Threat actor activity and indicators
A recent Iranian cyber campaign has set its sights on a staggering 3,900 exposed devices in US infrastructure, putting energy, water, and government services at risk. This large-scale threat is a clear warning sign that these critical systems may be vulnerable to attack.
The FBI recently disrupted a sneaky espionage operation run by APT28, a Russian GRU-linked group notorious for its broad reach, by cutting off their access to a network of routers they used as a launching pad for further attacks. This bold move effectively severed the group's tremendous access, putting a stop to their clever tactics.
Meet the shadowy hack-for-hire group with ties to India that's targeting journalists and activists in the Middle East and North Africa, silencing voices and stifling free speech. Their sinister operations have been uncovered by security researchers, revealing a chilling espionage trade where reporters, officials, and dissenting voices are prime targets.
The Bitter APT Group has been linked to a sophisticated year-long spear-phishing campaign that targeted the Middle East, using deceptive emails to spread its reach. This hack-for-hire effort, attributed to a South Asian connection, signals a sustained threat to the region's security.
Hackers known as UNC6783 are exploiting business process outsourcing providers to gain access to sensitive corporate support tickets on platforms like Zendesk, putting high-value companies across multiple sectors at risk. This sneaky tactic opens the door for cybercriminals to infiltrate and wreak havoc on unsuspecting organizations.
The Cybersecurity and Infrastructure Security Agency (CISA) has sounded the alarm: Iranian-linked cyber actors are targeting US critical infrastructure, posing a threat to public safety, services, and commerce. American organizations must take immediate action to assess their risk and bolster defenses.
In a major cyber takedown, the FBI has successfully disrupted a Russian hacker network by pulling the plug on compromised US-based routers, effectively cutting off the threat actor's malicious infrastructure. This bold move allowed authorities to neutralize the threat without relying on individual device owners to take action.
US critical infrastructure providers are reeling from a wake-up call after Iranian-backed hackers exploited weaknesses in internet-exposed operational technology assets, causing disruption and financial loss. The alarming breach, revealed by the Cybersecurity and Infrastructure Security Agency, highlights the high stakes of vulnerable systems.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Discover the alarming evolution of cyber threats in Mandiant's M-Trends 2026 report, which reveals a stark reality: attackers are now operating under two distinct playbooks, drastically changing the detection, response, and risk landscape. The report uncovers a significant increase in global median dwell time to 14 days, with some attacks lingering for as long as 122 days.
Get ready to face the future of cyber threats! The Kaspersky Security Services report delivers eye-opening insights into the evolving cyberattack landscape, combining real-world incident response findings with hard data from its Managed Detection and Response service.
Censys just secured $70 million in funding to supercharge its AI-driven threat intelligence platform, giving defenders real-time visibility into the global network's underlying infrastructure. This game-changing tech helps defenders stay one step ahead of attackers by mapping and monitoring the internet's technical surface.
Weeks of frustrating disruptions have left Outlook mobile and macOS users struggling to access their Exchange Online mailboxes, sparking a flurry of questions about reliability and resolution. Microsoft is actively investigating the issue, but for affected users, the wait for a fix continues.
This week's string of high-profile crypto hacks, indictments, and regulatory moves exposes a growing dilemma: as decentralized finance and crypto markets expand, the lines between crime, commerce, and policy are becoming increasingly blurred. From charged crypto hacks to fentanyl cases, the seams where these worlds meet are fraying in plain sight.
Microsoft is investigating a frustrating issue affecting Classic Outlook users, preventing them from sending emails via Outlook.com due to a bug linked to broader email delivery problems. The disruption is causing inconvenience for users relying on seamless communication.
The US and UK are racing against time to outsmart a growing maritime threat: underwater attack drones that can devastate ships, harbors, and critical infrastructure. With a joint call for tech tenders and a tight deadline of April 3, they're on a mission to find cutting-edge solutions before it's too late.
Think the most isolated machines are untouchable? North Korea’s APT37 has broadened its toolkit — combining believable lures with new utilities that can defeat air‑gap protections and put highly sensitive systems at fresh risk.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
A throwaway 2016 email from Vincenzo lozzo casually dismissing Bruce Schneier cracks open the Epstein files; what looks like a ledger of crimes is also a map of how the wealthy and tech‑savvy shaped conversations about privacy, security and reputation.
Ever wondered what happens when trusted doors are left unlocked? This ThreatsDay Bulletin shows how trusted attack chains—everyday files, SMS, cloud APIs and smart contracts—are being repurposed into stealthy, high‑leverage strikes and what you can do to shut them down.
A decade after Aaron Swartz, AI’s hunger for research risks putting a few corporations in charge of access to knowledge — deciding what we can learn, who benefits, and which ideas get heard.
For 16 years KrebsOnSecurity has pulled back the curtain on the criminal plumbing—bulletproof hosts, access brokers and resilient intermediaries—showing why targeting those enablers, not just the flashy attacks, is the real path to stopping cybercrime.
Think essay mills are just a campus nuisance? A new investigation reveals a $25M ad‑driven cheating network that used Google search ads to funnel students to essay services — and whose money trail ties to a Kremlin‑connected oligarch and a Russian university involved in attack drone development, turning academic dishonesty into a national security worry.
Get the inside scoop on a $25M essay mill tying drones to diplomas—our exclusive exposé reveals how the scheme works and why it matters for students and educators alike.
Meet Rey—the pseudonymous face of Scattered LAPSUS$ Hunters—who unexpectedly lifted his veil after KrebsOnSecurity traced him to his father and secured an interview. That admission could shatter the groups anonymity and change the game for investigators, rivals and recruits.
AI-enabled threats are already reshaping the attack landscape—making reconnaissance, social engineering and vulnerability hunting faster and cheaper. Bitdefender’s data-driven webinar cuts through the headlines to show boards and C‑suites which risks merit action and which are just noise.