Tag: threat actor
43 articles
cloud backup service Risky Breach: Must-Have Fixes
SonicWall says attackers accessed cloud backup files holding encrypted firewall credentials and configs — turning the safety net meant to speed recovery into a potential roadmap for targeted attacks. If you used their Cloud Backup, assume exposure: rotate keys and credentials, review firewall and VPN access, and verify your backups and key management now.
SnakeDisk worm: Stunning Risky Thai-Targeted Threat
A China-aligned group called Mustang Panda has paired an updated TONESHELL backdoor with a USB worm named SnakeDisk that only activates for Thailand-based devices to drop a persistent Yokai backdoor — a surgical, geographically targeted campaign that ups the stakes for anyone who plugs in removable media. Stay cautious with USB drives and tighten removable-media policies: this is a reminder that one careless plug can invite long-term access.
AI-powered operations: Stunning Exposure, Defender Win
An attacker’s bid for stealth backfired when legitimate security software exposed their AI‑assisted playbook — Huntress telemetry captured model‑like artifacts that turned a covert campaign into a forensic treasure trove, proving AI speeds attacks but also leaves telltale traces defenders can use.
signed Windows kernel driver: Stunning Risky Backdoor
When a Microsoft‑signed WatchDog driver (amsdk.sys) was abused to neuter endpoint defenses and plant ValleyRAT, it proved that a valid signature isn’t a guarantee of safety. This Silver Fox campaign underscores why organizations must stop trusting signatures alone and add behavior‑based controls and tighter vetting for privileged drivers.
APT28 LameHug: Exclusive Risky AI Threat Warning
MITRE’s take on APT28’s LameHug at Black Hat is a wake-up call: while crude now, this testbed shows how AI and automation could quickly turn basic tools into powerful cyber weapons. Defenders, policymakers, and everyday users should sharpen defenses and share intel now—before experiments like this graduate into routine attacks.
QR Phishing FIDO Keys: Exclusive Risky Threat Revealed
Think your FIDO key makes you untouchable? PoisonSeed’s QR‑phishing scam shows how a convincing QR scan and fake approval prompt can trick users into granting access—learn how these attacks work and what simple steps you can take to stay safe.
Threat Actor Targets Indian Defense Sector: Key Insights Revealed
Discover how the elusive APT36 cyber-espionage group is stealthily targeting Indias defense sector, revealing the urgent need for stronger digital defenses in a world where cyber warfare reshapes national security.
Threat Actor Targets Indian Defense Sector in Rising Cyberattack
A stealthy cyber threat group is intensifying attacks on Indias defense networks, revealing how vulnerable even the most secure secrets can be in today’s digital battlefield.
Threat Actor Targeting Indian Defense Sector Raises Security Alarms
A sophisticated cyber-espionage group is zeroing in on India’s defense sector, exposing critical vulnerabilities and sparking urgent calls for stronger digital defenses to protect national security.
Texas Dept. of Transportation breached, 300k crash records stolen
Texas Dept. of Transportation breach: 300K crash records stolen, raising major data security concerns and prompting urgent investigations.
APT41 Leverages Google Calendar for Stealthy Malware Control Operations
APT41 leverages Google Calendar to manage covert malware operations, using scheduled commands to hide control activities and evade detection.
Craft CMS Vulnerability: Hackers Exploit CVE-2025-32432 to Deploy Cryptominer and Proxyware
Craft CMS vulnerability (CVE-2025-32432) exploited by hackers to deploy cryptominer and proxyware, compromising system security and data integrity.
Chrome Unveils One-Click Update for Compromised Passwords
Chrome introduces a one-click update for compromised passwords, streamlining security and simplifying password management for safer browsing.
Twilio Refutes Breach Allegations Amid Alleged Steam 2FA Code Leak
Twilio denies breach allegations amid claims of a leaked Steam 2FA code. Discover the facts behind the security controversy and the company’s firm denial.
DPRK-Backed TA406 Targets Ukraine With Malware Campaigns
DPRK-backed TA406 targets Ukraine with malware campaigns. Discover its tactics, evolving cyber threats, and the potential impact on regional security.
Chinese hackers behind attacks targeting SAP NetWeaver servers
Chinese hackers behind targeted attacks on SAP NetWeaver servers exploit vulnerabilities, escalating global cybersecurity concerns.
Commvault Confirms Hackers Exploited CVE-2025-3928 as Zero-Day in Azure Breach
Commvault confirms hackers exploited CVE-2025-3928, a zero-day vulnerability in an Azure breach, exposing critical flaws and prompting urgent security reviews.
Mustang Panda Expands Operations in Myanmar with StarProxy, EDR Bypass, and TONESHELL Enhancements
Mustang Panda expands in Myanmar, enhancing operations with StarProxy, EDR bypass techniques, and TONESHELL improvements for advanced cyber capabilities.
New Chinese-Linked Backdoor Threatens European Companies
A new Chinese-linked backdoor poses a significant threat to European companies, compromising security and sensitive data across various industries.