UAT-6275 uses a WinRAR flaw to plant a shell in CIS government attacks
Cisco Talos traces four delivery routes across nine countries. Hunt Startup-folder changes and unexpected PowerShell, then update affected Windows archive tools.
Read article →threats
Threat actors, malware campaigns, phishing, exploitation, and incident activity.
Latest in threats
FBI Disrupts Laptop Farms Behind North Korean Remote Hires
CrowdStrike says fake employees used U.S. homes to run company laptops remotely. Inspect shipping changes, remote-access tools and hiring records together.
Read article →
Attackers Hid PEERSTITCH in Fortinet Firewalls After Manager Breach
A stolen FortiManager archive helped attackers reach managed FortiGates; a memory-only implant linked logging and VPN processes. Check revisions and rotate trust material.
Read article →
Volexity Volcano Recovers Browser Exploit Traces After Cleanup
A replayed Chrome-to-Windows intrusion left encoded script in free memory. Capture RAM early, then use host artifacts to guide wider collection.
Read article →
Fortinet CLI Flaw Lets Privileged Attackers Change Appliance Files
CISA added a flaw affecting four Fortinet products to KEV. Match installed releases to Fortinet's fixes, then examine privileged CLI access and file changes.
Read article →
Cisco Email Gateway Attachment Flaw Gives Attackers Root Access
Exploited file-write flaw reaches gateways using File Reputation and older scanner tools. Check each appliance's logs and scanner version before choosing an update or rebuild.
Read article →
CL-UNK-1211 Plants PHP Web Shells on Government Linux Servers
Attackers changed PHP configuration to reload a web shell, stole passwords through a sudo alias and searched government mailboxes for social media access.
Read article →
Attackers Briefly Hijacked AOMEI Updates to Plant Backdoors
UNC7017 changed two AOMEI configuration files for minutes at a time. Hunt updater-launched files and scheduled tasks even after the vendor restored its servers.
Read article →
ARMORY CASTLE Uses BeyondTrust Zero-Day to Keep Root Access
The actor exploited Remote Support, installed a root backdoor and reached managed endpoints. Patch BT26-05, then investigate appliance persistence and sessions.
Read article →
Palo Alto Networks PAN-OS Flaw Lets Attackers Run Code as Root
Limited exploitation targets authenticated access to PAN-OS management. Compare installed hotfixes, restrict the admin path and inspect three vendor-listed IPs.
Read article →
YAM Store sells Microsoft and Google cloud access to phishing crews
Microsoft traces a broker reselling cloud tenant access and storage to phishing kits. Examine app credentials, privileged grants and hosted files in affected tenants.
Read article →
Fake WatchGuard VPN download takes passwords before serving the real client
A lookalike download page collects the VPN server and credentials twice, then starts a signed WatchGuard installer. Check browser history and VPN logins.
Read article →
Ivanti VPN Zero-Days Let UTA0576 Reach Root and Steal Credentials
A patched-at-the-time Connect Secure VPN fell to a three-flaw chain. Upgrade affected branches and investigate memory, LDAP traffic and movement from the appliance.
Read article →Showing 1–13 of 156