Reader view
Choose the default article length.
Threat actors, malware campaigns, phishing, exploitation, and incident activity.
A fake Dubai Airports coding test ran from a Visual Studio project before compilation. Inspect the project target and developer-host staging path, then isolate matches.
Read article →Microsoft found a selective post-compromise implant paired with legitimate software and a same-name archive. Hunt the loader, archive and C2 together, then contain affected hosts.
Read article →A disguised signed MSP360 installer gave intruders one management channel, then installed ScreenConnect for another. Hunt the service-to-installer chain and restrict unapproved agents.
Read article →CISA lists the on-prem flaw as exploited. Check Edge certificate authentication, web-interface reachability and the affected release train before upgrading.
Read article →CERT/CC identifies trusted diagnostic shells with memory-write commands. Match the binary and firmware trust lists, then install vendor updates and verify DBX revocation.
Read article →CISA lists a LAN-reachable GS1900 CGI overflow as exploited. Match switch model and firmware to Zyxel’s fixes, then restrict management access.
Read article →Reply-stage archives lead to RedFlick scheduled tasks and CosmicPulse. Hunt the task names, trace the archive, and verify senders through a known channel.
Read article →CISA lists an exploited session flaw with code execution as the Zammad user. Zammad says 6.5 and older are exploitable; move those installations to 7.2.0 and triage exposure.
Read article →CAIRN groups malware candidates by AI-related metadata, then separates artifact presence from behavior and confirmed families. Triage noisy matches before calling an incident.
Read article →Microsoft tracked the same affiliate through four ransomware ecosystems. Hunt renamed MeshAgent services, domain-controller copies and cloud-transfer tooling before encryption.
Read article →A local zammad account can escalate to root. CISA lists exploitation; the vendor disputes the reported scope and recommends upgrading to 7.2.0.
Read article →CISA lists a RouterOS SSH rekey flaw as exploited. It lets unauthenticated clients reach a command path and can chain with a second flaw; update and restrict SSH.
Read article →CISA lists an exploited FortiMail arbitrary-file-write flaw. Fortinet urges operators to disable IBE or restrict management access while branch upgrades are forthcoming.
Read article →Showing 27–39 of 156
