1589 matches found
Bluenoroff Bypasses MoTW to Target Japanese Organizations
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Bluenoroff is known for targeting financial institutions and government organizations and has been active since at least 2014. From September onwards Bluenoroff threat actors added a new feature, that...
Internet Explorer Zero-Day Vulnerability Exploited by APT 37
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary North Korean hackers identified as APT37 exploited a previously unknown Internet Explorer zero-day vulnerability to infect South Koreans, North Korean defectors, policymakers, journalists, and human righ...
Attackers target Telecommunications sector to gain network access
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary To gain initial access, the adversary used social engineering to impersonate IT, staff, using phone calls, SMS, and/or Telegram. When the adversary gains access to the target environment, it performs...
Actors, Threats and Vulnerabilities 28 November – 4 December 2022
...
Do you know about an emerging new infostealer malware named DockLogs
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary DuckLogs is a new info-stealing malware variant, which is sold as Malware-as-a-Service MaaS product. It captures and exfiltrates data from infected PCs such as credentials, cookies, crypto wallets, brows...
Billbug returns after two years to conduct an espionage campaign
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary After being widely active in the year 2018-2019, Billbug, a Chinese state-sponsored group, is back after almost two years. They have been attacking multiple government agencies in an Asian country since...
Citrix Addresses Auth bypass Flaws Affecting ADC and Gateway Products
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Citrix has addressed bugs in Citrix ADC and Citrix Gateway. A remote intruder could exploit either of these flaws to obtain control of a susceptible system. To successfully exploit the vulnerabili...
LDR4 is a new Ursnif variant
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary In June 2022, a new aspect of the URSNIF malware was identified. Unlike prior URSNIF iterations, this new variation, code named LDR4, is a backdoor designed to facilitate operations such as ransomware an...
VMware could not fix a vulnerability that has been disclosed for eleven months
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary VMware disclosed a vulnerability in November 2021 that has not been fixed as of October 2022. VMware initially patched this vulnerability, but later discovered that it did not fix it. The...
BlackByte uses a new attack technique to target vulnerable Windows drivers
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary BlackByte Ransomware is leveraging a security flaw in a legitimate Windows driver to conduct a new bring your own vulnerable driver BYOVD attack...
Unknown Iranian attackers leverage vulnerabilities to conduct ransom operations
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Iranian government-sponsored actors carry out malicious cyber activities against a wide range of people and entities in the United States, Australia, Canada, and the United Kingdom by using known...
The 8220 Cryptomining Gang massively expands Cloud Botnets
Threat Level Actor Report For a detailed advisory, download the pdf file here Summary The 8220 gang has significantly expanded their cloud bot armies around the world, targeting AWS, Azure, GCP, Alitun, and QCloud cloud service hosts. The group is being detected using a new version of the IRC...
CloudMensis Spyware Actively Targets Apple macOS Users
...
Microsoft uncovers a macOS App Sandbox escape vulnerability
Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary Microsoft has recently discovered a vulnerability in macOS that allows third parties to bypass sandbox restrictions and execute malicious commands...
Microsoft releases updates for exploited zero-day and other vulnerabilities resulting in RCE
Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary Microsoft patch Tuesday addressed security updates for a Zero-day vulnerability that affects the entire operating system. The update includes bug fixes for Azure Site Recovery, Microsoft Edge...
Iranian APT targets Middle East’s Energy & Telecommunications industry
Threat Level Attack Report For a detailed advisory, download the pdf file here Summary A new campaign has been launched by a state-sponsored Iranian APT group, Lyceum to target organizations from the Middle East in the energy and telecommunication sectors. They have been observed deploying a new...
Attackers can bypass authentication in Cisco SMA & ESA
Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary An attacker can login into a web management interface of an affected system to perform bypass authentication remotely...
Security updates for Adobe Illustrator June 2022
Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary Adobe has released security updates in Adobe Illustrator that addresses critical vulnerabilities at priority 3 as per Adobe. These vulnerabilities could lead to arbitrary code execution on target systems...
How to Evolve Your Vulnerability Management to Threat Exposure Management
...
OldGremlin, a threat actor targeting Russian organizations with phishing emails since 2020
THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here After almost a year, OldGremlin made a comeback in March 2022 by resuming their malicious email campaigns against two Russian organizations. Over the last two years, OldGremlin has carried out 13 malicious email campaigns...
Attacks on European Union and Ukrainian government entities carried out by the Armageddon group
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The Computer Emergency Response Team of Ukraine CERT-UA has issued an alert warning of an ongoing spear-phishing attempt aimed at delivering an email with a malware attachment to Ukrainian government institutions and European...
New Threat Actor using Serpent Backdoor attacking French Entities
...
FIN8 Hacker group using new ‘White Rabbit’ Ransomware against U.S. Banks
THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here. White Rabbit is a ransomware family that has only recently been discovered. It could be a subsidiary project of the FIN8 hacking gang. A ransomware expert seeking for a sample of the malware made the first public disclosure...
Why VM Programs Suck
& From the Trenches This is the conversation I have with VM leads every week. It usually starts at minute thirty of a discovery call, after the official agenda is over and the Zoom faces relax. Someone says "can I be honest with you for a second?" — and then I get the list. Same complaints...
The Exploit Pipeline Just Went Autonomous.
& In February, I wrote about the breach zone — the gap between CVE disclosure and scanner signature. In April, I wrote that the breach zone became permanent when NIST stopped enriching the majority of CVEs. Both posts assumed the same ceiling: humans, working at human speed, are the bottleneck fo...
CTEM for Financial Services: Protect What Matters Most
Financial institutions process trillions of dollars in transactions every day. One exploited vulnerability can freeze operations, trigger regulatory penalties, and erode customer trust overnight. Traditional vulnerability management, which scans, scores, and queues patches, cannot keep pace with...
The Backlog Became Policy
& In February, we called the gap between CVE disclosure and scanner signatures the "breach zone." On April 15, 2026, NIST made that gap permanent — and signatureless detection stopped being an advantage. It became a requirement. This post updates Attackers Don't Need Signatures. Neither Should Yo...
Threat Intelligence for Exposure Management: How TI Powers Smarter CTEM Programs
Your security team has access to more vulnerability data than ever before. Scanners produce thousands of findings each week. Threat feeds deliver a steady stream of indicators. Yet most organizations still struggle with the same fundamental problem: deciding what to fix first. The disconnect...
How to Reduce Mean Time to Remediate (MTTR) in Cybersecurity
How to Reduce Mean Time to Remediate MTTR in Cybersecurity Every hour a vulnerability remains unpatched is an hour an attacker can use it against you. That window of exposure is exactly what Mean Time to Remediate MTTR measures, and for security leaders, it's one of the most consequential metrics...
What Is a “Next Generation” Vulnerability Management Solution?
You already know that running vulnerability scans is a fundamental part of cybersecurity. But what happens after the scan is finished? A long list of potential weaknesses without context is more overwhelming than helpful. A modern vulnerability management system goes far beyond simple scanning. I...
5 Best Threat Exposure Management Tools for 2025
A long list of vulnerabilities without context isn't a security strategy—it's just noise. Legacy vulnerability scanners are great at finding potential flaws, but they often fail to answer the most important question: "What should we fix right now?" This is why Threat Exposure Management TEM...
CISA Known Exploited Vulnerabilities May 2025: A Guide
Your vulnerability management backlog is probably overflowing. With thousands of new CVEs disclosed every year, it’s impossible to patch everything, and trying to do so leads to burnout and wasted effort. The CISA KEV catalog is the answer to this overwhelming noise. It’s not just another list of...
The Landmines CAASM Exposes That Your CMDB Pretends Don’t Exist
Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Click right here to hear it all on CAASM & CDMB Inefficiencies! Let’s be honest: a lot of the...
Critical Vulnerabilities Patched in Progress Software’s MOVEit
...
Moonstone Sleet: A New North Korean Cyber Threat
...
Kimsuky Expands Its Arsenal with New Backdoor
...
ToddyCat’s Toolkit and Tactics Fueling Data Theft
...
Zero-Day Flaw in Palo Alto Networks PAN-OS Patched After Active Exploitation
...
Attacks, Vulnerabilities and Actors 1 to 7 April 2024
...
Aiohttp Vulnerability Leveraged by ShadowSyndicate
Summary: The cybercriminal group ShadowSyndicate has been detected scanning for vulnerable servers, aiming to exploit a recently addressed vulnerability in the widely-used Aiohttp library. This exploit, if successful, could lead to unauthorized access to sensitive data on servers globally, posing...
Operation RusticWeb: Coordinated Strikes on Indian Government
Summary: Since October 2023, an orchestrated phishing campaign named Operation RusticWeb has been systematically targeting the Indian government and defense sector, deploying Rust-based malware for sophisticated intelligence gathering. Threat Level - Amber | Attack Report For a detailed threat...
Gaza Cybergang’s Pierogi++ Upgrade Takes Center Stage
Summary: The Gaza Cybergang, a sophisticated threat actor, has recently intensified its attacks by deploying an advanced version of the Pierogi backdoor malware. This group focuses its cyber operations primarily on Palestinian entities and Israel, with a historical record of targeting entities...
A New Face of AsyncRAT Utilizes WSF Scripts to Spread
Summary: AsyncRAT is a remote access trojan RAT malware known for stealing credentials and executing various malicious activities since 2019. Its recent variant, distributed through WSF script files, employs sophisticated fileless techniques, emphasizing the importance of user caution and robust...
CVSS 4.0 Decoded: Understanding & Implementing Changes
What is CVSS? The Common Vulnerability Scoring System CVSS is a vendor-agnostic, industry-open standard owned and maintained by The Forum of Incident Response and Security Teams FIRST. CVSS “provides a way to capture the principal characteristics of a vulnerability and produce a numerical score...
Iran-Backed Agrius APT’s Attacks on Israeli Institutions
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary In a series of harmful cyberattacks that occurred from January 2023 to October 2023, the Iranian-backed Advanced Persistent Threat APT group known as Agrius targeted Israels education and technology...
From Bullets to Bytes The Hamas-Israel Conflict Goes Digital
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary In the midst of the ongoing Israeli-Hamas conflict, a group of pro-Hamas hacktivists has emerged, utilizing a sophisticated Linux-based wiper malware known as BiBi-Linux Wiper. In the broader context of...
China’s Cyber Espionage Targets Semiconductor Giants in East Asia
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary In recent cyber espionage activities, threat actors affiliated with the Peoples Republic of China PRC have targeted semiconductor companies operating in Mandarin/Chinese-speaking regions of East Asia...
Charming Kitten’s ‘Sponsor’ Strikes 34 Organizations in Brazil, Israel, and U.A.E
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Charming Kitten, also known as Ballistic Bobcat, orchestrated a sophisticated campaign aimed at 34 diverse targets across Brazil, Israel, and the United Arab Emirates. This operation employed a novel...
LOLKEK Ransomware Evolving New Tactics to Evade Detection
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary LOLKEK ransomware is still being actively developed and uses new tactics to evade detection, including obfuscation, legitimate tools, and network shares. It encrypts all drives, including network shares,...
New Rilide Stealer Version Evades Chrome Manifest V3 Protections
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new version of the Rilide Stealer malware, evading Chromes security measures to target Chromium-based browsers in campaigns that exploit user trust through fake plugins and games, posing a significant...