Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Ep 4: Naming and Shaming

As Chinese hackers continue their raid of American companies, the threat reaches new levels of urgency, not so much for the sophistication of these hackers, but because of the sheer volume of attacks. And yet, victims continue to keep their breaches under wraps, and the government is hamstrung in what they can say because most everything they know about Chinese cyberespionage is classified.

Malware hiding in plain sight: Spying on North Korean Hackers

On March 13th 2025, our malware analysis engine alerted us to a potential malicious package that was added to NPM. First indications suggested this would be a clear-cut case, however, when we started peeling back the layers things weren’t quite as they seemed. Here is a story about how sophisticated nation state actors can hide malware within packages.

Launching Aikido Malware - Open Source Threat Feed

Our Aikido Intel team has been identifying undisclosed open-source vulnerabilities using LLM-driven analysis and human verification. Now, we’re expanding our supply chain security research to detect and track malware in open-source packages, cheaper, better, & faster than what exists today.

SquareX Discloses Browser-Native Ransomware that Puts Millions at Risk

From WannaCry to the MGM Resorts Hack, ransomware remains one of the most damaging cyberthreats to plague enterprises. Chainalysis estimates that corporations spend nearly $1 billion dollars on ransom each year, but the greater cost often comes from the reputational damage and operational disruption caused by the attack.

ARaaStocracy - RALord ransomware emerges with new DLS

The latest data leaks site (DLS) CYJAX has identified is titled RALord, which constitutes one of 14 new DLSs identified in March 2025 alone. This Ransomware-as-a-Service (RaaS) group appears to be sophisticated and professional, providing services including affiliates, data ransoms, and dark web advertisements. It has been reported that the group is active on at least one cybercriminal forum under the username ‘ForLord’.

Civilian Cyber Corps: Protecting Underfunded Organizations

Welcome to the Data Security Decoded podcast by Rubrik Zero Labs. In this episode, our host, Caleb Tolin, is joined by Michael Razeeq, a cybersecurity policy researcher specializing in advocating for Civilian Cyber Corps (C3s). Michael shares insights into how these volunteer forces, C3s, are transforming community cyber defense, addressing workforce shortages, and providing both preventive and reactive cybersecurity services to underfunded organizations.

Ransomware and Healthcare: How To Defend Against Evolving Cyber Threats

Given today’s reality of cyber security, healthcare organizations are always at risk of getting attacked. A Sophos‘s study outlines that out of the surveyed organizations, 59% have been impacted by ransomware attacks in 2024. What is more – only 22% have actually fully recovered in less than a week. However, for 37% of those institutions, it took over a month to recover. This is why it is crucial to adhere to regulatory frameworks and keep your data secured to the highest standard.

BONUS: Live Panel with Top China & Cyber Experts at The New York Stock Exchange

For this special live recording of To Catch a Thief at The New York Stock Exchange, host and former lead cybersecurity and digital espionage reporter for The New York Times, Nicole Perlroth sits down with those who have been directly targeted by, traced, or directly engaged China’s state-sponsored hackers, diplomatically, or in the cyber domain.

Frag explodes onto the scene - New DLS emerges for Frag ransomware

In 2024, Cyjax observed the emergence of 72 extortion and ransomware group data-leak sites (DLSs). As of late March 2025, Cyjax has identified DLSs for 21 new groups this year, as noted in recent blogs on Morpheus, GD LockerSec, Babuk2, Linkc, Anubis, and Arkana. The latest DLS Cyjax has identified is named Frag, which constitutes one of 14 new DLSs identified in March 2025 alone.

Master Malware Analysis: Boost Your Skills with This In-Depth Course

In today's rapidly changing technological landscape, information quickly becomes outdated. That's why strong practical skills and experience are so important for tech specialists. A solid skillset guarantees that they'll be ready to explore the uncharted territory of constantly evolving tools and emerging threats. But how do you achieve that as an aspiring cybersecurity specialist? Despite the fact that cybercrimes are on the rise and cybersecurity specialists are in high demand, there aren't many educational products that offer relevant hands-on knowledge in this field.

Why Your Security Training Is Failing

"We have an attention span of around 1.8 seconds" - Carolin Desirée Toepfer explains why traditional security training isn't working. Learn how repetition and psychology-based approaches can drive real behavior change instead of just checking compliance boxes. Watch this episode of Data Security Decoded for research-backed insights from the founder of a cybersecurity edtech platform.

Ransomware Warning - A Silent Threat Hits Every 39 Seconds

Assume starting your weekday with a cup of coffee and being prepared to take on the tasks of the day. Suddenly you notice something unusual as the machine starts. The previously accessed files disappear, and the screen flickers. A red notice appears stating the files have been encrypted and the data would be permanently deleted unless a total of ten million dollars in Bitcoin is paid within 48 hours.

Who broke the Internet? Arkana Security names U.S. broadband provider on new DLS

In 2024, Cyjax observed the emergence of 72 extortion and ransomware group data-leak sites (DLSs). As of late March 2025, Cyjax has identified DLSs for 19 new groups this year, as noted in recent blogs on extortion groups Morpheus, GD LockerSec, Babuk2, Linkc, and Anubis.

Hundreds of Malicious Android Apps Received 60 Million Downloads

Bitdefender warns that a major ad fraud campaign in the Google Play Store resulted in more than 60 million downloads of malicious apps. The attackers managed to place at least 331 malicious apps in the Play Store. In addition to displaying full-screen ads, some of the apps also directed users to phishing sites designed to harvest their credentials. “Most applications first became active on Google Play in Q3 2024,” Bitdefender says.

Security Bulletin: QakBot/Qbot Malware

QakBot (also known as Qbot or Pinkslipbot) is a highly adaptive malware that has evolved over the past decade to evade security defenses. Initially developed as a banking trojan to steal financial data, it has since expanded its capabilities, employing advanced evasion techniques and a modular architecture to facilitate credential theft, lateral movement, and ransomware deployment.

BlackLock Ransomware: What You Need To Know

BlackLock is a relatively new ransomware group. First seen in March 2024, the ransomware operation initially operated under the name El Dorado, before rebranding as BlackLock late last year. BlackLock follows a RaaS (ransomware-as-a-service) business model, leasing its tools and infrastructure to affiliates who launch attacks, sharing a proportion of the proceeds with BlackLock.

How to Effectively Train Your Employees on Cybersecurity

Welcome to the Data Security Decoded podcast. In this episode, our host, Richard Cassidy, is joined by Carolin Desirée Toepfer, founder of Cyttraction and CISO as a Service for multiple organizations across Europe and North America. Carolin shares her journey from building websites and online communities to becoming a cybersecurity leader, offering insights into the unique challenges of European cybersecurity, AI security frameworks, and transforming cybersecurity training into data integrity training that better aligns with business needs.

Cybersecurity Essentials for Startups

Launching a startup is an exciting venture. From conducting market research to defining your value proposition and developing a solid business plan, laying the groundwork for your business requires careful planning and diligence. Another key factor to consider is funding. Whether through investors, crowdfunding, or alternative financing options like private loans, securing adequate capital is essential for success.

How Attackers Use AI To Spread Malware On GitHub

Github Copilot became the subject of critical security concerns, mainly because of jailbreak vulnerabilities that allow attackers to modify the tool’s behavior. Two attack vectors – Affirmation Jailbreak and Proxy Hijack – lead to malicious code generation and unauthorized access to premium AI models. But that’s not all. Contents hide 1 Jailbreaking GitHub Copilot 1.1 Affirmation jailbreak? “Sure,” let’s exploit the AI system(s) 2 Proxy Hijack.

When Security Fails: Be READY | Former Federal CIO Warning

"Something's going to happen." Maria Roat, former Deputy Federal CIO, delivers a wake-up call about the inevitable nature of security incidents. In this crucial clip from Data Security Decoded, Maria reveals why response preparation is everything and how to minimize damage when (not if) breaches occur. Don't wait until "all your data went out the door" - learn proactive strategies from a federal tech leader who's seen it all!

Security is NOT a Tech Problem: It's BUSINESS | CIO Reveals Board-Level Truth

Aysha Khan, CIO & CISO at Treasure Data, drops a truth bomb: "Security isn't a tech problem—it's a BUSINESS problem." In this eye-opening clip from, Aysha explains why cybersecurity deserves a seat at the board table and how empowering your CISO creates true organizational resilience. Listen to the full episode to discover why your security strategy might be fundamentally flawed!

What is Turbo Threat Hunting?

Rapid, reliable has never been so easy. Keep your business moving forward at lightning speed with Turbo Threat Hunting. With the ability to proactively scan 75,000 backups in less than 60 seconds, you can recover and get back up to speed in record time. Time is money, especially when it comes to recovering and getting your business back up and running!

Widespread Fake CAPTCHA Campaign Delivering Malware

Arctic Wolf has recently observed a campaign in which threat actors are compromising widely used websites across various industries and embedding a fake CAPTCHA challenge. When victims visit the site, they are presented with the CAPTCHA challenge or redirected to a site that provides instructions, triggering PowerShell code execution and ultimately leading to the loading of information stealer malware.

Medusa Ransomware: FBI and CISA Urge Organizations to Act Now to Mitigate Threat

The Medusa ransomware gang continues to present a major threat to the critical infrastructure sector, according to a newly-released joint advisory from the FBI, Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC).

SafeBreach Coverage for US CERT AA25-071A (Medusa Ransomware)

On March 12, 2025, the Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the Federal Bureau of Investigation (FBI) and the Multi-State Information Sharing and Analysis Center (MS-ISAC), issued a joint Cybersecurity Advisory (CSA) titled “#StopRansomware: Medusa Ransomware” (Alert Code: AA25-071A).

The Mike Tyson Approach to Cybersecurity: Beyond Prevention

Everyone has a plan until they get punched in the face - and cyberattacks are that punch. While traditional security focuses on prevention, true resilience comes from how you respond and recover. Learn why organizations must build better infrastructure, processes, and talent post-breach instead of rushing back to normal operations. The human toll of attacks is real, but avoiding post-incident reflection is the biggest mistake you can make.

Beware: Malvertising Campaign Hits Nearly a Million Devices

Microsoft warns that a widespread malvertising campaign hit nearly one million devices around the world. The campaign, which began on illegal streaming sites, impacted both consumer and enterprise devices across a wide range of industries. “Analysis of the redirector chain determined the attack likely originated from illegal streaming websites where users can watch pirated videos,” Microsoft says.

Combating Ransomware, Phishing, and Zelle Fraud at Financial and Bank SOCs

Banking and financial services companies sit on a goldmine of sensitive customer data, making them a prime target for phishing and ransomware attackers hoping to strike a payout. Even with defenses like MFA and security training, human error continues to be a critical point of failure for financial institutions — a 2024 report found that 3 out of every 1000 individuals working in banking click on a phishing link each month.

Resurgence of a Fake Captcha Malware Campaign

During an Advanced Continual Threat Hunt (ACTH) investigation in early February 2025, Trustwave SpiderLabs discovered a resurgence of fake CAPTCHA verifications designed to deceive victims into executing malicious PowerShell scripts. This campaign employs a multi-stage PowerShell execution process, ultimately delivering infostealers such as Lumma and Vidar.

The True Cost of Cloud-Native Backups: Are You Paying More Than You Think?

For IT decision-makers, the public cloud has become a game-changer. Scalability, agility, and elasticity are just a few of the many benefits that have driven more organizations to adopt public clouds such as AWS, Microsoft Azure, and Google Cloud. But with cyber threats on the rise, ensuring business-critical cloud data is protected and rapidly recoverable while optimizing cloud costs can feel like a difficult balancing act.

Understanding the IAM Blast Radius

In this episode of Into the Breach, James Purvis and Mike Schmidt delve into the concept of the IAM (Identity and Access Management) blast radius and its impact on modern security practices. They explore how DSPM (Data Security Posture Management) helps reduce noise, focus on sensitive data, and implement proactive least-privilege models to mitigate risks in cloud and SaaS environments. Learn how understanding the interplay between identities and data can enhance security outcomes and minimize the blast radius of breaches.

The Harsh Reality of Ransomware Attacks: It's Not a 4-Hour Fix

Even well-prepared organizations with strong security are surprised by the intensity and length of cyber attacks. Heather Hughes notes that many expect quick solutions but are unprepared for the reality. "This process isn't over in two days," she explains, countering the myth of a 'big red button' fix. For more on how organizations should prepare, hear Heather, VP at Aon Cyber Solutions in the latest episode of podcast.

Analyzing Elysium, a Variant of the Ghost (Cring) Ransomware Family

In February 2025, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) published a cybersecurity advisory to share information about the Ghost (Cring) ransomware and its techniques. The group behind this ransomware started its activities around 2021 by attacking public-facing applications running outdated versions.

The Akira ransomware exploit: Detecting IoT-based threats with Sumo Logic

In a recent and sophisticated cyberattack, the Akira ransomware group leveraged an unsecured Linux-based webcam to infiltrate a corporate network. By exploiting this overlooked IoT device, the attackers successfully bypassed traditional Endpoint Detection and Response (EDR) solutions, ultimately encrypting network shares and causing widespread damage.

HUNTUBS Ransomware Attack on Tata Technologies: A Major Cybersecurity Breach

Cybersecurity incidents continue to make headlines, with the latest victim being Tata Technologies, a leading global engineering and technology services company. The HUNTUBS ransomware group has claimed responsibility for a major attack, leaking sensitive corporate data. The incident, which resulted in the theft of 1.4 TB of confidential data, has raised concerns about cybersecurity resilience among major enterprises.

Captain MassJacker Sparrow: Uncovering the Malware's Buried Treasure

Cryptojacking malware—a type of malware that tries to steal cryptocurrencies from users on infected machines. Curiously, this kind of malware isn’t nearly as famous as ransomware or even infostealer malware. We found this kind of strange since cryptocurrencies have been a popular subject in recent years, so you would think that malware that dabbles in the field would make some more headlines.

Warning: Ransomware Threats Increased Fourfold in 2024

Researchers at Barracuda observed a fourfold increase in ransomware threats last year, driven by increasingly sophisticated ransomware-as-a-service (RaaS) operations. “The developers behind RaaS platforms often have the time, resources, and skills to invest heavily in advanced and evasive toolsets and templates,” Barracuda explains.

Prevent, Detect, Contain: LevelBlue MDR's Guide Against Black Basta Affiliates' Attacks

Between December 2024 and February 2025, the LevelBlue MDR team saw over a dozen attempts and a handful of successful intrusions by threat actors (TAs). Internally, we broadly attribute these attacks to the Black Basta ransomware gang. As outlined by other cybersecurity researchers’ reporting of similar tactics, techniques, and procedures (TTPs) observed; there is a high probability that this activity is from affiliate groups or initial access brokers.

SquareX Unveils Polymorphic Extensions that Morph Infostealers into Any Browser Extension - Password Managers, Wallets at Risk

With recent attack disclosures like Browser Syncjacking and extension infostealers, browser extensions have become a primary security concern at many organizations. SquareX's research team discovers a new class of malicious extensions that can impersonate any extension installed on the victim's browser, including password managers and crypto wallets.

Data at Risk: 96% of Ransomware Attacks Involve Data Theft

A new report from Arctic Wolf has found that 96% of ransomware attacks now involve data theft as criminals seek to force victims to pay up. “As potential victims implemented more reliable backup and restoration processes, ransomware operators introduced data exfiltration as a means to apply additional pressure and protect their revenue streams,” Arctic Wolf says.

Unveiling EncryptHub: Analysis of a multi-stage malware campaign

EncryptHub, a rising cybercriminal entity, has recently caught the attention of multiple threat intelligence teams, including our own (Outpost24’s KrakenLabs). While other reports have begun to shed light on this actor’s operations, our investigation goes a step further, uncovering previously unseen aspects of their infrastructure, tooling, and behavioral patterns.

Breaking Down Ransomware-as-a-Service

Ransomware-as-a-service is a business model where ransomware operators and third parties, called “affiliates,” work together to launch ransomware attacks. RaaS was first identified in 2012 with the Reveton ransomware strain, and in the subsequent decade it has exploded into a sophisticated and ever-evolving cybercrime tactic.

Byte Back: Next-Generation Malware Classification Using Binary Transformers

In recent years, Transformer models have been the backbone of the revolution within the artificial intelligence sector. They are the basis of large language models (LLMs) and responsible for LLMs’ ability to understand and generate text of a human-like quality. Transformers are able to learn long-range interactions between words and sentences, allowing them to retain high-level concepts and insights into their training data.

A Deep Dive into Strela Stealer and how it Targets European Countries

Infostealers have dominated the malware landscape due to the ease of threat operations maintenance, and a wide group of potential victims. In this blog, we take a closer look at a unique infostealer designed to precisely target a narrow data set on systems located in chosen geographic locations. The Strela Stealer (rus. Cтрела, lit. 'Arrow') is an infostealer that exfiltrates email log-in credentials and has been in the wild since late 2022.

Cactus Ransomware: What You Need To Know

Cactus is a ransomware-as-a-service (RaaS) group that encrypts victim's data and demands a ransom for a decryption key. Hundreds of organisations have found themselves the victim of Cactus since it was first discovered in March 2023, with their stolen data published on the dark web as an "incentive" to give in to the extortionists' demands.

February 2025 Cybersecurity Consulting Updates and Ransomware Activity

Each month, we break down critical cybersecurity developments, equipping security professionals with actionable intelligence to strengthen defenses. Beyond threat awareness, this blog also provides insights into incident readiness and response, drawing from real-world experiences in consulting cybersecurity services. Learn how organizations can proactively prepare for cyber incidents, mitigate risks, and enhance their resilience against evolving attack vectors.

Trouble Brewing: Dissecting a fake homebrew update that stole user data

A few weeks ago, a malware campaign that leveraged Google Ads to promote a fake Homebrew website caught my attention. It tricked users into running an installer command that downloaded and executed a malicious binary resulting in an info stealer being introduced to the user’s machine.

People and Process Drive Technology: Modern Ways to Bridge IT Ops and Security

In this episode of Into the Breach, James Purvis and Mike Schmidt tackle the evolving relationship between IT Ops and IT Security. They discuss how eliminating silos, adopting a people-and-process-driven approach, and embracing platformization can bridge the gap between these traditionally separate teams. Learn how modern organizations are shifting from best-of-breed solutions to integrated platforms to improve collaboration, streamline workflows, and achieve faster, more effective outcomes as cloud adoption skyrockets.

The Rise of Perfect Clones: The Darcula Phishkit and How to Stop It

It’s no secret that phishing has always relied on deception. Scam-targeted enterprises the world over warn their customers of the social engineering tactics and brand impersonation designed to trick them into handing over credentials. Besides email-based phishing, social media has become a hotbed for phishing attacks, with scammers using fake ads, impersonated accounts, and fraudulent messages to lure users.

Never Let a Good Crisis Go to Waste - CISO's Powerful Take on Security Improvement

Amy Bogac, CISO at Elevate Textiles, shares her candid approach to cybersecurity program management. She emphasizes the importance of distinguishing between immediate fixes and long-term improvements after security incidents. Key insights: Set clear boundaries between incident resolution and continuous improvement Use security incidents as leverage for necessary program investments Learn from every crisis to strengthen your security posture Distinguish between short-term fixes and long-term strategic improvements.

Modern Storage Meets Cyber Resilience: The Rubrik and Pure Storage Solution Architecture for Unstructured Data

Additional contributor: Dan Kogan, VP of Enterprise Growth and Solutions at Pure Storage Rubrik and Pure Storage have partnered to deliver a reference architecture solution that enables organizations to unify, manage, and secure unstructured data at scale. According to projections from UBS, data volumes will reach as much as 660 zettabytes—or 129GB per person on Earth—by 2030.

VGod Ransomware Analysis: Golang-Based Threat with ChaCha8 and AES Encryption, Persistence, and Mitigation

Ransomware remains one of the most pressing cybersecurity threats, affecting individuals and organizations worldwide. Among the latest ransomware strains making headlines is VGOD ransomware, known for its advanced encryption techniques and aggressive attack methods. In this blog, we will explore the workings of VGOD ransomware, recent incidents, and the critical lessons organizations must learn to protect against such threats.