Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Trustwave

SpiderLabs Ransomware Tracker Update September 2025: Qilin, Akira Top Ransomware Attackers

Sep 30, 2025 By Trustwave In Trustwave
The threat groups Qilin and Akira together conducted about one-quarter of the 402 ransomware attacks tracked by Trustwave SpiderLabs in September, with the manufacturing and technology sectors receiving the brunt of these efforts. This information was derived from a new SpiderLabs ransomware tracking tool that gathers information from a variety of open intelligence sources and our own proprietary research.
Read Post
Corelight

Hunting GTPDOOR: The case of the "Black Hat Positive"

Sep 29, 2025 By Ben Reardon In Corelight
Ben Reardon, Lead Researcher Corelight Labs / NOC crew I'm a researcher on the Labs team at Corelight and, for me, working in the Black Hat Network Operations Center (NOC) at the USA show in Las Vegas is up there as one of the most interesting and intense activities on the calendar.
Read Post
Preventing Data Breaches: Essential Steps Your Business Needs Today

Preventing Data Breaches: Essential Steps Your Business Needs Today

Sep 26, 2025 By SecuritySenses In SecuritySenses
The average total cost of a data breach is now $3.86 million, making prevention a top priority for businesses of every size. Yet most organizations still struggle to stay ahead. Studies reveal that it takes nearly 280 days on average to identify and contain a breach, and the shift to remote work has only made matters worse. More than three quarters of companies report longer detection and containment times, adding an estimated $137,000 to the cost of each incident.
Read Post
outpost 24

Olymp Loader: A new Malware-as-a-Service written in Assembly

Sep 25, 2025 By Lidia López Sanz In Outpost 24
Olymp Loader is a Malware-as-a-Service (MaaS) advertised on underground forums and Telegram since June 5, 2025. The seller, “OLYMPO”, presents Olymp Loader as fully written in assembly language and frequently markets it as FUD (Fully UnDetectable). Despite its recent appearance, many underground forum users have already posted positive reviews.
Read Post
ssl2buy

Harvest Now, Decrypt Later: Why Enterprises Must Prepare Now

Sep 25, 2025 By Ann-Anica Christian In SSL2BUY
In Dune, Frank Herbert’s eponymous sci-fi work, there is a phrase that is often repeated – ‘fear is the mind killer’. We can juxtapose this saying with the cybersecurity landscape, as the fear of not being future-ready is what keeps CISOs up at night. The very thought that a cybersecurity strategy, created and implemented with great effort, won’t be able to keep every evolving and increasingly sophisticated threat at bay is disconcerting.
Read Post

When Firewalls Age Out: What the Akira Attack Can Teach Us About Lifecycle Security

Sep 24, 2025 By WatchGuard Technologies In WatchGuard
Cyberattacks evolve faster than aging infrastructure can keep up, and expired hardware is one of the biggest blind spots organizations face today. The recent Akira ransomware campaign targeting SonicWall VPNs is a powerful reminder of what happens when devices slip out of support.
View Video

Hypervisor Encryption: Shutting Down Recovery

Sep 24, 2025 By Rubrik In Rubrik
Ransomware isn’t just about locking files anymore; attackers like Scattered Spider can take entire backup systems offline. Joe Hladik explains how hypervisor encryption lets them access virtualization interfaces and encrypt entire ESXi clusters, leaving organizations with no way to recover. Joe lays out why this tactic is so dangerous: it turns a backup, your last line of defense, into another point of failure.
View Video
bitsight

From Ransomware to Exposed ATMs: How Adversaries Target Financial Institutions

Sep 24, 2025 By Emma Stevens In BitSight
The financial sector remains one of the most targeted industries for cybercriminals and nation-state actors due to the sensitivity of customer data, the high value of financial transactions, and the critical role these institutions play in global stability. Bitsight’s 2025 State of the Underground report found that underground markets listed nearly 14.5 million compromised credit cards in 2024, representing a 20% increase over 2023. This growth was driven entirely by a surge in US-issued cards.
Read Post

Scattered Spider: the Evolution of Identity-Based Ransomware

Sep 23, 2025 By Rubrik In Rubrik
Identity-based ransomware is no longer a fringe tactic; it’s becoming the playbook of today’s most dangerous adversaries. Scattered Spider, a financially motivated e-crime group, has shifted the model from smash-and-grab encryption to a far more devastating combination of double extortion, social engineering, and hypervisor encryption attacks.
View Video
WatchGuard

No More Ransom: Why the UK's Crackdown Signals the End of Paying Hackers

Sep 23, 2025 By Oli Venn In WatchGuard
For years, ransomware gangs have thrived by holding businesses hostage, forcing a terrible choice: pay up or watch your systems collapse. That era is ending. After a summer of cyber chaos that hit everything from the NHS to Harrods, the UK government has drawn a red line: no more quiet payoffs, no more sweeping attacks under the rug.
Read Post
safebreach

Scattered Spider: What You Need to Know

Sep 22, 2025 By Adrian Culley In SafeBreach
Founded around 2022, Scattered Spider is a well-known group of young, English-speaking threat actors believed to be from the US and UK. The group—which has some members as young as 16—first gained global recognition in September 2023 when they successfully hacked the internal systems of both Caesars Entertainment and MGM Resorts, obtaining sensitive data they used to extort the casinos.
Read Post
outpost 24

zerodayx1: Hacktivist groups turning to ransomware operations

Sep 22, 2025 By KrakenLabs In Outpost 24
In July 2025, pro-Palestinian hacktivist group zerodayx1 launched its own Ransomware-as-a-Service (RaaS) operation, following the path of other hacktivist teams. They loudly announced the initiative on platforms commonly used for such purposes, including X (formerly Twitter) and Telegram. Zerodayx1 exemplifies the ongoing evolution of these groups, underscoring the importance of studying and understanding their methods in order to better prepare for and respond to such threats.
Read Post
netwrix

Stopping BadUSB, Rubber Ducky, and Flipper Zero Attacks

Sep 22, 2025 By Jeremy Moskowitz In Netwrix
BadUSB, Rubber Ducky, and Flipper Zero devices bypass traditional USB blocking by impersonating keyboards and executing commands at machine speed. Netwrix Endpoint Management combines Endpoint Protector’s device control with Policy Manager’s privilege enforcement to block rogue devices, remove unnecessary admin rights, and contain lateral movement before it escalates.
Read Post
upguard

Shai-Hulud's True Lesson for CISOs: A Crisis of Communication

Sep 19, 2025 By Phil Ross In UpGuard
The Shai-Hulud worm wasn't just a sophisticated supply chain attack; its most important lesson was about a crisis of communication. The attack thrived in the organizational gap between security policy and the daily realities of software development, a gap that exists in most companies. Defending against the next software supply chain attack requires more than a new tool; it demands a strategic shift from imposing controls to forging a genuine partnership with engineering.
Read Post
apono

ShaiHulud, Nx & S1ngularitystyle Attacks: How JIT Access Stops the Chain Reaction

Sep 19, 2025 By The Apono Team In Apono
The Shai‑Hulud worm and the Nx / S1ngularity attacks show how token‑stealing malware, vulnerable workflows, and always‑on elevated permissions allow cascading compromise. Enforcing JIT access on repository, organization owner/admin roles, and team‑based inherited permissions sharply reduces exposure, limits damage, and strengthens audit/compliance posture.
Read Post
apono

ShaiHulud worm and the Nx / S1ngularity attacks: How-to use JIT Access to Stop the Chain Reaction

Sep 19, 2025 By The Apono Team In Apono
The Shai‑Hulud worm and the Nx / S1ngularity attacks show how token‑stealing malware, vulnerable workflows, and always‑on elevated permissions allow cascading compromise. Enforcing JIT access on repository, organization owner/admin roles, and team‑based inherited permissions sharply reduces exposure, limits damage, and strengthens audit/compliance posture.
Read Post
safebreach

SafeBreach Coverage for CISA Analysis Report AR25-261A: Malicious Listener for Ivanti Endpoint Mobile Management Systems

Sep 18, 2025 By Tova Dvorin In SafeBreach
On September 18, 2025, an Analysis Report was issued by CISA that details information about two sets of malware it obtained from an organization that was compromised during May 2025. To gain initial access, the threat actors chained together known vulnerabilities outlined in CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile (Ivanti EPMM) before deploying the malware, which allowed them to achieve remote code execution (RCE).
Read Post
bluevoyant

From GrimResource to PureLogs Stealer: Dissecting a Recent Attack

Sep 18, 2025 By Joshua Green and Thomas Elkins In BlueVoyant
BlueVoyant’s Threat Fusion Cell (TFC) and Security Operations Center (SOC) researchers have uncovered a recent cyber campaign featuring a unique twist on fake browser updates. This attack leveraged the GrimResource vulnerability and delivered the PureLogs stealer malware to targeted environments through disguised Microsoft Management Console (MSC) files.
Read Post
Trustwave

Storm-2603: Targeting SharePoint Vulnerabilities and Critical Infrastructure Worldwide

Sep 17, 2025 By Cris Tomboc In Trustwave
This blog is the latest in a series that delves into the deep research conducted daily by the Trustwave SpiderLabs Threat Operations team on major threat actor groups currently operating globally. Trustwave SpiderLabs Cyber Threat Intelligence team has developed a new detailed analysis of Storm-2603, the threat group associated with the recent exploitation of security flaws in Microsoft SharePoint Server.
Read Post
cyberint

Meet Scattered Spider: The Group Currently Scattering UK Retail Organizations

Sep 16, 2025 By Adi Bleih In Cyberint
First published May 8th 2025 Updated Sept 16th 2025 Editor’s Note: This blog builds on our recent analysis of the DragonForce ransomware cartel, which claimed responsibility for a wave of UK retail attacks in April–May 2025. While DragonForce took credit for the extortion and data leak phase, growing evidence suggests that another group—Scattered Spider—may have played a foundational role in enabling those attacks.
Read Post
Arctic Wolf

Wormable Malware Causing Supply Chain Compromise of npm Code Packages

Sep 16, 2025 By Arctic Wolf Labs In Arctic Wolf
On September 15, 2025, reports surfaced that the widely used npm package @ctrl/tinycolor had been compromised by malware as part of a broader supply chain attack affecting over 40 packages initially, with the number rising to more than 180 according to Aikido’s blog. Upon further investigation, the first malicious package that was identified as compromised in this campaign was rxnt-authentication, which was updated on September 14, 2025, at 17:58:50 UTC.
Read Post
knowbe4

Report: AI-Powered Phishing Fuels Ransomware Losses

Sep 12, 2025 By KnowBe4 Team In KnowBe4
AI-powered social engineering attacks are significantly more successful than traditional attacks, according to a new report from cyber risk management firm Resilience. The researchers state, “Social engineering attacks fueled 88% of material losses, with AI-powered phishing achieving a 54% success rate compared to just 12% for traditional attempts.” AI allows attackers to easily craft sophisticated phishing emails, as well as voice and video deepfakes.
Read Post
WatchGuard

Ransomware Techniques Are Changing. Are MSPs Ready for This Shift?

Sep 12, 2025 By Ryan Estes In WatchGuard
Ransomware is evolving ‒ not fading. Despite a decline in attack detections based on WatchGuard Firebox telemetry, data from extortion sites and media reporting tells a different story: ransomware activity is actually on the rise, both quarter-over-quarter and year-over-year. The number of active ransomware groups is also increasing, as is the average ransom demand. In fact, the typical payout jumped from $400,000 in 2023 to $2 million in 2024 ‒ a staggering 500% spike.
Read Post
levelblue

AsyncRAT in Action: Fileless Malware Techniques and Analysis of a Remote Access Trojan

Sep 10, 2025 By Sean Shirley In LevelBlue
Fileless malware continues to evade modern defenses due to its stealthy nature and reliance on legitimate system tools for execution. This approach bypasses traditional disk-based detection by operating in memory, making these threats harder to detect, analyze, and eradicate. A recent incident culminated in the deployment of AsyncRAT, a powerful Remote Access Trojan (RAT), through a multi-stage fileless loader. In this blog, we share some of the key takeaways from this investigation.
Read Post

Intel Chat: Salt Typhoon, Scattered LapSus Hunters, WhatsApp compromise & AI-assisted attack [245]

Sep 8, 2025 By LimaCharlie In LimaCharlie
Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform. This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows.
View Video
lookout

How to Defend Against WormGPT-Driven Phishing and Malware

Sep 8, 2025 By Lookout In Lookout
AI is unlocking new ways to work across industries. Nearly four in five CEOs are implementing or likely to implement generative AI to speed up innovation across their companies, and workers at every level are using GenAI to improve or expand their processes. Unfortunately, they aren’t the only ones embracing the power of AI. WormGPT was one of the best-known early examples of an AI that could create convincing social engineering attacks and build malware.
Read Post
WatchGuard

Less ransomware, same risk. How can it be prevented?

Sep 5, 2025 By Iratxe Vazquez In WatchGuard
Just because ransomware attacks have decreased doesn’t mean that the risk has disappeared. Indeed, it remains one of the most disruptive threats to any organisation. Headlines can convey a false sense of relief: Ransomware attacks are down 15%, according to Verizon's latest DBIR report. But for those of us who work in cybersecurity, we know that this doesn't tell the whole story, especially when the real issue isn't how often an attack occurs, but what happens when it does.
Read Post
Arctic Wolf

GPUGate Malware: Malicious GitHub Desktop Implants Use Hardware-Specific Decryption, Abuse Google Ads to Target Western Europe

Sep 5, 2025 By Arctic Wolf Threat Research In Arctic Wolf
On 19 August 2025, the Arctic Wolf Cybersecurity Operations Center (cSOC) uncovered and remediated a sophisticated delivery chain: a threat actor leveraged GitHub’s repository structure together with paid placements on Google Ads to funnel users toward a malicious download hosted on a lookalike domain. By embedding a commit‑specific link in the advertisement, the attackers made the download appear to originate from an official source, effectively sidestepping typical user scrutiny.
Read Post
lookout

Adversarial AI and Polymorphic Malware: A New Era of Cyber Threats

Sep 5, 2025 By Lookout In Lookout
The state of cybersecurity has always been in flux, but the arrival of tools like ChatGPT heralded one of the most significant challenges for security teams in years. AI has the potential to unlock incredible potential in data processing and malware detection, but in the wrong hands, Large Language Models (LLMs) and other adversarial AI tools can be used to develop polymorphic malware that can escape detection, gain access to sensitive data, and poison data sets.
Read Post
CrowdStrike

EMBER2024: Advancing the Training of Cybersecurity ML Models Against Evasive Malware

Sep 3, 2025 By Phil Roth In CrowdStrike
CrowdStrike data scientists are members of a team of cybersecurity researchers that recently released EMBER2024, an update to EMBER, the popular open source malware benchmark dataset originally released in 2018. The EMBER2024 dataset includes metadata, labels, and calculated features for over 3.2 million files from six different file formats.
Read Post
10 Budget Moves to Protect Against Ransomware

10 Budget Moves to Protect Against Ransomware

Sep 3, 2025 By SecuritySenses In SecuritySenses
Protecting your business from ransomware doesn't require an unlimited budget, but it does take careful planning. Cyberattacks grow more advanced each year. Ignoring preparedness could result in massive downtime or data loss. Investing in the right defenses reduces risk without overspending. Knowing where to allocate funds can mean the difference between prevention and recovery costs spiraling out of control. Here are nine actionable investments with real-world impact to safeguard your organization while keeping budgets in check.
Read Post

Defeating Ransomware with Unified Security

Sep 2, 2025 By WatchGuard Technologies In WatchGuard
Ransomware is getting smarter, so your security better be, too. The old playbook of scattered tools and siloed defenses no longer cuts it. Every business needs to connect the dots to stay ahead. In this webinar, we’ll show you how bringing together SASE, XDR, NDR, and automation under a unified platform creates a powerful security force that works with your team, not against it.
View Video

Intel Chat: Trend Micro Apex One, PyPI domains, RingReaper & Openbaar Ministrie attack [244]

Sep 1, 2025 By LimaCharlie In LimaCharlie
In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community. Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform. This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows.
View Video

Google Saved the Day: How Search Solved a Ransomware Alert #appsec

Sep 1, 2025 By Mend In Mend
Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.