Lab AI Ransomware Nearly Sparks Crisis
A harmless academic AI ransomware prototype caused panic, showing just how thin the line now is between lab projects and live attack.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Juice Jacking Explained: Stay Safe at Public USB Chargers
Recharging the battery of phones, tablets, or laptops in public places such as airports, stations, hotels, or cafés is quite normal and convenient. Everybody does it while traveling or working on the go. Most of these charging points rely on USB ports, which not only deliver power but also support data transfer. In recent years, cybersecurity authorities such as the FBI and the Federal Communications Commission (FCC) have warned users about a rising cyber threat known as juice jacking.
The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties
It wasn’t long ago that we uncovered compromised extensions on Open VSX. Now, a new wave of attacks is emerging, and all signs point to the same threat actor. The technique will sound familiar: hidden malicious code injected with invisible Unicode Private Use Area (PUA) characters. We first saw this trick back in March when npm packages used PUAs to conceal payloads. Then came Open VSX. Now, the attacker seems to have turned their sights on GitHub, and their methods are evolving.
Advanced Threat Hunting Demo: Brickstorm APT
Is your VMware environment secure? A sophisticated backdoor called BRICKSTORM, used by espionage actor UNC5221, could be hiding in your vCenter backups right now. Restoring from a compromised snapshot means letting the attackers right back in. But what if your backups could be your best defense? In our new 4-minute demo, we walk through the exact steps to: Proactively hunt for BRICKSTORM within your backups using YARA rules. Instantly quarantine infected snapshots to stop the threat from spreading. Identify a guaranteed 'Gold Copy' for a fast, safe, clean-room recovery.
October 2025 Ransomware Update
his week on the podcast, we have our resident ransomware expert, Ryan Estes, on to give an update on the latest in the ransomware ecosystem. We cover a few recent changes to operators, extortion techniques, and business impact from ransomware attacks in recent months.
AI Unlocks Ransomware And Deepfake Espionage
Attackers use AI to craft phishing, automate ransomware, and slip deepfakes into job interviews—breaching systems without ever touching a keyboard.
How Cybercriminals Bypass Your Defenses (And How to Stop Them)
Malware can seriously disrupt a computer's functionality. Performance issues are only the beginning, with the worst cases involving credential theft, data theft, or monetary theft. Malware is annoying, but it can also be dangerous. Simply put, you don't want malware to make its way onto your devices. That's what antivirus software is for.
Ransomware's Worst Halloween Nightmare: The BDRShield Backup
It’s a dark and stormy night in cyberspace. Ransomware monsters lurk in the shadows, ready to encrypt and extort unsuspecting businesses.
From Brazil with Love: New Tactics from Lampion
This post will describe a long-running spam campaign from a Brazilian group known for using the Lampion stealer. We’ll detail the latest updates on the infection chain and its components, share previously undescribed indicators, and cover key takeaways, including.
CTI roundup: Famous Chollima, COLDRIVER, Vidar Stealer 2.0
Famous Chollima combines BeaverTail and OtterCookie, COLDRIVER deploys three new malware families, and Vidar Stealer 2.0 demonstrates upgraded capabilities.
Widespread Installation of Calendaromatic Adware Includes Homoglyph Channel
Kroll has recently seen a widespread installation of an application called Calendaromatic, that Kroll Threat Intelligence (TI) is currently classifying as a potentially unwanted program (adware) but displays some functionality that gives it the potential to conduct more malicious behaviors.
Agentic AI Ransomware: What You Need to Know
Brace yourself for agentic AI ransomware. It's a terrifying fusion of cutting-edge tech and malicious intent that's set to redefine cyber threats as we know them. Unlike traditional ransomware, which follows pre-programmed rules, agentic AI ransomware can adapt its behavior in real-time based on its environment and the defenses it encounters.
AI Sidebar Spoofing Attack: SquareX Uncovers Malicious Extensions that Impersonate AI Browser Sidebars
SquareX released critical research exposing a new class of attack targeting AI browsers. The AI Sidebar Spoofing attack leverages malicious browser extensions to impersonate trusted AI sidebar interfaces, which is used to trick users into executing dangerous commands that can lead to credential theft, device hijacking, and password exfiltration.
Dual-Platform Backdoor from a South Asian Threat Group: StealthServer
In my ongoing monitoring of cyber threats in South Asia, I’ve encountered a series of advanced persistent threat (APT) activities. This region has long been a hotspot for sophisticated cyberattacks, with various groups ramping up their operations in terms of frequency and technical complexity. Starting from early July, I’ve captured multiple new malware samples targeting both Windows and Linux platforms.
Why Infostealer Malware Demands a New Defense Strategy
Modern breaches rarely begin with a brute-force attack on a firewall, they now start with a user login. Valid account credentials are now a top initial access vector, responsible for 30% of all intrusions. In this post, we address a common misconception surrounding the inforstealer malware that may be putting you at risk of a data breach.
Minimizing liability is not the same as security: Lessons from Recent Airport Cyber Disruptions
Blog post updated for clarity. In late September 2025, several European airports reported significant delays and flight cancellations due to disruptions with their check-in and passenger systems. As a global leader in aviation technology and the backbone of passenger travel, protection of systems and customer operations is paramount for Collins Aerospace. Nonetheless, the vendor of the vMUSE check-in system had been hit by a ransomware attack.
CTI roundup: Astaroth, TA585, Microsoft tech support scams
Astaroth trojan uses GitHub to host malware configurations, TA585 delivers MonsterV2 malware in phishing campaigns, and threat actors exploit Microsoft’s logo in tech support scams.
Resilience After the Breach: 6 Cyber Incident Response Best Practices
In its 2025 State of the Underground report, Bitsight TRACE found that ransomware activity continued to escalate in 2024, with a 25% increase in unique victims listed on leak sites and a 53% increase in the number of ransomware group-operated leak sites. The report also observed a 43% increase in data breaches shared on underground forums, with nearly one in five victims based in the United States. These findings highlight a continued upward trend in cyberattack activity.
Public Sector Ransomware Attacks Relentlessly Continue
In 2025, 36 years after the first ransomware attack was recorded, actors continue to zero in on the public sector, and there is no evidence they will slow down any time soon. In fact, our numbers suggest that ransomware attacks against government organizations are ramping up, causing crippling service outages, massive data loss, reputational damage, public distrust, and financial harm.
The Next-Level Threat: Defending Against BrickStorm and the 393-Day Dwell Time
A new threat campaign, codenamed BrickStorm and attributed to a China nexus group tracked as UNC5221, has security researchers sounding the alarm. This is a highly sophisticated espionage operation, and its most staggering feature is the adversary’s patience. The astonishing average time they remain inside a victim’s network before being detected is well over a year—393 days to be exact.
Evasive Malware Surges 40% in WatchGuard's Latest Internet Security Report
Cybercriminals are taking stealth to new levels. According to WatchGuard Technologies’ latest Internet Security Report, evasive malware attacks jumped 40% in Q2 2025, driven by a sharp rise in threats delivered over encrypted connections. While Transport Layer Security (TLS) encryption is essential for protecting users, attackers are increasingly exploiting it to conceal malicious payloads and evade traditional detection methods.
Rubrik Identity Resilience: Explained!
With attackers now logging in instead of hacking in, securing your identity infrastructure is more critical than ever. Relying on a patchwork of tools for Active Directory and Entra ID creates dangerous blind spots and slows your response to threats.
Why Law Firms Are Ransomware's Favorite Target
Law firms are getting hit with ransomware at an alarming rate, and most don’t realize how exposed they actually are until it’s too late. The American Bar Association reports that 29% of law firms experienced a successful security breach in 2023. The average ransom demand for professional services firms runs between $200,000 and $500,000.
Brazilian Caminho Loader Employs LSB Steganography and Fileless Execution to Deliver Multiple Malware Families Across South America, Africa, and Eastern Europe
Arctic Wolf Labs has identified and analyzed a new malware loader we’re calling Caminho, a Brazilian-origin Loader-as-a-Service (LaaS) operation employing Least Significant Bit (LSB) steganography to conceal.NET payloads within image files hosted on legitimate platforms.
[Cybersecurity Awareness Month]: Keeping Enkryptor at Bay: How We All Can Help Beat Back Ransomware
Ransomware is the gift that keeps on giving… and taking. I’ve been tracking ransomware for almost nine years now, and I’ve seen it progress from simple and annoying malware to an organization-ending threat for many. I’m not big on pushing FUD (Fear, Uncertainty and Doubt), so when I say that it is one of the biggest cyberthreats to organizations in the small and medium-sized business space, I am not exaggerating.
Exposing Salt Typhoon on the network using the PEAK Threat Hunting Framework
How do you find an adversary who lives where you can't easily look? A recent CISA advisory on the state-sponsored actor "Salt Typhoon" highlights this exact challenge. These actors aren't just breaking in; they're moving in. They persist on network edge devices like routers and firewalls—critical infrastructure that often sits outside the view of traditional endpoint security. From this vantage point, they capture traffic, steal credentials, and plan their next move.
GlassWorm: The First Self-Propagating VS Code Extension Worm
Oct 16, 2025 How AI is Transforming Application Security Testing Read More Natalie Tischler Oct 14, 2025 Veracode Named a Leader in Gartner Magic Quadrant for AST for 11th Consecutive Time Read More Joe Ariganello Oct 9, 2025 The Business Case for Investing in AppSec Tools Read More Natalie Tischler.
Malvertising | #CybersecurityAwarenessMonth
In the 9th episode of the 'Little lessons in cybersecurity' series, we are talking about Malvertising, a sneaky trick hackers to make you on ads that are not actually ads!
PhishinGit - GitHub.io pages abused for malware distribution
This blog discusses PhishinGit, a phishing campaign uncovered by CYJAX that abuses GitHub.io pages to distribute malware disguised as Adobe downloads. It explains how threat actors used Browser-in-the-Browser (BitB) techniques, Dropbox-hosted payloads, and anti-analysis JavaScript to evade detection. The blog also explores the attack chain, observed mitigations, MITRE ATT&CK mapping, and indicators of compromise (IOCs) to help organisations identify and defend against similar threats.
Three Threats Reshaping Financial Services: Identity, Supply Chain, and AI
Cyber resilience in financial services is often treated as a checklist of tools and controls, rather than what it truly is: a system of people, intelligence, and collaboration working together.
Ready or Not?? New 11:11 Ransomware Report
The statistics in our Ransomware Report are sobering: ransomware attacks occur roughly every 11 seconds, with 85% of organizations suffering at least one attack within a 12-month period. For IT professionals managing critical infrastructure, the question isn’t if you’ll face a cyber incident—it’s when. The numbers are staggering: cybercrime damages are projected to reach $23 trillion annually by 2027.
SocGholish: Turning Application Updates into Vexing Infections
This blog is the latest in a series that delves into the deep research conducted daily by the Trustwave SpiderLabs Threat Operations team on major threat actor groups and malware currently operating globally.
A Brief History of Ransomware
Ransomware is not new, but the ransomware of today is very different from the ransomware of 1989. Today’s episode doubles as a history lesson, as Adam and Cristian look back at how a prolific global threat has evolved over the decades.
CTI roundup: XWorm, Microsoft Teams, Storm-1175
XWorm malware reemerges with ransomware, Microsoft disrupts multiple threats targeting Teams, and Storm-1175 exploits a critical GoAnywhere MFT vulnerability.
The Minimum Viable Hospital
A ransomware attack will take a hospital down for 2-3 weeks on average. When you define the few core applications most critical to maintaining patient continuity of care, and create a plan to quickly recover them, you can turn disaster into a testament to preparedness. This is your Minimum Viable Hospital.
QRSwapper analysis: Malware distributed via Google Colab
During routine threat hunting, we, the ManageEngine Malware Analysis Team, came across a cluster of Google Colab notebooks appearing in search results for popular software downloads. On the surface, they looked legitimate, with well written installation guides and download links.
CVE-2025-61882: Oracle E-Business Suite Under Mass Exploitation by Cl0p Ransomware
A critical CVE-2025-61882 Oracle E-Business Suite vulnerability is under active exploitation by the Cl0p ransomware group. This unauthenticated remote-code-execution (RCE) vulnerability — CVE-2025-61882 — in Oracle E-Business Suite (EBS) was patched by Oracle in October 2025 and is being actively exploited in the wild. Multiple security vendors attribute attacks to Cl0p/associated ransomware extortion campaigns and Oracle has published an emergency Security Alert.
Ransomware Product Update 2025
CYJAX has expanded its ransomware group coverage, giving clients broader visibility and faster intelligence on emerging threats. This blog highlights the surge in global ransomware attacks and explains how this product update enhances organisational resilience in an evolving threat landscape.
CTI roundup: DarkCloud, Trinity of Chaos, WARMCOOKIE
DarkCloud malware targets sensitive data, a new cybercrime alliance targets major sectors, and WARMCOOKIE malware continues to evolve.
Advanced Banking Trojan Maverick Uses WhatsApp to Prey on Brazilian Users
The BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) researchers recently analyzed attacks of an adversary targeting users based in Brazil via WhatsApp. The attack lures users into downloading a zip archive. The zip archive contains a shortcut file (.lnk) which ultimately downloads and executes a banking trojan which BlueVoyant researchers have dubbed Maverick internally based off the naming convention used by the attackers.
CTI Roundup: SystemBC, ShinyHunters, AI-obfuscated Phishing
This week, Tanium’s Cyber Threat Intelligence (CTI) team investigates SystemBC, a large-scale proxy botnet that’s leveraging compromised virtual private server (VPS) infrastructure to support cybercriminal operations, including ransomware and credential theft. Next, the team looks at ShinyHunters—a financially motivated data extortion group that’s now targeting enterprise cloud applications.