Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Digital Security Risks During Separation or Divorce: Protecting Your Privacy When Relationships Break Down

Digital Security Risks During Separation or Divorce: Protecting Your Privacy When Relationships Break Down

Dec 31, 2025 By SecuritySenses In SecuritySenses
During separation or divorce, the breakdown of a relationship often brings unexpected digital risks alongside emotional and financial challenges. Many couples spend years sharing passwords, devices, and online accounts without a second thought. However, when trust erodes, this shared digital access can quickly turn into a serious cybersecurity and privacy concern. Understanding how digital exposure happens and how to manage it responsibly is becoming an essential part of modern family disputes.
Read Post
levelblue

LevelBlue SpiderLabs: Ransomware Attacks Up 17% in 2025

Dec 30, 2025 By LevelBlue In LevelBlue
Ransomware attacks increased by 17.2% percent year-over-year in 2025, with the group Qlin dominating the threat landscape, according to data generated by the LevelBlue SpiderLabs team. These attacks focused primarily on the manufacturing and technology sectors, with the US by far being the most targeted nation. 2025 continued the trend of yearly increases; however, over the last few years, the rate of attacks has somewhat slowed.
Read Post
Snyk

The Holiday Whisper: Shai-Hulud 3.0

Dec 29, 2025 By Lion Kontorer In Snyk
The end-of-year holiday period is traditionally a time for code freezes and quiet rotations; however, it is also a favored window for opportunistic attackers. Threat actors love the holidays; they know that with development teams out of the office and response times naturally lagging, a small window opens for them to test new exploits without immediate detection. Recently, a security researcher discovered a new, contained variant of Shai-Hulud, dubbed "The Golden Path" (v3.0).
Read Post
knowbe4

Most Parked Domains Lead Users to Scams or Malware

Dec 29, 2025 By KnowBe4 Team In KnowBe4
Over 90% of parked domains now direct users to malicious content, compared to less than 5% a decade ago, according to researchers at Infoblox. “Parking threats are fueled by lookalike domains,” Infoblox explained. “No domain is immune. When one of our researchers tried to report a crime to the FBI’s Internet Crime Complaint Center (IC3), they accidentally visited ic3gov. Their phone was quickly redirected to a false “Drive Subscription Expired” page.
Read Post
foresiet

New Stealthy C# RAT NoobsaibotRAT Targets Windows with Advanced Features

Dec 24, 2025 By foresiet In Foresiet
Remote Access Trojans (RATs) continue to be one of the most actively traded malware categories across dark web forums. Their appeal lies in flexibility: a single framework can support espionage, credential theft, ransomware staging, or long-term persistence. Recently our team Identified a dark web actor advertised a tool called“noobsaiBOT”, claiming it to be a fully custom, stealth-focused RAT with source code included, priced at$20,000 and offered as a one-time exclusive sale.
Read Post
graylog

Understanding Ransomware Email Threats

Dec 18, 2025 By Jeff Darrington In Graylog
The Ransomware-as-a-Service (RaaS) ecosystem has changed the look and shape of modern day ransomware attacks. Malicious actors typically view their cybercrimes as a business, hoping to make the most amount of money with the least amount of effort. For example, according to research, AI-automated phishing attacks performed similarly to human generated ones and 350% better than the ones sent to the control group.
Read Post
How PPC Campaign Vulnerabilities Can Lead to Ransomware Attacks

How PPC Campaign Vulnerabilities Can Lead to Ransomware Attacks

Dec 18, 2025 By SecuritySenses In SecuritySenses
In the US, search ad spend was expected to reach $124.59 billion in 2024. Those big pay-per-click (PPC) advertising budgets are attracting the attention of cybercriminals. Click fraud is a well-known hazard in marketing circles. However, a more insidious threat lurks in the background.
Read Post
safeaeon

Ransomware Remediation Tactics That Help You Recover Fast

Dec 15, 2025 By SafeAeon Inc. In SafeAeon
Ransomware attacks have grown stronger in the last few years. Attackers are now stealing data before locking it. They also pressure victims by posting stolen files on the internet. There are groups that sell ransomware kits, making these attacks easy to run. This has made things worse for businesses all around the world. Teams are looking for ransomware remediation tactics that help them recover fast and reduce the chance of the attacker returning.
Read Post

Intel Chat: React2Shell, GeminiJack vulnerability, proRussia hacktivist arrested & Warp Panda [276]

Dec 15, 2025 By LimaCharlie In LimaCharlie
In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community. Original CrowdStrike article. CISA BRICKSTORM Backdoor breakdown. Analysis report PDF. Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform. This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows.
View Video
datadog

2025 cloud security roundup: How attackers abused identities, supply chains, and AI

Dec 15, 2025 By Mallory Mooney In Datadog
In 2025, many of the long-standing cloud security concerns remained, but new areas of focus also developed. The significant increase in AI adoption enabled organizations to deliver features faster but also introduced new attack surfaces, such as untrusted or unpredictable user input for large language model (LLM) applications. At the same time, long-lived credentials and vulnerabilities in third-party packages continued to expose cloud environments to risk.
Read Post

Unleash Agents. Not Risk.

Dec 12, 2025 By Rubrik In Rubrik
AI agents can increase productivity, but without proper governance and centralized oversight, they can cause destruction. Now more than ever, organizations urgently need a control layer for AI agents as a part of their rollout strategy. Rubrik Agent Cloud is designed to monitor and audit agent actions, enforce real-time policies and guardrails, and undo agent mistakes. Built on the Rubrik Platform that uniquely combines data, identity, and application contexts, Rubrik Agent Cloud will deliver security, accuracy, and efficiency as they transform with AI.
View Video

All things AI and malware with Randy Pargman

Dec 11, 2025 By LimaCharlie In LimaCharlie
Join us for this week's Defender Fridays as we explore the reality of AI-powered malware threats with Randy Pargman, Senior Director of Threat Detection at Proofpoint. At Defender Fridays, we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.
View Video
foresiet

Stealc Infostealer: A Deep Dive into Its Evolution, Operations, and Threat Landscape

Dec 10, 2025 By Foresiet In Foresiet
Stealc, an information-stealing malware operating as Malware-as-a-Service (MaaS), has emerged as a potent tool in the cybercriminal arsenal since its debut in early 2023. Advertised on Russian-speaking underground forums. Established stealers such as Vidar, Raccoon, Mars, and RedLine, offering customizable data exfiltration for browsers, cryptocurrency wallets, and applications. Its non-resident design minimizes footprints, enabling stealthy theft of credentials, cookies, autofill data, and files.
Read Post
foresiet

The Resurgence of Mirai: Jackskid Botnet and Escalating IoT Threats in November 2025

Dec 9, 2025 By Foresiet In Foresiet
The Mirai botnet, first unleashed in 2016, continues to evolve into increasingly sophisticated variants, posing severe risks to the Internet of Things(IoT) ecosystem. This report examines the Jackskid Botnet—a newly identified Mirai derivative—characterized by its aggressive propagation via zero-day exploits and brute-force attacks, resulting in daily active bot IPs surpassing 40,000 as of late November 2025.
Read Post
bytesafe

Shai-Hulud v2: The "Second Coming" of the npm Worm

Dec 9, 2025 By Daniel Parmenvik In Bytesafe
In September, we covered the Shai-Hulud worm, a self-replicating attack that exposed just how fragile the npm supply chain can be. But as we know, successful malware rarely stays static. Late November marked the arrival of Shai-Hulud v2, or as its authors rather dramatically titled it, “The Second Coming”. This isn’t just a rerun; it’s a remaster. The new iteration is stealthier, more aggressive, and significantly more dangerous. While v1 was a wake-up call, v2 is a fire drill.
Read Post
acronis

Dharma (CrySiS) Ransomware: Technical Analysis, Context and Mitigation

Dec 5, 2025 By Acronis In Acronis
Dharma, also known as CrySiS, is a long running ransomware family first observed in 2016. It operates as ransomware as a service, where developers lease the malware to affiliates who deploy it. A variant discovered in March 2021 appends the ".biden" extension to encrypted files. This article provides a technical analysis of Dharma, outlines its infection vector, describes its encryption workflow, and offers guidance for mitigation.
Read Post
knowbe4

Malicious AI Tools Assist in Phishing and Ransomware Attacks

Dec 5, 2025 By KnowBe4 Team In KnowBe4
Researchers at Palo Alto Networks’ Unit 42 are tracking two new malicious AI tools, WormGPT 4 and KawaiiGPT, that allow threat actors to craft phishing lures and generate ransomware code. These tools are criminal alternatives to mainstream AI tools like ChatGPT, with no safety guardrails to prevent users from using them for malicious activities. The latest version of WormGPT offers lifetime access for $220, or a monthly fee of $50.
Read Post
bluevoyant

Fake SAP Concur Extensions Deliver New FireClient Malware Variant

Dec 4, 2025 By Joshua Green and Thomas Elkins In BlueVoyant
The BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) team are tracking an adversary luring users into downloading fake Concur browser extensions. The fake browser extension installer contains a FireClient Loader designed to gather host information and send to its command and control (C2) server. If execution succeeds with successful communication to the C2, the loader drops a backdoor BlueVoyant is naming FireClient Backdoor.
Read Post
CrowdStrike

Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary

Dec 4, 2025 By Counter Adversary Operations In CrowdStrike
Throughout 2025, CrowdStrike has identified multiple intrusions targeting VMware vCenter environments at U.S.-based entities, in which newly identified China-nexus adversary WARP PANDA deployed BRICKSTORM malware. WARP PANDA exhibits a high level of technical sophistication, advanced operations security (OPSEC) skills, and extensive knowledge of cloud and virtual machine (VM) environments.
Read Post
securonix

JS#SMUGGLER: Multi-Stage - Hidden Iframes, Obfuscated JavaScript, Silent Redirectors & NetSupport RAT Delivery

Dec 4, 2025 By 1. Stage 1 Overview In Securonix
The Securonix Threat Research team has analyzed a sophisticated web-based multi-stage malware campaign. The attack chain unfolds across three distinct stages: (1) an obfuscated JavaScript loader injected into a compromised website, (2) a stealthy HTA (HTML Application) that executes encrypted PowerShell stagers via mshta.exe, and (3) a final PowerShell payload that downloads, extracts, executes, and establishes persistence for a Windows-based remote access Trojan.
Read Post
bitsight

Paying the Ransom: A Short-Term Fix or Long-Term Risks?

Dec 3, 2025 By Emma Stevens In BitSight
According to our 2025 State of the Underground report, ransomware attacks rose by nearly 25% in 2024, and the number of ransomware group leak sites jumped 53%. This surge sets the stage for a critical question: if compromised, should you pay ransomware demands or not? The stakes are enormous, including downtime, data loss, brand damage, and legal risk all hang in the balance.
Read Post
knowbe4

New Criminal Toolkit Abuses Browser Push Notifications

Dec 3, 2025 By KnowBe4 Team In KnowBe4
A new criminal platform called “Matrix Push C2” is using browser notifications to launch social engineering attacks, according to researchers at BlackFog. “This browser-native, fileless framework leverages push notifications, fake alerts, and link redirects to target victims across operating systems,” the researchers write.
Read Post
levelblue

SpiderLabs Ransomware Tracker Update November 2025: Qlin, Cl0p, and Akira Vie for Top Attacker

Dec 3, 2025 By LevelBlue In LevelBlue
LevelBlue SpiderLabs ransomware tracker noted a slight dip in the overall number of attacks that took place in November 2025, but the research team saw the threat group Cl0p surge, conducting 98 attacks during the month, up from just 13 in October. LevelBlue SpiderLabs derived the information from its ransomware-tracking tool, which gathers data from a variety of open intelligence sources and our own proprietary research.
Read Post
WatchGuard Threat Lab's top six cybersecurity predictions for 2026

WatchGuard Threat Lab's top six cybersecurity predictions for 2026

Dec 2, 2025 By WatchGuard In WatchGuard
WatchGuard has revealed its top six cybersecurity predictions for 2026, forecasting a year where AI-driven threats, regulatory pressures, and the decline of legacy tools will reshape the security landscape. Corey Nachreiner, chief security officer at WatchGuard Technologies, emphasises that organisations must prepare for rapid evolution in both attack methods and defensive strategies.
Read Post
cato networks

Cato CTRL Threat Research: From Productivity Boost to Ransomware Nightmare - Weaponizing Claude Skills with MedusaLocker

Dec 2, 2025 By Inga Cherny In Cato Networks
Claude Skills is a new feature from Anthropic that has gained rapid adoption, with more than 17,000+ GitHub stars already since its launch in October 2025, allowing users to create and share custom code modules that expand Claude’s capabilities and streamline workflows. But as this ecosystem grows, Cato CTRL uncovered a serious oversight into how Skills are executed.
Read Post

Top CISO Priorities and Global Digital Trust with Morgan Adamski

Dec 2, 2025 By Rubrik In Rubrik
Welcome to Data Security Decoded. Join host Caleb Tolin in conversation with Morgan Adamski who leads Cyber, Data, and Tech Risk at PwC and is a former US national security leader who spent 16 years tracking nation-state threats inside the US government. Coming out of a career spent inside secure facilities without windows or phones and working to address China’s prepositioning in US critical infrastructure, Morgan shares a direct view of how geopolitics is now shaping cyber risk decisions in boardrooms.
View Video
foresiet

Shai-Hulud Returns 2.0 - Massive Self-Propagating npm Supply-Chain Attack Hits 600 Packages and 100M+ Downloads

Dec 1, 2025 By Foresiet In Foresiet
The software supply chain has come under assault once again with the resurgence of the Shai-Hulud npm worm—now significantly more advanced, more destructive, and far more widespread. Consequently, what is quickly being described as one of the most serious active threats to the npm ecosystem, the second wave of the Shai-Hulud campaign has compromised at least 600 npm packages, collectively downloaded more than 100 million times. One of the most alarming aspects of this campaign is its origin point.
Read Post
Malvertising 101: When the Top Ad on Your Search Is a Trap

Malvertising 101: When the Top Ad on Your Search Is a Trap

Dec 1, 2025 By SecuritySenses In SecuritySenses
Online searching is something we do on a daily basis, often more than once, and we usually rely on the first result that appears. While it's the most practical solution, it's not the safest. In recent years, we've seen a growing threat called malvertising, which is a much more sophisticated trap than most of what we're accustomed to seeing. The numbers indicate that this is an increasing concern, and we'll explain how to protect yourself from it.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.