Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

bitsight

What Is a Remote Access Trojan (RAT), and Why Should You Care?

May 28, 2025 By Emma Stevens In BitSight
According to our 2025 State of the Underground report—in which we take a look back at cybercrime on the deep and dark web from the past year—384 unique varieties of malware were sold in 2024, an increase from 349 in 2023. To determine this number, our research team examined malware and hacking tools for sale on the top three criminal forums, and as a result, we found that Remote Access Trojans (RATs) were the second most common form of malware in 2024, just behind stealer malware.
Read Post
Trustwave

PhaaS the Secrets: The Hidden Ties Between Tycoon2FA and Dadsec's Operations

May 28, 2025 By Cris Tomboc and King Orande In Trustwave
Since September 2023, Trustwave’s Threat Intelligence Team has been tracking a large-scale phishing campaign distributed via email, attributed to "Storm-1575". Storm-1575 is known for developing and distributing a PhaaS platform with adversary-in-the-middle (AiTM) capabilities, known as "Dadsec". The team’s recent investigations have revealed that the infrastructure used by Dadsec is also connected to a new campaign leveraging the "Tycoon2FA" Phishing-as-a-Service (PhaaS) platform.
Read Post

May 27, 2025 Cyber Threat Intelligence Briefing

May 27, 2025 By Kroll In Kroll
This week’s briefing covers: Joint Cybersecurity Advisory released on KTA007 (APT28) A joint advisory has been released warning of Russian-attributed threat actors targeting western logistics entities and technology companies since 2022. Microsoft leads global action to disrupt LUMMASTEALER Microsoft’s Digital Crimes Unit has recently seized and facilitated the takedown, suspension, and blocking of approximately 2,300 malicious domains that formed the backbone of LUMMASTEALER infrastructure.
View Video
splunk

What Is Extortionware? Going Beyond Ransomware

May 27, 2025 By Shaun Quarton In Splunk
Extortionware involves stealing sensitive data from an organization and threatening to leak it. It’s become a core tactic in the modern ransomware playbook, and if your business holds valuable or confidential information, it’s a threat you can’t afford to ignore. Today, we’re taking a closer look at what extortionware is, how it works, and why it’s become one of the most difficult cyber threats to defend against.
Read Post
Featured Post
Why Codefinger represents a new stage in the evolution of ransomware

Why Codefinger represents a new stage in the evolution of ransomware

May 27, 2025 By Justin Giardina, Chief Technology Officer In 11:11 Systems
Forget typical ransomware! Codefinger hijacked cloud keys directly, exposing backup flaws and shared responsibility risks. Time to rethink defence. If you didn't pay much attention to news of the recent Codefinger ransomware attack, it's possibly because ransomware has become so prevalent that major incidents no longer feel notable. But Codefinger is not just another ransomware breach to add to the list of incidents where businesses lost sensitive data to attackers. In key respects, Codefinger represents a substantially new type of ransomware attack.
Read Post
tripwire

3AM Ransomware Attackers Pose as IT Support to Compromise Networks

May 23, 2025 By Graham Cluley In Tripwire
Cybercriminals are getting smarter. Not by developing new types of malware or exploiting zero-day vulnerabilities, but by simply pretending to be helpful IT support desk workers. Attackers affiliated with the 3AM ransomware group have combined a variety of different techniques to trick targeted employees into helping them break into networks. It works like this.
Read Post
cyberint

The Lumma Stealer InfoStealer: The Details

May 22, 2025 By Coral Tayar In Cyberint
Original Article published Decmber 2023. Update May 22nd 2025: The FBI has seized user panels and other Lumma C2 infrastructure. As of now, we don’t see the Lumma info-stealer disappearing from the arena. Our team is on guard to check and analyze the changes. This case shares similarities with the so called seizure of infrastructure of RedLine and Metta info stealers in October 2024 by the FBI, DOJ, Dutch authorities, etc.
Read Post
CrowdStrike

CrowdStrike Collaborates with U.S. Department of Justice on DanaBot Takedown

May 22, 2025 By Counter Adversary Operations In CrowdStrike
Effective collaboration is essential when confronting today's sophisticated cyber adversaries, particularly those operating with state tolerance or direction. At CrowdStrike, we routinely work alongside law enforcement agencies and industry partners to identify, monitor, and mitigate cyber threats. Recently, we provided technical assistance to the U.S.
Read Post
safebreach

SafeBreach Coverage for US CERT AA25-141B (Sticky Werewolf)

May 22, 2025 By Tova Dvorin In SafeBreach
On May 21, 2025, the FBI and CISA released a joint Cybersecurity Advisory (CSA), designated AA25-141B, warning about the rise in attacks leveraging LummaC2, attributed to a threat group referred to internally as Sticky Werewolf, this cyber espionage campaign has used LummaC2 malware since at least April 2023 to target Russian and Belarusian government agencies, science centers, and aviation manufacturers.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.