Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Arctic Wolf

Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or Less

Sep 26, 2025 By Arctic Wolf Labs In Arctic Wolf
In late July 2025, Arctic Wolf Labs began observing a surge of intrusions involving suspicious SonicWall SSL VPN activity. Malicious logins were followed within minutes by port scanning, Impacket SMB activity, and rapid deployment of Akira ransomware. Victims spanned across multiple sectors and organization sizes, suggesting opportunistic mass exploitation. This campaign has recently escalated, with new infrastructure linked to it observed as late as September 20, 2025.
Read Post
Arctic Wolf

Cisco Patches ASA, FTD, and IOS Vulnerabilities, Including Critical and Exploited Flaws

Sep 26, 2025 By Andres Ramos In Arctic Wolf
On September 25, 2025, Cisco released fixes for two vulnerabilities in Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) that are currently being actively exploited by a sophisticated threat actor. The US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 25-03 requiring Federal Civilian Executive Branch (FCEB) agencies to patch these vulnerabilities by 12 PM EDT on September 26.
Read Post
outpost 24

Carding ecosystem: The fall of traditional financial cybercrime

Sep 26, 2025 By Marcelo Ruano In Outpost 24
Carding is a type of cybercrime where attackers steal or illegally buy credit card information and use it to make unauthorized transactions. It often involves testing stolen card numbers with small purchases before making larger fraudulent charges. Criminals typically exchange or sell these stolen details on underground forums or dark web marketplaces. Outpost24’s Threat Intelligence team, KrakenLabs, carried out a previous public analysis of the underground card fraud ecosystem in 2022.
Read Post
Snyk

Malicious MCP Server on npm postmark-mcp Harvests Emails

Sep 25, 2025 By Liran Tal In Snyk
On September 25, 2025, the npm package postmark-mcp, an MCP (Model Context Protocol) server intended to let AI assistants send emails via Postmark, was reportedly modified to secretly exfiltrate email contents by adding a blind-copy (BCC) to an external domain. Current analysis suggests the behavior began around 1.0.16 and persisted in later versions.
Read Post
outpost 24

Olymp Loader: A new Malware-as-a-Service written in Assembly

Sep 25, 2025 By Lidia López Sanz In Outpost 24
Olymp Loader is a Malware-as-a-Service (MaaS) advertised on underground forums and Telegram since June 5, 2025. The seller, “OLYMPO”, presents Olymp Loader as fully written in assembly language and frequently markets it as FUD (Fully UnDetectable). Despite its recent appearance, many underground forum users have already posted positive reviews.
Read Post

When Attackers Weaponize AI and Defenders Fight Back with Smarter Remediation

Sep 24, 2025 By Nucleus Security In Nucleus
Artificial intelligence is transforming cybersecurity, and not always for the better. Attackers are now weaponizing AI to speed up reconnaissance, create exploit code, and bypass traditional defenses. Security teams can’t afford to rely on outdated vulnerability management practices. In this webinar, Scott Kuffer (COO, Nucleus Security) and Corey Brunkow (Director of Federal Operations, Horizon3.ai) break down how AI is changing the threat landscape and what defenders can do to stay ahead.
View Video
Snyk

How Snyk Learn Helps You Meet PCI DSS v4.0 Developer Training Requirements

Sep 23, 2025 By Michael Biocchi In Snyk
As businesses strive to secure sensitive cardholder data and stay compliant with Payment Card Industry Data Security Standard (PCI DSS) v4.0.1, one of the most overlooked areas is developer training. The latest version of the PCI DSS places clear emphasis on ensuring developers are not only residually aware of security best practices, but are actively trained to build secure software and detect vulnerabilities. This is where Snyk Learn comes in.
Read Post
Arctic Wolf

CVE-2025-26399: Critical Unauthenticated RCE in SolarWinds Web Help Desk Through Second Bypass

Sep 23, 2025 By Andres Ramos In Arctic Wolf
On September 23, 2025, SolarWinds released a hotfix for a critical vulnerability impacting Web Help Desk (WHD), tracked as CVE-2025-26399. The vulnerability arises from a deserialization flaw in the AjaxProxy component that could allow a remote unauthenticated threat actor to achieve remote code execution. CVE-2025-26399 is the second bypass of a flaw originally disclosed last year as CVE-2024-28986 within WHD, with the first bypass being CVE-2024-28988.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.