Threat Intelligence

As global governments and tech giants reckon with widespread of revelations of autonomous AI agents unexpectedly breaking into computer systems, documents obtained by The Intercept show the U.S. Army is looking to harness that exact technology to seek and destroy. Army Cyber Comm

Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. The company says it has isolated the issue and eradicated the immediate threat. Currently, its team is working to restore services following thorough

IT management software provider ConnectWise has suspended access to several of its cloud services after it discovered that unauthorized actors had gained access to Microsoft 365 tenants. ConnectWise began investigating suspicious activity on October 15. By October 17, the company

Personal information belonging to millions of current and former California public school students has been stolen from a system operated by Educational Testing Service (ETS). ETS is a nonprofit organization that helps run the state's standardized tests under contract with the Ca

Digital platform provider Conduent has agreed to pay $80m to settle a class action lawsuit following a 2024 cyber incident that breached the personal and health data of around 62 million people. The money will be divided up into covering material losses experienced by individual

The Google Threat Intelligence Group (GTIG) reports that attackers compromised AOMEI Technology's update and notification infrastructure in a campaign investigated between April and July. AOMEI Backupper is backup software that the company says is used by more than 100 million pe

Mobile is now a core operational pillar for governments, critical infrastructure providers, and large enterprises. It is also a growing attack surface, as sensitive conversations increasingly happen across mobile-first channels where identity, location, and metadata move through

Serbia's student-led pro-democracy movement, born from the November 2024 anti-corruption protests, has faced widespread targeting with spyware as part of broader state repression. In 2026 alone, investigations led by the SHARE foundation with the support of the Citizen Lab and Am

Sophos X-Ops uncovered a new technique used by attackers to enumerate user accounts in ServiceNow by abusing Microsoft Graph permissions. This novel approach allowed attackers to identify valid user accounts within a target's ServiceNow environment by querying the Microsoft Graph

Recently fixed vulnerabilities in the Plex Media Server are under active exploitation in attacks that, when successful, install malware, including cryptominers and residential proxy apps, a researcher said. Plex fixed four vulnerabilities at the start of last month. However, thre

On August 18, 2026, Vercel announced a $1 million challenge inviting researchers to break the isolation boundary of its Sandbox product. Vercel's challenge explicitly invited researchers to attempt both network and host escape; we were interested in the latter. The question was s

A massive cyberattack has disrupted the US Bankruptcy Court's Bankruptcy Noticing Center (BNC) - the system responsible for sending out official notices about hearings, deadlines, and proceedings for all federal bankruptcy cases nationwide. This outage is the result of an attack

In September, reports emerged that a Virginia woman had been submerged by a flood of emails. The real reason behind the inbox blitz was to bury a legitimate email from the victim's bank warning her about a fraudulent laptop purchase. This is email bombing. If it's happened to you

The same is true for bots: verifying who operates it creates accountability, but trust depends on what it does next. A known bot can still ignore website preferences, overwhelm origins, or evade controls. It's not always malicious -- often it's just a misconfiguration or a bug. T

The growing AI landscape is giving enterprises more choice in how they build, customize, and deploy increasingly capable models. Open-weight models are an important part of that landscape. They give enterprises access to model weights and greater flexibility to inspect, evaluate,

The FBI is once again warning US citizens to be on the lookout for the scams that are so often rife around election season. With November's midterms fast approaching, the FBI said scammers are known to use the names, imagery, and slogans of high-profile candidates for a range of

On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances. The successful exploitation of this vulnerability results in the arbitrary upload of files. During an incident response engagement, Mandiant i

The Federal Trade Commission (FTC) has filed a complaint accusing Digital Forensics Corporation of exploiting people already targeted by sextortionists. The FTC has accused Digital Forensics Corporation, its owner Dmitry Belkin, and affiliated companies of misleading sextortion v

Managed file transfer (MFT) systems, vendor portals, EDI pipelines, and e-signature platforms have something in common that has nothing to do with how they're built: they concentrate valuable files, privileged access, and trusted connections to dozens or hundreds of external part

Our research indicates that the online advertising ecosystem is abused to facilitate the delivery of zero-click targeted spyware, and that the simple display of a targeted ad is enough for infection. This report exposes zero-click spyware delivered via targeted ads, which we call

Adding 10 new clients sounds like exactly the kind of problem an MSSP wants to have, bringing more revenue, more accounts, and more room to grow. But growth also brings more alerts, suspicious files and URLs, investigations, escalations, reports, and SLA commitments. And if too m

Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras. The following versions of Guangzhou Juan IoT Technology EseeCloud are affected: EseeCloud App <=4.9.6 and EseeCloud Firmware <=4.9.86.0. These vulnerabilities,

Tim Beasley, a senior incident response consultant at Semperis, was investigating a cyberattack involving Russia's Midnight Blizzard when a package containing nesting dolls and other regional gifts showed up on his doorstep. He assumed it was from the group, which has been linked

Today the Department of Justice announced coordinated actions against the Democratic People's Republic of North Korea (DPRK) government's schemes to fund its regime through remote information technology (IT) work for U.S. companies. These actions include an indictment, two arrest

Darktrace malware researchers have found an ongoing malware campaign using a document-themed lure containing a malicious LNK file and a PDF with an embedded payload. The Nim based loader deploys a Rust-based remote access trojan (RAT), using a UAC bypass and DLL search-order hija

The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent ex

In a nutshell: the VBA code is stored inside an OLE file, that is embedded inside the DWG file. You can do a brute-force search for the embedded OLE file, or you can follow a pointer inside the header of the DWG file. I wrote a small Python script (autocad.py) for this second cas

Over the past year, Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators, developers, and an illicit marketplace selling tools and infrastructure for large-scale phishing, enabling cybercriminal operations worldwide.

A new vulnerability, CVE-2026-102298, has been reported. In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another acco

Three vulnerabilities in LG's webOS have been discovered that can be chained together to grant an attacker on the same local network root access to certain smart TVs. This attack can be performed without requiring any user interaction or a PIN. LG has since released a fix for the

We first encountered RedRelay in early 2021. While responding to a ransomware incident at a European MSP, we also identified APT15 in the network, who were routing their activity via a cluster of infrastructure which had significant comms between nodes via UDP port 5500. We soon

A Saudi OpenAI engineer has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to secretly record sensitive conversations. The U.S. Department of Justice announced Tuesday that Abdulrahman Alfozan,

Following Ukrainian strikes, Infrawatch recorded a 54% fall in responses from Yandex Cloud's services on 11 October. Yandex Cloud runs the computers behind businesses' websites and apps. Ukrainian strikes reached Sasovo on 8 October, Kaluga on 9 October and Vladimir on 11 October

Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory providing upgrade instructions to customers. Systems exhibiting signs of compromi

Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said. The attackers reached them through the controller that runs all of a store's fridges

Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication. The following versions of Swann Communications SWIFI-SE2KIC are affected: SWIFI-SE2KIC firmware <=2.0.22 (CVE-2026-107605, CVE-2026-107606, CVE-2026-10760

Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes. A replicator like this would be challenging to shut down, since there's no

Albert Heijn is reporting major disruptions to its online services on Monday, following a cybersecurity incident confirmed by its parent company, Ahold Delhaize. The disruption, which began on Sunday afternoon, has left the retailer's website, mobile app, and customer service sys

Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. On October 9, Ledger launched an investigation into user reports of cryptocurrency losses an

Differences between legacy self-assessments (DFARS 252.204-7019) and CMMC Level 2 self-assessments (DFARS 252.204-7021) are leading defense contractors to a rude awakening: they no longer dictate the requirements they can implement or defer during a NIST 800-171 implementation. I

Analysis by cybersecurity researchers at Check Point, published on October 9, has exposed what appears to be the inner workings of the Silent Ransom Group. Leaked files disclosed to an anonymous onion site called "The Luna Moth Files" in early October 2026 claim to contain intern

It's another week of the vulnpocalypse. As we have learned to embrace the vulnpocalypse, we still feel there should be a rule against an advisory having over 1,000 associated CVEs. There should be some sort of law as to how many CVEs can be put into a single advisory. We don't th

On Friday, the US and China agreed to discuss various AI safety risks during a planned September meeting. These will be the first official bilateral talks between the two countries since the second Trump administration began, and the talks will be led by US Treasury Secretary Sco

Surfshark disclosed that hackers accessed one of its internal test servers after a configuration error exposed it to the internet. The VPN service provider said the incident did not affect its customers and did not extend to other parts of its infrastructure, but it exposed servi

MantaxOtax Android malware has combined file encryption with extensive surveillance, letting attackers steal messages, credentials and device data while restricting access to infected phones. In a technical write up published on September 9, Zimperium's zLabs team linked the malw

A new Android malware strain called Mantax Otax combines ransomware and spyware capabilities to encrypt files, steal sensitive data, and spam and harass victims. Indonesian operators distribute the malware through malicious APKs hosted outside Google Play, targeting users with ph

With the release of Apple Watch Series 12, Apple has decided that it's ok to capture people's conversations without their consent. The latest Apple Watch comes with Audio Intelligence, a set of AI audio processing capabilities tuned for the company's S11 chip. Its features includ

The FBI has published its first ever Cyber Strategy, providing guidance on how the agency investigates and disrupts cyber threat actors. The new document, published on September 9, highlights the need for strategic response to escalating cyber-attacks perpetrated by financially-m

SolarView Compact provided by Contec Co., Ltd. contains multiple vulnerabilities. The affected products include SolarView Compact, SV-CPT-MC310 versions prior to 9.00, and SV-CPT-MC310F versions prior to 9.00.

The U.S. Department of Justice (DOJ) on Wednesday announced coordinated actions aimed at an illicit online marketplace called Xinbi Guarantee that offered scam services, including seizing Telegram channels used to run the service, confiscating two cryptocurrency wallets, and depl