59 casos · pág. 3/3
Resilience's report Cyber risk in energy and utilities analyzes cyber insurance claims filed between Jan. 1, 2023 and Sept. 5, 2026. Email compromise made up 21% of energy and utilities claims, against 10% across the rest of the portfolio. Ransomware was only 9% of claims but about 70% of incurred losses including reserves. In several cas…
Recorded Future's Insikt Group reports on TAG-193, a cluster that ran a sustained intelligence-collection campaign against government bodies from early 2025 through May 2026. Targets include diplomacy, economic development, agriculture and environmental agencies in Russia, Tajikistan, Belarus, Armenia and Uzbekistan. Lure documents and im…
Huntress published an explainer on business email compromise (BEC), a targeted form of phishing in which attackers impersonate or take over trusted email accounts to redirect payments or steal credentials. The article cites roughly $55 billion in worldwide losses and a Huntress survey of 500+ US IT professionals, in which 36% of organizat…
Huntress reports that manufacturing accounted for about 17% of cyber attacks in 2025, up from 9% in 2024, citing its own cyber threat report. The article is a vendor trends piece rather than an incident report. It argues that ransomware operators now target production uptime and operational technology (OT), not just data, because manufact…
FortiGuard Labs describes a large-scale, global campaign that uses heavily obfuscated JScript droppers to launch an AutoIt/Lua-based loader with low detection rates. The loader delivers several popular RATs and infostealers, including a version of Snake Keylogger. The infection chain relies on business email compromise tactics, impersonat…
Cisco Talos disclosed an APT spear-phishing and quishing campaign, tracked as UAT-11985, that targets individuals affiliated with Taiwan research organizations. First seen in mid-2026, it uses fake event invitations to lead victims to an adversary-in-the-middle (AitM) phishing framework that harvests Google account credentials and MFA cod…
This weekly recap covers several concurrent incidents. ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors abused them to compromise Microsoft 365 tenants. China-nexus Armory Castle (UNC5221 / Warp Panda) exploited BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) as a zero-day in lat…
Check Point Research reports that commercial antidetect browsers, notably Kameleo, AdsPower and MultiLogin, are widely referenced on Russian-language underground forums and marketplaces. They are used for account takeover, payment card fraud (carding), fraudulent loan applications, ad-revenue fraud, bulk creation of fake accounts and coor…
A Huntress thought-leadership post sets out five priorities for security leaders in 2026: abuse of trusted IT tools, AI-enabled cybercrime, social engineering, multi-extortion ransomware and identity-based attacks including BEC. The article cites internal Huntress telemetry showing RMM abuse rising roughly 277% year over year, with Screen…
Zscaler ThreatLabz's 2026 Ransomware Report describes ransomware operators using generative AI to sharpen phishing, speed up reconnaissance and pick out the most sensitive corporate data to steal. The report records 896.2 TB exfiltrated by the top 10 ransomware groups between April 2025 and March 2026. The article cites a 275.8% annual in…
Check Point Research's Q3 2026 Brand Phishing Report finds Microsoft was the most impersonated brand, at 33% of all attempts (up from 23% in Q2) and roughly four times the share of any other brand. Apple, Google, LinkedIn and Amazon completed the top five, together accounting for more than half of attempts. Dropbox (up ten places to eight…
This SentinelOne weekly roundup (Week 39, 2026) covers one law enforcement success and two active threat campaigns. A US court sentenced Armenian national Karen Serobovich Vardanyan ("Maneeken"/"Karl Lagerfeld"), an initial access specialist for Ryuk ransomware, to two years in prison and over $1.2 million in restitution. SentinelLABS ide…
Russian firm Solar (a Rostelecom subsidiary) reported a nearly two-year intrusion at an unnamed Russian healthcare organization, attributed to the Belarus-aligned hacktivist cluster Partisan Zmiy (Cyber Partisans). Solar found the compromise in December 2025, but the earliest signs date to early 2024. Unlike the group's usual destructive …
Unit 42 attributes with high confidence to an Iranian state-aligned actor, tracked as CL-STA-1178, a campaign called Blinder Tunnel. In March 2026 it targeted an individual in Iraq's critical infrastructure sector, after infrastructure staging that began as early as November 2025. The actor impersonated the Dubai Airports IT department an…
Darktrace researchers documented a new campaign distributing CikaBika Bot, a Rust-based remote access trojan controlled entirely through Discord. The infection chain starts with a disk image named PropositionProjet.img, which contains a French-language decoy PDF and a Windows shortcut disguised as a Word document. A Nim loader extracts th…
Kaspersky's analysis of Operation FlashHole describes a Lazarus Group campaign against South Korean organizations. It follows Operation SyncHole and is placed within the broader Cascade Hole activity. The earliest evidence dates to July 2025 (securelist.com, bleepingcomputer.com), and Kaspersky identified at least three victims in the sof…
CISA ran concurrent red team assessments at two organizations: Organization A (Government Services and Facilities) and Organization B (Water and Wastewater Systems). Both reached full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organization A did not detect or contain the activity. Organization B …
A joint StopRansomware advisory (AA26-293A) from CISA, the FBI, the USSS, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit details SafePay ransomware activity observed through August 2026 (cisa.gov). The group has been active since August 2024 and has compromised …
A multinational advisory (CISA, NSA, FBI, AIVD, MIVD, NCSC-UK and others) warns that the Russian state-supported APT LAUNDRY BEAR (aka Void Blizzard, TA488) has compromised Western government, defense industrial base and NGO organizations running Zimbra Collaboration Suite (ZCS) since at least July 2025. The campaign uses a view-based XSS…
