184 casos · pág. 7/10
Threat actors are abusing the open source AI platform Cairn, an agent-coordination engine usable as an autonomous penetration testing tool, to automate attacks on hundreds of websites worldwide. AI security firm Norforge found the activity after threat actors left their Cairn panels exposed, following a Gambit Security report on attackers…
A multinational advisory (CISA, NSA, FBI, AIVD, MIVD, NCSC-UK and others) warns that the Russian state-supported APT LAUNDRY BEAR (aka Void Blizzard, TA488) has compromised Western government, defense industrial base and NGO organizations running Zimbra Collaboration Suite (ZCS) since at least July 2025. The campaign uses a view-based XSS…
A joint advisory (AA26-281A) attributes China-based malicious cyber activity to Integrity Technology Group (Integrity Tech), a for-profit company with links to the Chinese government. The company builds and sells tools, hosts infrastructure and compromises networks worldwide. The actors' TTPs are consistent with Flax Typhoon, Ethereal Pan…
The Mini Shai-Hulud worm from May 2026 is still infecting new GitHub repositories. SafeDep found six repositories that received malicious hook files between 20 and 24 September 2026. The cause is that all tags of the actions-cool/issues-helper GitHub Action, hijacked on 18 May 2026, still point to the malicious commit, and the payload is …
The F5 Labs 2026 State of PQC on the Web report scanned the top 1 million domains with TLS 1.3 handshakes. It found that 54% support post-quantum (hybrid) key exchange, but the figure is driven mainly by CDNs, especially Cloudflare and Fastly, which enable PQC by default. Excluding Cloudflare-hosted domains, adoption falls to 22%. Sectors…
TrustedSec (author Brandon Colley) publishes practical guidance on building an effective logging, auditing, monitoring and alerting program for Active Directory (AD). It is based on recurring logging and auditing gaps found in the firm's AD assessments, where logging is treated as a switch to flip rather than a discipline owned by someone…
Kaspersky researchers report that the APT group Mirage Kitten has moved from native C/C++/Go malware to Node.js and JavaScript implants, NodeRabbit and PollCat. Both are cross-platform RATs delivered through spear-phishing by fake recruiters on LinkedIn and other job platforms, using trojanized coding-challenge archives hosted on Amazon S…
The leaker CyberLeek, behind a series of leaks of Rockstar Games' upcoming Grand Theft Auto 6, has threatened to publish a complete, playable build of the game. The threat followed the release of about 25 minutes of new footage, which Eurogamer reviewed and judged to appear legitimate, noting it carried CyberLeek's emblem. Instead of dema…
The Netherlands' Tax and Customs Administration has abandoned its planned Microsoft 365 public-cloud rollout and will move to an on-premises, open-source approach, citing digital sovereignty and data control concerns. About 5,000 employees had already migrated when the Dutch Advisory Council on ICT Assessment recommended reversing the rol…
Infoblox links the long-running Help TDS traffic distribution system, active since at least 2017, to the Russian-language affiliate program Hotejka, assessed with high confidence to be a rebrand of the traffic monetization operation ROI777. Help TDS supplies PHP templates and a malicious WordPress plugin that affiliates install on comprom…
Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has …
A vendor-sponsored analysis by Exaforce (published on bleepingcomputer.com) says attackers are enumerating or exfiltrating data within about 15 minutes of gaining access. It describes three patterns: stolen developer GitHub OAuth tokens, ClickFix lures that impersonate Claude Code install instructions to deliver a macOS stealer, and help …
FoxIO disclosed a class of denial-of-service flaws in the QPACK header compression used by HTTP/3. It affects seven of the ten stacks the firm tested and was released with working proof-of-concept code. An unauthenticated remote attacker can send a small compressed header batch that expands in memory by thousands of times, exhausting a de…
CISA, the FBI, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz and two UK law enforcement agencies published a joint advisory on the SafePay ransomware group. The group has compromised at least 600 organizations across critical infrastructure sectors in North America, South America, Europe and Australia since August 202…
A ClickFix malvertising campaign uses sponsored Google results for "amazon business" to lure victims to a fake Amazon login page on Google Sites and then to a fake CAPTCHA. The CAPTCHA pastejacks a command into the clipboard that the victim is told to run in the Windows Run box. The command abuses the legacy finger.exe utility to fetch a …
BRONZE SANDCASTLE (written Bronze Sandcastle by thehackernews.com) is a previously undocumented intrusion set disclosed by SophosLabs on 2026-10-21. It is assessed as China-based or China-aligned and has been active since mid-2025 (thehackernews.com). Between August 2025 and August 2026 it compromised victims in the Philippines, Taiwan, A…
Symantec reports that the Russia-linked APT28 (aka Swallowtail, Fancy Bear, Forest Blizzard, BlueDelta), which the U.S. government links to the GRU, targeted organizations in two NATO member states. Victims were a naval shipbuilder, a manufacturer of military aircraft engines and a law enforcement agency (thehackernews.com, cyberscoop.com…
A leaked Anthropic S-1 filing, reported by The Wall Street Journal and summarized by TechCrunch, says the company is struggling to secure enough cloud capacity from AWS, Google and Microsoft, which increasingly see it as a competitor. Anthropic expects to spend more than $750 billion on cloud contracts, some still under negotiation. It is…
GreyNoise reports that a single malicious cyber actor, tracked since 7 May 2026, is a suspected Chinese speaker working in UTC+8 and is the same as or related to Red Heron (reported by Acronis), based on the shared C2 domain, malware family, Gitea exploitation and other TTPs. The actor exploited the wp2shell WordPress chain (CVE-2026-6303…
GreyNoise reports that on 31 August 2026 a likely Russian-speaking malicious cyber actor used 45.142.193.132 and AI to develop, test and deploy exploits for PaperCut NG/MF (CVE-2026-81578 and CVE-2026-82078). Using hundreds of AI agents built on OpenAI's Codex harness, a DeepSeek model and public offensive security tools, the actor compro…
