9 casos · pág. 1/1
Unit 42 detailed a multi-stage intrusion in September 2024 against a telecommunications managed service provider, tracked as CL-STA-0954 (aka UNC5820). The attackers gained initial access by exploiting CVE-2024-47575 (FortiJump) on a central FortiManager and exfiltrated an archive with running configurations, credentials and private keys …
Palo Alto Networks Unit 42 reports that a suspected advanced actor tracked as CL-STA-0954 (aka UNC5820) deployed a previously unreported memory-resident ARM64 implant, PEERSTITCH, on Fortinet FortiGate firewalls. The group exploited the FortiOS path traversal flaw CVE-2025-61624 for the final stage. The intrusion hit a telecommunications …
Between April and July 2026, the threat actor UNC7017 tampered with the AOMEI Backupper update infrastructure several times to deliver the CrossRoad downloader and the ShinyRoad modular backdoor. Each tampering window lasted only five to ten minutes before reverting to authentic files. This made the campaign hard to detect and suggests it…
A supply chain campaign tracked as UNC7017 hijacked the update infrastructure of AOMEI Technology between April and July 2026 to distribute the CROSSROAD downloader and the SHINYROAD backdoor through AOMEI Backupper and AnyViewer update workflows. The attackers tampered with server configurations only briefly, then restored legitimate con…
Between April and July 2026, a threat actor tracked as UNC7017 compromised AOMEI update and notification infrastructure and used it to push malware to users of AOMEI Backupper. The attackers briefly altered two configuration files and restored them within minutes to evade detection. The campaign was uncovered by ManageEngine's Threat Anal…
Between May and July 2026, attackers tracked by Google Threat Intelligence Group (GTIG) as UNC7017 altered files on AOMEI's own update servers for windows of 5 to 10 minutes. Any copy of AOMEI Backupper that checked for updates during a window downloaded and ran a backdoor. GTIG, Mandiant and ManageEngine's Threat Analysis Lab disclosed t…
F5 Labs published its 2026 cybersecurity predictions and scored its 2025 forecasts at 6.5/8, by its own assessment. The 2025 review cites AI-powered botnets, attacks on AI model APIs, AI side-channel attacks on cryptography, APT use of hacktivist personas, and expanded Roskomnadzor powers to isolate or reroute Russian internet traffic fro…
MITRE released version 20 of its ATT&CK framework, expanding coverage of recent adversary tradecraft across the Enterprise, ICS and Mobile domains. Enterprise gains nine techniques and sub-techniques, including two prompt injection techniques (direct and indirect), abuse of an organization's own AI agents for data theft, poisoning of web …
An active supply chain attack is abusing a compromised credential for the ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 OAuth application, giving unknown actors access to customer tenants. Huntress confirmed unauthorized sign-ins in 173 partner/customer tenants, and Microsoft reports broad successful service principal authenti…
