/
ttps_attack:T1021.001 × limpar

Resultados

6 casos · pág. 1/1

theregister.com · · 3 fontes · 3 atualizações critical

Qilin, INC and Settra ransomware crews exploit PAN-OS GlobalProtect bug CVE-2026-0257 since June, pivoting to ESXi

Multiple ransomware groups, including Qilin and INC, are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portals and gateways. Unit 42 has been investigating intrusions since early June across many sectors, including finance, healthcare and manufacturing. The flaw was patched on May 13 and ini…

unit42.paloaltonetworks.com · critical

Ransomware groups Qilin, Inc and Settra actors exploit PAN-OS GlobalProtect auth bypass CVE-2026-0257, pivoting to vCenter/ESXi

Palo Alto Networks Unit 42 reports active exploitation of CVE-2026-0257, an authentication bypass in the portal and gateway components of PAN-OS GlobalProtect. The flaw lets unauthorized attackers circumvent security controls and open VPN connections. The October 19 update says Unit 42 continues to see exploitation attempts by ransomware …

infosecurity-magazine.com · high

CISA, Germany and UK advisory: SafePay ransomware has compromised at least 600 critical infrastructure victims

A joint advisory from US, German and UK government agencies, including CISA, says the SafePay ransomware group has compromised at least 600 critical infrastructure organizations since emerging in August 2024. Victims are in North America, South America, Europe and Australia. SafePay has been one of the most active ransomware groups in 202…

NightEagle (APT-Q-95) targets Russian organizations with GhostContainer Exchange backdoor and RDP tunneling

Kaspersky GERT reports that the NightEagle APT (also tracked as APT-Q-95), active since at least 2023 and previously focused on Asia, is now attacking businesses in Russia. The attackers usually gain access through compromised valid credentials on corporate VPNs, connecting from Russian IPs tied to Cloudflare WARP tunnels and from Europea…

gbhackers.com · · 2 fontes · 2 atualizações critical

CISA advisory: SafePay ransomware has hit 600+ organizations and destroys backups via VSS shutdown and NAS factory resets

A joint advisory published on October 20, 2026 by CISA, the FBI, the United States Secret Service and German and UK law enforcement says SafePay ransomware actors have compromised at least 600 organizations across critical infrastructure sectors in North America, South America, Europe and Australia since August 2024. The findings cover in…

cisa.gov · high

CISA and FBI #StopRansomware advisory on Gunra, a Conti-derived RaaS exploiting Fortinet and VPN flaws for double extortion

The FBI, CISA, DC3, NSA, USSS and the Republic of Korea's KNPA issued joint advisory AA26-222A on Gunra ransomware. Gunra appeared in April 2025 as a double-extortion variant derived from the leaked Conti source code. It launched a structured RaaS affiliate program in January 2026, also operating under the alias Golden Community, and recr…