11 casos · pág. 1/1
Industrial Cyber interviews OT security executives from Dragos, OMV Petrom, Thales and an energy-sector former CISO on how upstream oil and gas operators secure dispersed, remote and often unmanned sites. The article cites the Dragos 2026 OT/ICS review: 29% of oil and gas cases showed poor IT/OT segmentation, the highest of any sector, an…
Researcher Harsh Jaiswal (Hacktron) disclosed an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect when Cloud Authentication Service (CAS) is enabled, tracked as CVE-2026-0265. With help from Claude and Ghidra MCP, he found that the firewall's JWT verification trusts the alg field in the token header. An attacker can theref…
Huntress reports that manufacturing accounted for about 17% of cyber attacks in 2025, up from 9% in 2024, citing its own cyber threat report. The article is a vendor trends piece rather than an incident report. It argues that ransomware operators now target production uptime and operational technology (OT), not just data, because manufact…
In April 2026, Kaspersky GERT responded to an incident at a Middle East manufacturing organization where the actor gained domain admin-equivalent control of Active Directory. The actor created and linked a malicious GPO named PAYLOAD at the domain root. It pushed ransom notes, a wallpaper and lock screen, a logon banner and a local admini…
Unit 42 investigated a months-long intrusion against a European bank, which began with unauthorized VPN-based access through a third-party-managed external gateway appliance that did not enforce strict authentication. Using compromised credentials, the attacker ran noisy, high-volume internal reconnaissance and brute-force campaigns again…
Multiple ransomware groups, including Qilin and INC, are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portals and gateways. Unit 42 has been investigating intrusions since early June across many sectors, including finance, healthcare and manufacturing. The flaw was patched on May 13 and ini…
Palo Alto Networks Unit 42 reports active exploitation of CVE-2026-0257, an authentication bypass in the portal and gateway components of PAN-OS GlobalProtect. The flaw lets unauthorized attackers circumvent security controls and open VPN connections. The October 19 update says Unit 42 continues to see exploitation attempts by ransomware …
A joint advisory (AA26-281A) attributes China-based malicious cyber activity to Integrity Technology Group (Integrity Tech), a for-profit company with links to the Chinese government. The company builds and sells tools, hosts infrastructure and compromises networks worldwide. The actors' TTPs are consistent with Flax Typhoon, Ethereal Pan…
Kaspersky GERT reports that the NightEagle APT (also tracked as APT-Q-95), active since at least 2023 and previously focused on Asia, is now attacking businesses in Russia. The attackers usually gain access through compromised valid credentials on corporate VPNs, connecting from Russian IPs tied to Cloudflare WARP tunnels and from Europea…
A joint advisory published on October 20, 2026 by CISA, the FBI, the United States Secret Service and German and UK law enforcement says SafePay ransomware actors have compromised at least 600 organizations across critical infrastructure sectors in North America, South America, Europe and Australia since August 2024. The findings cover in…
The FBI, CISA, DC3, NSA, USSS and the Republic of Korea's KNPA issued joint advisory AA26-222A on Gunra ransomware. Gunra appeared in April 2025 as a double-extortion variant derived from the leaked Conti source code. It launched a structured RaaS affiliate program in January 2026, also operating under the alias Golden Community, and recr…
