7 casos · pág. 1/1
Researcher Harsh Jaiswal (Hacktron) disclosed an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect when Cloud Authentication Service (CAS) is enabled, tracked as CVE-2026-0265. With help from Claude and Ghidra MCP, he found that the firewall's JWT verification trusts the alg field in the token header. An attacker can theref…
CISA, the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz and the UK's National Crime Agency and North West Regional Organised Crime Unit issued a joint advisory on the SafePay ransomware group. SafePay has breached at least 600 critical infrastructure organizations across North America, South America, Europe and…
In April 2026, Kaspersky GERT responded to an incident at a Middle East manufacturing organization where the actor gained domain admin-equivalent control of Active Directory. The actor created and linked a malicious GPO named PAYLOAD at the domain root. It pushed ransom notes, a wallpaper and lock screen, a logon banner and a local admini…
A joint advisory from US, German and UK government agencies, including CISA, says the SafePay ransomware group has compromised at least 600 critical infrastructure organizations since emerging in August 2024. Victims are in North America, South America, Europe and Australia. SafePay has been one of the most active ransomware groups in 202…
A joint advisory (AA26-281A) attributes China-based malicious cyber activity to Integrity Technology Group (Integrity Tech), a for-profit company with links to the Chinese government. The company builds and sells tools, hosts infrastructure and compromises networks worldwide. The actors' TTPs are consistent with Flax Typhoon, Ethereal Pan…
Kaspersky GERT reports that the NightEagle APT (also tracked as APT-Q-95), active since at least 2023 and previously focused on Asia, is now attacking businesses in Russia. The attackers usually gain access through compromised valid credentials on corporate VPNs, connecting from Russian IPs tied to Cloudflare WARP tunnels and from Europea…
The FBI, CISA, DC3, NSA, USSS and the Republic of Korea's KNPA issued joint advisory AA26-222A on Gunra ransomware. Gunra appeared in April 2025 as a double-extortion variant derived from the leaked Conti source code. It launched a structured RaaS affiliate program in January 2026, also operating under the alias Golden Community, and recr…
