22 casos · pág. 1/2
Microsoft released fixes for a record 1,411 CVEs in its October 2026 Patch Tuesday on October 13, more than the roughly 1,100 issued in all of 2025 and above the records set in July and September. The surge is attributed to Microsoft's use of AI-driven vulnerability discovery, including its multi-model agentic scanning harness (MDASH). Th…
An actor using the handle WolfBlxck posted an updated recruitment announcement for Beelzebub ransomware. The actor claims the malware was rewritten from scratch with a stronger focus on disabling endpoint defenses, suppressing telemetry and hindering incident response. The post seeks three more members: a developer, a penetration tester a…
Trend Micro published its annual threat report, Calibrating Expansion, covering 2023. It reports 161 billion threats blocked, a 10% annual increase. Attackers appear to be targeting fewer, higher-value victims with more sophisticated methods. Email and web reputation blocks fell 47% and 2%, while File Reputation Service detections rose 35…
Trend Micro published its 2025 security predictions report, The Easy Way In/Out: Securing The Artificial Future, warning that highly customized, AI-powered attacks will supercharge scams, phishing and influence operations in 2025 and beyond. The central prediction is the emergence of malicious "digital twins": breached or leaked PII used …
SentinelOne analysis argues that bring your own vulnerable driver (BYOVD) succeeds because of a signing-trust gap rather than an incomplete driver list. The Windows kernel loads drivers signed with expired or revoked certificates, and a 2026 intrusion reported by Help Net Security used a decade-old forensic driver whose certificate had lo…
SentinelOne argues that "EDR killer" covers four different techniques, and a single driver-load rule leaves blind spots. The four are bring-your-own-vulnerable-driver (BYOVD), bring-your-own-installer, admin-to-kernel, and driverless suspension. The article gives hunt logic for each and recommends rolling them out in order of signal quali…
Bitdefender documented Midnight Mimosa, an Android malware campaign that embeds a platform-signed malicious system app in the firmware of low-cost, MediaTek-based handsets and counterfeit flagship models before they reach buyers. Thousands of infected devices were observed in more than 150 countries over roughly two years. The implant dri…
The Mini Shai-Hulud worm from May 2026 is still infecting new GitHub repositories. SafeDep found six repositories that received malicious hook files between 20 and 24 September 2026. The cause is that all tags of the actions-cool/issues-helper GitHub Action, hijacked on 18 May 2026, still point to the malicious commit, and the payload is …
ESET analysis describes a two-pronged risk for small and mid-size businesses (SMBs): AI agents create new paths into business systems, while attackers use AI to add speed and scale to established threats. Between March and May 2026, ESET scanned almost 900,000 unique agent skills from popular repositories and found more than 25,000 suspic…
This SentinelOne analysis argues that EDR killing, mostly through bring your own vulnerable driver (BYOVD), has grown from one-off tooling into a maintained, shared and sold capability. Ransomware actors disabled security tools in about 48% of 2024 intrusions, and BYOVD is the fastest-growing method within that figure. The article traces …
Multiple ransomware groups, including Qilin and INC, are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portals and gateways. Unit 42 has been investigating intrusions since early June across many sectors, including finance, healthcare and manufacturing. The flaw was patched on May 13 and ini…
Palo Alto Networks Unit 42 reports active exploitation of CVE-2026-0257, an authentication bypass in the portal and gateway components of PAN-OS GlobalProtect. The flaw lets unauthorized attackers circumvent security controls and open VPN connections. The October 19 update says Unit 42 continues to see exploitation attempts by ransomware …
TrustedSec (author Brandon Colley) publishes practical guidance on building an effective logging, auditing, monitoring and alerting program for Active Directory (AD). It is based on recurring logging and auditing gaps found in the firm's AD assessments, where logging is treated as a switch to flip rather than a discipline owned by someone…
This SentinelOne weekly roundup (Week 39, 2026) covers one law enforcement success and two active threat campaigns. A US court sentenced Armenian national Karen Serobovich Vardanyan ("Maneeken"/"Karl Lagerfeld"), an initial access specialist for Ryuk ransomware, to two years in prison and over $1.2 million in restitution. SentinelLABS ide…
Unit 42 detailed a multi-stage intrusion in September 2024 against a telecommunications managed service provider, tracked as CL-STA-0954 (aka UNC5820). The attackers gained initial access by exploiting CVE-2024-47575 (FortiJump) on a central FortiManager and exfiltrated an archive with running configurations, credentials and private keys …
Kaspersky GERT reports that the NightEagle APT (also tracked as APT-Q-95), active since at least 2023 and previously focused on Asia, is now attacking businesses in Russia. The attackers usually gain access through compromised valid credentials on corporate VPNs, connecting from Russian IPs tied to Cloudflare WARP tunnels and from Europea…
Kaspersky analysis of an installer first classified as adware (MD5 c24e99f9437feacaa63766a3cde3fe3d) found that it delivers the ValleyRAT backdoor. The installer drops a modified, signed Chinese wallpaper tool, QN Wallpaper, and uses it for DLL sideloading of a malicious libcef.dll. The adware's advertising function does not work. Attacke…
Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026, according to ReliaQuest. Because access arrives through the victim's own VPN, it can resemble legitimate remote work and go unnoticed until credential theft, lateral movement, …
GreyNoise reports that a single malicious cyber actor, tracked since 7 May 2026, is a suspected Chinese speaker working in UTC+8 and is the same as or related to Red Heron (reported by Acronis), based on the shared C2 domain, malware family, Gitea exploitation and other TTPs. The actor exploited the wp2shell WordPress chain (CVE-2026-6303…
SentinelOne reports observing APT29 (Midnight Blizzard / Cozy Bear, Russia's SVR) running the CaptiveCrunch campaign, disclosed by Microsoft in July 2026, across multiple customer environments in three regions. The operation abuses captive-portal behaviour and forged name resolution to push fake browser updater downloads to roaming Window…
