8 casos · pág. 1/1
Between April and July 2026, the threat actor UNC7017 tampered with the AOMEI Backupper update infrastructure several times to deliver the CrossRoad downloader and the ShinyRoad modular backdoor. Each tampering window lasted only five to ten minutes before reverting to authentic files. This made the campaign hard to detect and suggests it…
Between April and July 2026, a threat actor tracked as UNC7017 compromised AOMEI update and notification infrastructure and used it to push malware to users of AOMEI Backupper. The attackers briefly altered two configuration files and restored them within minutes to evade detection. The campaign was uncovered by ManageEngine's Threat Anal…
TrustedSec (author Brandon Colley) publishes practical guidance on building an effective logging, auditing, monitoring and alerting program for Active Directory (AD). It is based on recurring logging and auditing gaps found in the firm's AD assessments, where logging is treated as a switch to flip rather than a discipline owned by someone…
Between May and July 2026, attackers tracked by Google Threat Intelligence Group (GTIG) as UNC7017 altered files on AOMEI's own update servers for windows of 5 to 10 minutes. Any copy of AOMEI Backupper that checked for updates during a window downloaded and ran a backdoor. GTIG, Mandiant and ManageEngine's Threat Analysis Lab disclosed t…
A supply chain campaign tracked as UNC7017 hijacked the update infrastructure of AOMEI Technology between April and July 2026 to distribute the CROSSROAD downloader and the SHINYROAD backdoor through AOMEI Backupper and AnyViewer update workflows. The attackers tampered with server configurations only briefly, then restored legitimate con…
CymruSec 2026, billed as Wales' leading cross-sector cyber security event, takes place on Thursday 22 October at Cardiff City Stadium. Final places remain for delegates. The agenda covers the evolving threat landscape, AI-driven cybercrime, identity security, agentic threat hunting and organisational resilience. Speakers come from industr…
An active supply chain attack is abusing a compromised credential for the ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 OAuth application, giving unknown actors access to customer tenants. Huntress confirmed unauthorized sign-ins in 173 partner/customer tenants, and Microsoft reports broad successful service principal authenti…
The second CymruSec cross-sector cybersecurity conference takes place on 22 October 2026 at Cardiff City Stadium in Wales. It is a free-to-attend event focused on shared learning, emerging threats, new research, changing adversarial tactics and practical ways to improve resilience and response. Speakers come from organisations including M…
