Chinese APT group Fire Ant has compromised Cisco routers to establish covert data exfiltration channels using GRE tunnels. The attackers exploit legitimate networking protocols to blend malicious traffic with normal operations, making detection extremely challenging. Organizations using Cisco routin
China-linked APT group Fire Ant has been discovered leveraging compromised Cisco routers as covert infrastructure for espionage operations. The group embeds malicious implants directly into network devices, allowing persistent access while blending seamlessly with legitimate traffic. This campaign d
Two alleged members of the TeamPCP cybercriminal group have been arrested and face federal charges following a months-long supply-chain attack campaign that compromised multiple software vendors and affected thousands of downstream organizations. The arrests mark a significant disruption to one of 2
The FBI has successfully disrupted the QTFY hacking infrastructure, a sophisticated Chinese state-sponsored operation targeting U.S. critical infrastructure and government networks. The operation involved seizing command-and-control servers and disrupting malicious implants across compromised system
The United States Department of Justice has indicted 17 Iranian nationals for orchestrating a sophisticated, multi-year cyber espionage campaign targeting critical infrastructure, government agencies, and private sector organizations across multiple countries. The operation compromised thousands of
Security researchers have identified 15 malicious Firefox browser extensions that exploited Cloudflare Workers to exfiltrate sensitive cryptocurrency wallet data from unsuspecting users. These extensions masqueraded as legitimate productivity and utility tools while covertly harvesting private keys,
T-Mobile’s cybersecurity team took the extraordinary step of physically cutting a network cable to disconnect Chinese state-sponsored threat actors who had infiltrated their infrastructure. This drastic measure highlights the severity of the intrusion and the challenges telecommunications providers
Critical vulnerabilities in the Connective eID browser extension expose over 2 million Belgian citizens to remote code execution (RCE) and PIN theft attacks. The flaws affect the extension used for national electronic identification, allowing malicious websites to trigger arbitrary code execution an
Security researchers have uncovered a novel attack technique called “CSS Bomb” that weaponizes Cascading Style Sheets (CSS) to transform malicious emails into real-time keyloggers. When victims open these specially crafted emails in web-based email clients, the embedded CSS code captures every keyst
CrowdStrike has released critical threat hunting guidance for detecting shell command obfuscation techniques targeting VMware ESX environments. Attackers are leveraging sophisticated obfuscation methods to evade detection while executing malicious commands on hypervisor infrastructure. Organizations