Threat actors are leveraging Telegram bots as command-and-control (C2) infrastructure to maintain persistent backdoor access to government networks across the Middle East. This sophisticated campaign uses encrypted messaging channels to remotely execute commands, exfiltrate sensitive data, and evade
A sophisticated Windows exploitation technique leveraging bind links allows attackers to bypass critical security controls including Endpoint Detection and Response (EDR) systems, Anti-Malware Scan Interface (AMSI), AppLocker, and Sysmon monitoring. By manipulating Windows’ native bind link function
Microsoft has confirmed widespread synchronization delays affecting Windows Server Update Services (WSUS), disrupting enterprise patch deployment infrastructure globally. Organizations relying on WSUS for centralized update management are experiencing sync failures, incomplete metadata downloads, an
A critical remote code execution (RCE) vulnerability (CVE-2025-14266) has been discovered in 7-Zip, one of the world’s most popular file compression utilities. The flaw resides in the XZ archive format decompression module and allows attackers to execute arbitrary code when a victim extracts a speci
A critical remote code execution (RCE) vulnerability in ServiceNow, tracked as CVE-2024-6875, is now being actively exploited by threat actors. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable ServiceNow instances, affecting multiple versions of the platform. Organiz
North Korean state-sponsored threat actors have deployed a sophisticated steganographic technique to deliver OTTERCOOKIE malware by concealing malicious payloads within SVG (Scalable Vector Graphics) image files. This campaign specifically targets software developers, leveraging seemingly benign ima
Ukrainian threat group UAC-0145 has launched a sophisticated social engineering campaign using fake CAPTCHA verification prompts, known as “ClickFix,” to trick users into executing malicious PowerShell commands. The campaign specifically targets Ukrainian users through compromised websites and phish
Threat actors have weaponized the legitimate update mechanism of ViPNet, a widely-deployed secure communication software used across Russian government agencies, to deliver malicious payloads. The attack demonstrates advanced knowledge of the software’s architecture and represents a significant supp
A sophisticated Chinese-linked rootkit named Daxin has been discovered operating continuously for 13 years on a Taiwan-based manufacturer’s network. This advanced kernel-level malware employs innovative communication techniques, including hijacking legitimate TCP/IP stack communications to evade det
A critical heap buffer overflow vulnerability (CVE-2026-42533) has been discovered in NGINX’s map directive regex processing that could allow remote code execution. The flaw affects NGINX versions prior to 1.26.2 and 1.27.1, potentially impacting millions of web servers worldwide. Organizations usin