Oracle E-Business Suite faces active exploitation of CVE-2024-46817, a critical vulnerability allowing unauthenticated remote code execution. Attackers are leveraging this flaw to compromise enterprise systems, with proof-of-concept exploits circulating in underground forums. Organizations running O
A sophisticated backdoor dubbed “Mistic” has been identified as the primary tool of an access broker supplying corporate network credentials to ransomware operators. The malware features advanced evasion techniques including self-destruction capabilities, encrypted communications, and minimal forens
Mistic, a newly discovered backdoor, is being deployed in ransomware intrusion chains as a persistent access mechanism. This sophisticated malware combines advanced evasion techniques, encrypted command-and-control (C2) communications, and modular capabilities to maintain long-term access to comprom
Threat actors are actively exploiting unpatched Microsoft SharePoint servers to deploy ransomware and custom backdoors across enterprise networks. Multiple attack campaigns targeting known SharePoint vulnerabilities have been observed in the wild, with attackers leveraging these entry points to esta
A sophisticated backdoor dubbed “Mistic” has been linked to KongTuke, a known ransomware access broker operating in the cybercriminal underground. The malware enables initial access operations by maintaining persistent, stealthy footholds in compromised networks before selling access to ransomware o
The dark web’s cybercrime marketplace has evolved into a sophisticated economy where stolen identities sell for as little as 95 cents, malware-as-a-service operates on subscription models, and scam kits are available for hire. This underground ecosystem generates billions annually, fueling identity
A coordinated international operation has successfully cleaned 14,971 compromised WordPress websites infected with the SocGholish malware framework. This sophisticated JavaScript-based infection chain has been actively targeting WordPress sites for years, delivering fake browser updates that install
Gentlemen ransomware-as-a-service (RaaS) has emerged with sophisticated tactics that leverage multiple Endpoint Detection and Response (EDR) killing tools to disable security software before encryption. The operation employs bring-your-own-vulnerable-driver (BYOVD) attacks and exploits legitimate ut
DragonForce ransomware operators have weaponized Microsoft Teams as a covert communication channel to hide malware activity from security monitoring tools. By abusing the legitimate collaboration platform’s traffic, attackers successfully blend command-and-control communications within normal busine
A critical authentication bypass vulnerability in SimpleHelp remote support software has left nearly 14,000 publicly accessible servers exposed to potential compromise. The flaw allows unauthenticated attackers to gain unauthorized access to remote desktop sessions, potentially exposing sensitive co