A sophisticated backdoor dubbed “Mistic” has been linked to KongTuke, a known ransomware access broker operating in the cybercriminal underground. The malware enables initial access operations by maintaining persistent, stealthy footholds in compromised networks before selling access to ransomware o
The dark web’s cybercrime marketplace has evolved into a sophisticated economy where stolen identities sell for as little as 95 cents, malware-as-a-service operates on subscription models, and scam kits are available for hire. This underground ecosystem generates billions annually, fueling identity
A coordinated international operation has successfully cleaned 14,971 compromised WordPress websites infected with the SocGholish malware framework. This sophisticated JavaScript-based infection chain has been actively targeting WordPress sites for years, delivering fake browser updates that install
Gentlemen ransomware-as-a-service (RaaS) has emerged with sophisticated tactics that leverage multiple Endpoint Detection and Response (EDR) killing tools to disable security software before encryption. The operation employs bring-your-own-vulnerable-driver (BYOVD) attacks and exploits legitimate ut
DragonForce ransomware operators have weaponized Microsoft Teams as a covert communication channel to hide malware activity from security monitoring tools. By abusing the legitimate collaboration platform’s traffic, attackers successfully blend command-and-control communications within normal busine
A critical authentication bypass vulnerability in SimpleHelp remote support software has left nearly 14,000 publicly accessible servers exposed to potential compromise. The flaw allows unauthenticated attackers to gain unauthorized access to remote desktop sessions, potentially exposing sensitive co
A critical vulnerability in SimpleHelp remote support software allows unauthenticated attackers to create rogue administrator accounts, potentially granting complete control over remote support infrastructure. The flaw affects versions prior to 5.5.6 and has been assigned CVE-2024-57726 with a CVSS
Mackay Sugar, one of Australia’s largest sugar producers, has publicly disclosed a cyberattack that disrupted its operations. The company confirmed unauthorized access to its IT systems and has engaged cybersecurity experts while working with law enforcement. The incident highlights the ongoing thre
Threat actors are leveraging Microsoft Graph API reconnaissance techniques to identify and target payroll and HR employees within organizations, ultimately exfiltrating sensitive salary data. By abusing legitimate Graph API permissions and queries, attackers blend reconnaissance activities with norm
The Gentlemen ransomware operation has compromised 483 organizations across nine months, leveraging a sophisticated multi-pronged attack strategy combining infostealer malware, AI-powered reconnaissance, and an unprecedented 90% profit-sharing model with affiliates. This aggressive newcomer demonstr