Dark Reading
External Teams Chats Anchor 15-Minute Malware Delivery
Main bombing sis getting a new look with a wide-scale, ongoing social engineering campaign that might be tied to the Black Basta ransomware gang.
آرشیو ۹۰ روزه
همهٔ اخبار
جستوجو در عنوان، خلاصه یا نام منبع. هر خبر به صفحهٔ اصلی خودش لینک دارد.
دسته: بدافزار و آلودگی
پاک کردن فیلترها
۵۴۳ خبر
صفحهٔ ۱ از ۱۹
The Record (Recorded Future)
Nefilim, Hive ransomware operator given five-year-plus sentence after guilty plea
Ukrainian national Artem Stryzhak, 36, had pleaded guilty last year to charges related to participating in at least two well-known ransomware groups.
CyberScoop
Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison
Artem Stryzhak participated in a series of ransomware attacks on hospitals, government entities and law firms from the middle of 2018 to late 2021. The post Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison appeared first on CyberScoop.
Citizen Lab
Serbian Prosecutor Who Investigated Belgrade Trump Tower Project ‘Targeted with Spyware’
New findings by the Citizen Lab and SHARE Foundation show that a prominent supporter of Serbia's student movement was targeted with spyware. The post Serbian Prosecutor Who Investigated Belgrade Trump Tower Project ‘Targeted with Spyware’ appeared first on The Citizen Lab.
Dark Reading
'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants
The malware's focus on AI tools expands the traditional infostealer playbook to expose a forest of AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint.
Infosecurity Magazine
Cyber Incident Forces UNM Health to Cancel Surgeries, Divert Ambulances
The University of New Mexico is working to restore systems following the incident, which has been claimed by the BYOD ransomware group
EFF
French Court’s Site-Blocking Orders Drive Quad9 Out Of France
A nonprofit service that protects internet users’ privacy is leaving France. Quad9, a free DNS resolver, has said it will reluctantly stop serving users in France on November 24. This follows a French court order that Quad9 must block access to websites that are accused of infringing the copyrights of a sports broadcaster. Forcing a responsible privacy service out of an important market is a predictable result of try…
CyberScoop
National cyber director rolls out latest pilot in South Carolina, this time for rural hospitals
Like the water sector initiative, the six-month pilot program will connect rural hospitals with industry for free services. The post National cyber director rolls out latest pilot in South Carolina, this time for rural hospitals appeared first on CyberScoop.
ANY.RUN
SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises
SkyW4lker (SkyW4lker x365 Sentinel) is an active device-code phishing kit targeting Microsoft 365 users in the United States, Europe, and other regions. By abusing Microsoft’s legitimate authentication process, the kit can give attackers access to corporate accounts without stealing passwords or bypassing MFA. This puts business emails, sensitive documents, and other Microsoft 365 resources at […] The post SkyW4lker…
SOCRadar
September 2026: FBI Breach, Clop Hijack & IDScan Leak
The major cyber attacks of September 2026 hit federal law enforcement, a rival cybercrime gang, and the companies that verify identities. ShinyHunters hijacked the Clop ransomware gang’s Dark Web leak site and, four days later, claimed a breach of the Federal Bureau of Investigation (FBI). Identity data drove the month’s biggest numbers, led by adata […]
The Record (Recorded Future)
Malicious apps prey on Russians’ anxiety about fuel prices, drone strikes
Cybercriminals are stuffing infostealer malware into bogus apps aimed at tracking gas prices, police activity, drone strikes and other information of concern to average Russians, researchers said.
Flashpoint
Ransomware in the Age of AI: How Defenders Can Break the Attack Chain
Flashpoint's new guide examines how modern ransomware attacks unfold, from initial access to recovery, and the intelligence security teams need to disrupt attacks at every stage. The post Ransomware in the Age of AI: How Defenders Can Break the Attack Chain appeared first on Flashpoint.
Tenable Blog
Whole-of-state defense: How SLED agencies can secure critical infrastructure in the AI era
AI is widening the attack surface of the critical infrastructure facilities and services that state, local, and education (SLED) organizations run. In the final post of our Cybersecurity Awareness Month series, we explain how a whole-of-state security approach can help SLED agencies protect their critical infrastructure.Key takeawaysBecause cyber attackers prey on under-resourced targets, they often go after SLED org…
SOCRadar
Australia’s Annual Cyber Threat Report 2025-26 Shows Cyber Incidents Up 20%
Australia’s cyber security authority responded to 1,524 cyber security incidents in the 2025-26 financial year, a 20% increase from the previous year and a 36% rise over five years. The latest Annual Cyber Threat Report shows that phishing, compromised accounts, unpatched systems, ransomware and data theft remain the main operational pressures. Artificial intelligence is increasing […]
Infosecurity Magazine
Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes
Arctic Wolf warned that the function enables highly effective social engineering attacks, which lead to incidents such as ransomware
The Hacker News
Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption
The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up
CSO Online
Alibaba AI model tried to send data to Beijing server, Cohere says
An Alibaba AI model generated an unexpected command to upload data to a Beijing-region cloud storage service during a cybersecurity evaluation, rival developer Cohere said, raising concerns about the security of AI agents with access to enterprise systems. The model, Qwen3.8-Flash-Next, was being tested using Microsoft’s CTI-REALM cybersecurity benchmark, which tasked it with writing a rule to detect malicious file d…
Schneier on Security
Hiding Capabilities in AI Models
Interesting research: “AI Models Can Provably Hide Arbitrary Capabilities” Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights…
CyberScoop
What happens when security tools go dark before the ransomware
A China-linked ransomware crew disabled the security tools at a critical infrastructure operator before it launched the encryptor. Most security budgets never priced that in. The post What happens when security tools go dark before the ransomware appeared first on CyberScoop.
SecurityWeek
Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
Running at system boot, it periodically polled the update domain to execute any code served, with full privileges. The post Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover appeared first on SecurityWeek.
The Hacker News
Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. "The next steps that we took were to disconnect that Amadey controller from all those
CSO Online
The days of assuming another company’s breach is someone else’s problem are over
The median blast radius of data breaches has increased year-on-year at the same time cybercriminals have begun using AI to mine stolen datasets for damaging information that enables follow-on fraud and cyberattacks. In 2026, the median breach exposed 542 organizations beyond the initially breached victim, according to a study by exposed data intelligence platform Lab 1. This compares to the median blast radius of a b…
CSO Online
OpenAI’s August fix for theft of reasoning traces was quickly bypassed
Cybersecurity research firm Xint on Monday published details of a bug in the OpenAI API that leaks raw reasoning traces from frontier OpenAI models, revealing the risk of other data leaks. OpenAI has confirmed the flaw, mitigated it, and paid a bug bounty for its discovery. The problem is that OpenAI had already deployed mitigations for the issue in August after a research report dubbed Stolen Thoughts revealed a sim…
The Register - Security
Worm armed 42 GitHub repos by hiding a payload too big to fail
Payload blobs measuring 12.9 to 13.7 MB were large enough to evade GitHub code search
Security Affairs
Magento Campaign Infects 953 Online Stores Across Five Domains
Sansec tracks a Magento skimmer campaign that infected 953 stores, using five domains, bot filtering and malicious code hidden in CMS blocks. A criminal group has infected 953 online stores since July 2025, mostly Magento shops, according to Sansec researchers. The attackers add a small piece of code to store pages. When someone visits a […]
Flare
Who Pays When AI Makes Cybercrime Cheaper? Inside the New Economics of Ransomware and Extortion
Tammy Harper, Senior Threat Intelligence Researcher Walking around Strasbourg during Underground Economy, I found myself thinking about the businesses as much as the buildings. Behind every restaurant storefront, there is work the customer never sees: someone supplies it, someone pays for it, and the business survives on whatever is left over. It made me wonder […] The post Who Pays When AI Makes Cybercrime Cheaper?…
EFF
Lessons Learned From 'AdFection' and What To Do Next
Last week, researchers at Citizen Lab revealed a horrifying new malware campaign, dubbed “AdFection.” It used an ad network to distribute spyware to journalist’s devices to infect them without the target ever needing to click anything. This sort of attack on journalists is dangerous and incredibly concerning, especially since it’s built on the backbone of a technology we already object to: behavioral advertising. Alt…
The Hacker News
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. "A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT
Security Affairs
AI-Generated Fake Bank Calls and NFC App Enabled €380,000 Fraud, Dutch Police Say
Dutch police arrest two men over AI-voiced bank fraud that allegedly used a fake app to steal card data from 170 victims, causing €380,000 in losses. Rotterdam police have arrested two men over a new type of bank fraud that used AI-generated phone calls, a fake banking app, and NFC technology to steal bank card […]
SecurityWeek
953 Online Stores Infected in Long-Lasting Malware Campaign
Small loader code injected into the stores served a payload to visitors or did nothing to avoid detection. The post 953 Online Stores Infected in Long-Lasting Malware Campaign appeared first on SecurityWeek.