Introduction Some time ago, Kaspersky MDR analysts detected a targeted attack against government IT services in the African region. The attackers used hardcoded names of internal services, IP addr...
Intro Cyber-security now ranks among the energy sector’s most acute business risks. Unlike financial scandals such as Wirecard, a single unpatched flaw in operational technology can cascade from da...
Key findings Request for Quote scammers are using vendor supplied financing to steal physical goods. They utilize email and legitimate online quote request forms to reach potential victims. Sophist...
On Sunday, July 20, Microsoft Corp. issued an emergency security update for a vulnerability in SharePoint Server that is actively being exploited to compromise vulnerable organizations. The patch c...
Lookout Discovers Iranian APT MuddyWater Leveraging DCHSpy During Israel-Iran Conflict DCHSpy is an Android surveillanceware family that Lookout customers have been protected from since 2024. It i...
A critical vulnerability discovered in Livewire, a popular full-stack framework for Laravel applications, exposes millions of web properties to unauthenticated remote command execution attacks. Tr...
Four new samples of Android spyware linked to the Iranian Ministry of Intelligence and Security (MOIS) that collects WhatsApp data, records audio and video, and hunts for files by name, surfaced sh...
A newly rebranded extortion gang known as “World Leaks” breached one of Dell’s product demonstration platforms earlier this month and is now trying to extort the company into paying a ransom. Dell...
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2025-54309 CrushFTP - CrushFTP ...
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2025-54309 CrushFTP - CrushFTP ...
GCHQ’s National Cyber Security Centre reveals Russian military intelligence are behind the use of sophisticated malware dubbed AUTHENTIC ANTICS. Formal attribution comes as the UK Government sancti...
JPCERT/CC Eyes previously introduced the malware SPAWNCHIMERA and DslogdRAT, which were deployed by exploiting vulnerabilities in Ivanti Connect Secure. At JPCERT/CC, we have continued to observe a...
In the summer of 2005, Tan Dailin was a 20-year-old grad student at Sichuan University of Science and Engineering when he came to the attention of the People’s Liberation Army of China. Tan was pa...
A financially-motivated threat actor, active since early 2021, has been targeting Mexican organizations with custom packaged installers that deliver a modified version of AllaKore RAT. Arctic Wolf ...
So far, we’ve seen the Crux ransomware being deployed in three separate incidents. Encrypted files end in the .crux file extension, and ransom notes follow the naming convention crux_readme_[random...
On July 16, 2025, Cisco updated its advisory—originally published in late June—to include a third maximum-severity vulnerability affecting Cisco Identity Services Engine (ISE) and ISE-Passive Ident...
The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a phishing campaign that’s designed to deliver a malware codenamed LAMEHUG. An obvious feature of LAMEHUG is the ...
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2024-13972 Sophos - Sophos Interc...
Last month, a customer contacted us after noticing their WordPress website was unexpectedly redirecting to a spam domain. The redirection occurred approximately 4-5 seconds after a user landed on t...
Threat hunting case study: Lumma infostealer Source: Intel471 Information stealers, or infostealers, are malware applications that hoover enormous amounts of information from machines including lo...