Cyber Attacks
BRONZE SANDCASTLE abuses Sandboxie and other apps via DLL sideloading
China-linked actors place malicious libraries next to trusted software to steal credentials and install backdoors across Asia and Africa.
Read moreBlueTeam Insider Threat Research Desk
The BlueTeam Insider Threat Research Desk is the part of the BlueTeam Insider newsroom that covers attacks, malware, scams and the groups behind them. It is a newsroom desk, not a single person. Sections: Cyber Attacks, Malware & Ransomware, Threat Intelligence. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 23 articles so far. See the editorial policy or report an error.
Cyber Attacks
IQ.Lvbs alleges unauthorized access attempts from Comma.ai IP address
Startup claims rival’s IP targeted its sign-in system and driving model during a private beta phase in October.
Read more
Cyber Attacks
Windows 11 Update Bug Blocks Smart App Control Activation; Registry Fix Available
A glitch in the latest Windows 11 update prevents users from enabling Smart App Control, though a registry workaround temporarily restores the blocked security setting.
Read more
Cyber Attacks
Generative AI Enables Custom Malware Creation and Signature Bypass
Attackers use AI to rewrite scripts and evade signature-based detection, complicating ransomware defense efforts.
Read more
Cyber Attacks
AOMEI Update Hijacking Delivers CROSSROAD via Config Tampering
Attackers briefly altered AOMEI server settings to serve backdoors, bypassing integrity checks by modifying checksums in configuration files.
Read more
Cyber Attacks
North Korean IT Identity Fraud Scheme Targets US Remote Workers
Federal raids in Texas expose a multi-year operation using stolen identities to infiltrate American corporate networks via remote access.
Read more
Cyber Attacks
Bash .bashrc Manipulation Steals Sudo Passwords From Government Targets In Unit 42 Tracked Campaign
Attackers modified Bash startup files to intercept sudo commands and steal passwords from government and infrastructure targets, according to Unit 42 research.
Read more
Cyber Attacks
CoGUI, CoAceV, and CoFish_Ws Kits Drive 17,000-Domain Phishing Campaign
A Chinese-language fraud network uses three related phishing kits and thousands of rotating domains to target Japanese banks and impersonate global brands.
Read more
Threat Intelligence
OpenAI OpSec Alert: Leadership Cites Honeypots and Insider Risks Before FBI Arrest
OpenAI leadership directed employees to adopt strict operational security measures to counter potential espionage and insider risks.
Read more
Cyber Attacks
French Supermarkets Hit by Refrigeration Controller Compromises
ANSSI warns that Copeland and Dixell systems were targeted alongside Danfoss units in attacks disrupting hundreds of stores across France.
Read more
Cyber Attacks
UK Legal Aid Agency Breach Expands to Include Records from 1978
Forensic review reveals data breach scope widens significantly, exposing decades of applicant and practitioner records to unauthorized access.
Read more
Threat Intelligence
Silent Lynx Uses Spear-Phishing and GitHub Staging for Espionage
Kazakhstan-linked actors target Russian and Central Asian entities using lightweight tools and compromised accounts to maintain persistent access.
Read more
Malware & Ransomware
Android SMS Phishing: GhostBat RAT Steals Fintech PINs via Fake mParivahan Pages in India
Android users in India face increased risk as the GhostBat malware evolves to steal financial credentials through deceptive text messages impersonating traffic services.
Read more
Cyber Attacks
Firefox Enterprise 158.0 Deploys Local DLP and AI Controls for Browser Data
Mozilla’s new enterprise browser version enforces data loss prevention and AI usage policies locally, keeping management data on-premises.
Read more
Cyber Attacks
Iron Man Phishing Kit Impersonates Global Banks and Agencies
Security researchers analyzed the Iron Man phishing-as-a-service platform, revealing its infrastructure, templates, and operator controls used for credential theft.
Read more
Cyber Attacks
Ransomware Campaigns Leverage AI to Target Enterprise Identity Platforms
A survey of ransomware victims reveals AI assistance in most incidents, with identity management systems serving as the primary attack surface for credential theft.
Read more
Cyber Attacks
GhostProfile Mac Implant Uses Cloned Profiles for Hidden Browser Control
A new macOS malware creates invisible browser instances to hijack active web sessions, bypassing traditional screen-sharing detection methods.
Read more
Malware & Ransomware
ShinyHunters Probe: FBI Charges Dubrovsky With Extortion And Commerce Interference
FBI charges Edward Dubrovsky with conspiracy and commerce interference in its ongoing investigation of the ShinyHunters hacking group.
Read more
Cyber Attacks
Tabung Haji Resumes Services Post-Oct 8 Cyberattack; Depositor Data Deemed Secure
The Malaysian religious savings agency resumed services after security checks and system recovery measures addressed the October 8 disruption.
Read more
Cyber Attacks
MediaTek Android Firmware Rootkit Grants Silent Control Before Power-On
Bitdefender researchers found a supply chain infection that grants attackers silent control over low-cost devices before owners power them on.
Read more
Malware & Ransomware
AI Disqualification in Nikon Small World Competition Hands Victory to Vietnamese Researcher
The Nikon Small World in Motion competition has disqualified a winning entry for using artificial intelligence, awarding the title to a Vietnamese researcher instead.
Read more
Cyber Attacks
MicroScan, FishHub domains seized to block Chinese state actor critical infrastructure campaigns
US authorities disrupted infrastructure targeting campaigns by seizing command domains linked to Chinese state-sponsored actors.
Read more
Cyber Attacks
Open-Source Web3 Flaws Enable Cloud Supply Chain Breaches, Says Unit 42
Palo Alto Networks Unit 42 reports that threat actors are leveraging Web3 tools and open-source vulnerabilities to infiltrate enterprise cloud environments.
Read more