5+ day, 15+ hour ago   (596+ words) A newly documented ransomware intrusion attributed to The Gentlemen shows how attackers can convert a foothold in a Windows environment into domain-wide control by elevating accounts, turning off endpoint defenses, and abusing trusted Active Directory infrastructure to distribute ransomware. The…...

6+ day, 17+ hour ago   (605+ words) A previously undocumented Linux espionage toolkit linked with medium confidence to DPRK-aligned threat actors has been used to compromise South Korean organizations in the automotive and media sectors. The campaign is notable because it does not exploit a flaw in…...

1+ week, 5+ day ago   (564+ words) China-nexus threat actor Fire Ant has expanded its espionage operations from VMware hypervisors to the trusted infrastructure layer, compromising Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. Security firm Sygnia, which investigated the activity, said Fire Ant…...

1+ week, 5+ day ago   (571+ words) Threat actors are exploiting demand for generative AI tools to distribute RevStealer, a Windows-focused information stealer hidden inside a trojanized Electron application that impersonates a free desktop version of Anthropic’s Claude Opus 5. The primary lure, branded “Claude Opus 5 Free Desktop,…...

3+ week, 1+ day ago   (399+ words) Apollo Global Management has disclosed a cyber incident in which attackers gained unauthorized access to cloud platforms and may have acquired highly sensitive personal information. The alternative asset manager said the intrusion occurred between July 6 and July 10 after threat actors…...

3+ week, 2+ day ago   (470+ words) US Bank is currently investigating claims made by the LockBit ransomware group, which alleges that it breached the bank and stole sensitive data. The group has set a deadline of September 3 for the bank to meet an undisclosed extortion demand....

3+ week, 2+ day ago   (540+ words) GTIG assesses with high confidence that the activity has a Russian nexus, while UNC6293 and UNC7005 are assessed with moderate confidence to be initial-access subclusters associated with ICE RELIC, Google’s designation for the actor widely known as APT29. UNC6293, first publicly detailed in June…...

3+ week, 3+ day ago   (414+ words) MacSync Stealer is expanding its macOS-focused theft operation through a rotating network of more than 30 domains, using stable execution and network patterns to steal credentials, browser data, cloud access keys, SSH material, and sensitive user files. Initial execution commonly begins…...

3+ week, 4+ day ago   (474+ words) Researchers first identified the campaign in mid-May 2026. They discovered that the operation utilizes a broad range of criminal tools rather than relying on a single ransomware payload. The attackers use hacked WordPress sites as platforms for hosting malware, command-and-control (C2) infrastructure,…...

3+ week, 6+ day ago   (437+ words) Shell has launched a cybersecurity investigation following claims by the Cl0p ransomware operation that it stole 89GB of corporate information from the multinational energy company. This alleged breach was published on Cl0p’s dark web leak portal, prompting scrutiny from security researchers and…...