Author: Staff Writer

Fast Facts Cybercriminals are selling illegal access to AI models like Anthropic’s via underground forums, using compromised accounts and exploitative payment methods to bypass licensing and cost restrictions. Services like Poison Claude and Ecomagent.in proxy AI model prompts, risking data leakage, privacy breaches, and potential misuse by malicious actors. Emerging AI-related threats include abuse of free trials for synthetic identity creation and extensive bot activity leveraging AI agents and residential proxies, complicating detection and mitigation efforts. The Threat, Attack Techniques, and Targets Cybercriminals are now offering illegal access to artificial intelligence (AI) models through underground services like Poison Claude. This…

Top Highlights Cybercriminals, possibly linked to North Korea, are evolving blockchain-based command-and-control techniques by embedding C2 server IPs directly into Ethereum transaction addresses, making detection more difficult. The new "NullReceiver" method encodes C2 IPs within the recipient address of zero-value transactions, bypassing traditional detection methods that rely on monitoring fixed or payload-bearing addresses. This technique enables cheaper, harder-to-trace malware communications with no fixed target, significantly increasing operational resilience and complicating attribution efforts for defenders. Threat, Attack Techniques, and Targets Cybersecurity researchers have identified a new method used by threat actors to hide their command-and-control infrastructure. This method evolves from the…

Summary Points An unauthenticated local user can exploit CVE-2026-64531 in Linux’s Open vSwitch to achieve root privileges, potentially leading to complete system compromise. The vulnerability arises from a buffer wraparound in flow action memory, enabling attackers to leak kernel pointers, perform arbitrary kernel reads, and escalate privileges. Exploitation can be blocked by applying kernel patches, unloading the openvswitch module, or disabling unprivileged user namespaces; failure to do so risks privilege escalation in shared environments. Threat, Attack Techniques, and Targets The vulnerability, named CVE-2026-64531 and called OVSwrap, allows local users to gain root access on affected Linux systems. It is a…

Top Highlights Space infrastructure faces increased cybersecurity risks through collaborative threat sharing, potentially amplifying vulnerabilities. Advanced cyber techniques are likely used to target critical space systems, risking operational disruptions. Enhanced threat intelligence collaboration aims to detect and mitigate sophisticated cyber-attacks on space assets. Threat, Attack Techniques, and Targets Resecurity has joined the Space Information Sharing and Analysis Center (Space ISAC) to improve the security of space infrastructure. This is part of broader efforts to defend space systems against cyber threats. The article does not specify particular attack techniques or threat actors. Instead, it emphasizes the importance of sharing threat intelligence…

Fast Facts The collaboration expands threat intelligence sharing within the space sector, increasing the risk of coordinated cyber attacks on critical infrastructure. The prevalent use of sophisticated, encrypted communication methods suggests ongoing targeted cyber espionage and sabotage efforts. The attack vectors appear to involve advanced cyber intrusions potentially leveraging vulnerabilities in satellite and ground-based space systems. Threat, Attack Techniques, and Targets Resecurity has joined the Space Information Sharing and Analysis Center (Space ISAC) to improve space infrastructure cybersecurity. This collaboration aims to share threat intelligence and strengthen defense. The article indicates a focus on protecting critical space infrastructure but does…

Quick Takeaways Diagnostic tools are being targeted with URL-based vulnerability hunting, risking exploitation of file inclusion and code execution flaws. Command injection remains a critical threat when tools call OS commands via concatenated user input, enabling attackers to execute arbitrary commands. Proper API use, like subprocess.run() with argument arrays, significantly mitigates OS command injection risks by effectively separating commands from user input. Threat, Attack Techniques, and Targets This threat involves hackers “hunting” for vulnerabilities in diagnostic tools’ URLs. These URLs often reference diagnostic tools and are targeted to find weak points. Attackers may look for common vulnerabilities like file inclusion…

Summary Points DOUBLECUP uses steganographic PNG images and environmental keying for malware delivery, enabling covert, resilient payload execution across Windows and macOS systems. Attackers leverage ClickFix lures on impersonated CRM login sites to initiate multi-stage infections featuring CountLoader and DeviceManager, which exfiltrate data and establish persistence. The malware employs advanced evasion techniques such as blockchain-based C2 resolution via EtherHiding and process patching, complicating detection and response efforts. Threat, Attack Techniques, and Targets DOUBLECUP is a Russian loader-as-a-service (LaaS) that uses ClickFix to deliver malware. It stage malware in victims’ browser cache by dropping steganographic PNG images. These images hide malicious…

Summary Points Ransomware activity increased, targeting critical sectors like government, healthcare, and manufacturing, with four organizations listed on leak sites. Compromised credentials and VPN access remain available, heightening risks of ransomware, business email compromise, and unauthorized access. APT groups linked to China and North Korea continue operations in Southeast Asia, sustaining strategic cyber espionage threats against Indonesian organizations. Threats, Attack Techniques, and Targets During the week of July 19-25, 2026, cyber threats continued to rise in Indonesia. Ransomware activity increased significantly, with four organizations listed on leak sites. This shows that financially motivated threat actors remain active. The main targets…

Fast Facts Phishing methods are evolving rapidly, with a significant rise in voice phishing (vishing) and device code phishing, bypassing traditional security controls. Device code phishing, invented in 2020, saw a 15-fold increase in 2026, primarily targeting cloud identities and adopted by both state-sponsored groups and cybercriminals. Vishing attacks doubled in early 2026, with threat actors exploiting mobile devices and leveraging social engineering to gain access to corporate SSO applications. Cybercriminals prefer stealthy techniques like vishing over email phishing, making detection harder and emphasizing the importance of vigilant, multi-layered security measures. Device Code Phishing Surges by 1,500% in 2026 Recently,…

Threat actors are actively exploiting two critical authentication bypass vulnerabilities (CVE-2026-18556 and CVE-2026-18577) in N-able N-Central. These flaws affect a widely used RMM platform employed by MSPs and enterprise IT teams. N-able detected suspicious activity on July 31 and issued an emergency hotfix (2026.3.1.7) on August 2, 2026. Immediate patching is essential to mitigate the risk posed by these high-severity vulnerabilities. Understanding the Risk for Daily IT Operations Cyber threats are always changing. Recently, hackers found ways to bypass security in a popular tool called N-able N-Central. This tool helps manage many computers and servers in an organization. Now, attackers…