Author: Staff Writer

Summary Points Allegations suggest US-backed backdoors or botnets may have remotely sabotaged networking equipment from Cisco, Juniper, Fortinet, and MikroTik. Disruptions are believed to be facilitated through firmware or bootloader vulnerabilities, possibly activated by satellite signals or pre-set triggers. Limited verification due to Iran’s extensive internet restrictions complicates attribution and assessment of the actual impact of these cyber operations. Threat, Techniques, and Targets Iranian state media claims that the US used cyber tools like backdoors or botnets to disrupt networking equipment. These claims are supported by Chinese media, which also amplify the reports. The hardware affected includes devices from Cisco,…

Summary Points Cybercriminals exploit GitHub’s notification system by using fake issues to deliver malicious OAuth app authorization requests, making it difficult for developers to distinguish from legitimate alerts. A zero-cost attack setup involves creating a fake GitHub account, an OAuth app requesting extensive permissions, and using email notifications triggered by issue mentions to phish developers. The attack leverages a Time-of-Check Time-of-Use (TOCTOU) race condition, enabling attackers to post and quickly erase phishing content, thus evading detection and leaving little trace. Developers are advised to scrutinize OAuth permissions, regularly audit authorized apps, be cautious of suspicious notifications, and enable security alerts…

Quick Takeaways CISA has listed three critical vulnerabilities in Cisco Catalyst SD-WAN Manager on its KEV catalog, demanding immediate action before the April 23, 2026 deadline. The flaws include sensitive information exposure, improper API file handling allowing privilege escalation, and stored passwords in recoverable format, all enabling potential remote or local exploitation. Compromising this platform could grant attackers broad control over enterprise networks, potentially leading to significant lateral movement and cyber intrusions. Organizations are urged to apply patches, follow CISA’s directives, tighten API and file permissions, and monitor for signs of compromise to mitigate risks. The Core Issue On April…

Summary Points "The Gentlemen" is a rapidly expanding RaaS group that has claimed over 320 victims since mid-2025, utilizing a range of cross-platform ransomware tools targeting Windows, Linux, NAS, BSD, and VMware ESXi environments. The group operates like a structured business, recruiting skilled affiliates through underground forums, providing them with advanced tools, and publicly exposing victim data to pressure payment. It employs a multi-stage infiltration and lateral movement strategy, starting from Domain Admin access, deploying Cobalt Strike payloads, and using diverse methods (PsExec, WMI, PowerShell) to encrypt systems, including virtual infrastructure. To defend against such attacks, organizations should enforce multi-factor…

Fast Facts Internal phishing campaigns exploiting Microsoft 365’s Direct Send are increasing, bypassing traditional perimeter defenses. State-sponsored actors from China and North Korea are launching sophisticated attacks combining zero-day exploits with advanced social engineering. Adversaries are creating fake developer personas and using high-level tactics like "Dear Leader" interview tests to infiltrate organizations. Threat, Attack Techniques, and Targets In 2025, cyber threats from state-sponsored groups and phishing campaigns have increased significantly. Adversaries now use internal phishing tactics that evade standard defenses. They are using Microsoft 365’s Direct Send feature to launch these attacks. These campaigns often include fake developer personas and…

Essential Insights The new open-source MCP Server enhances security teams’ ability to rapidly interrogate vulnerability and exposure data, reducing manual effort and delays in threat detection. By enabling AI models to access and analyze localized, comprehensive security telemetry, it helps identify critical assets, emerging exposure trends, and policy failures more efficiently. The streamlined data access and integration support continuous threat exposure management, improving detection of prioritized vulnerabilities and accelerating response actions. Threat, Techniques, and Targets The article discusses a new open-source tool that connects Rapid7 vulnerability data to AI systems. The tool itself does not appear to be a threat…

Quick Takeaways Identity has evolved to become the critical security boundary and "invisible engine" powering digital enterprises, replacing traditional perimeter-based security with verification and authorization based on user identity. Modern identity systems enable fine-grained access control, enhancing internal security, compliance, and traceability, while also streamlining processes across multiple testing and operational environments. They support personalized customer experiences by consolidating fragmented data into unified profiles, leading to increased trust, loyalty, and targeted marketing. As core infrastructure, identity underpins fraud prevention, risk assessment, and real-time asset management, requiring integration, governance, and security to sustain digital transformation efforts. The Issue The story highlights…

Top Highlights New data shows Vect ransomware has partnered with BreachForums and TeamPCP, enabling large-scale, coordinated deployment of ransomware through forum integration and mass affiliate mobilization. Vect’s sophisticated, multi-platform malware uses purpose-built tools, advanced evasion tactics, and targets enterprise environments, marking significant operational maturity and a focus on commercial impact. The partnership shifts traditional ransomware models by leveraging supply chain access, embedding forum infrastructure into deployment, and activating a broad, public affiliate network, unprecedented in scale. Organizations using targeted CI/CD tools should immediately rotate credentials, strengthen network defenses, and enhance detection early indicators, as the threat exploits deeply embedded enterprise…

Essential Insights Attackers increasingly focus on exploiting identity-related methods—such as phishing, stolen credentials, and social engineering—rather than software vulnerabilities to infiltrate systems, especially in hybrid and cloud environments. Malicious actors are misusing legitimate remote monitoring and management (RMM) tools, network devices, and exploiting vulnerabilities like SSL VPNs to gain initial access and move laterally within networks. The rise of AI-driven phishing, synthetic voice attacks, and the proliferation of machine identities (like service accounts and APIs) pose new challenges, with cybercriminals targeting authentication mechanisms instead of traditional software flaws. Defenders are urged to adopt layered, zero-trust security strategies—utilizing strong authentication, continuous…

Quick Takeaways Threat actors are disguising malware within true .wav files by replacing audio bytes with BASE64-encoded payloads, bypassing traditional audio analysis. The embedded payload is XOR-encoded, requiring simple known-plaintext attacks to extract and decode the malware. This technique allows malicious code to be delivered via seemingly legitimate audio files, posing a new vector for covert malware distribution. Threat Overview, Attack Techniques, and Targets The threat involves cyber actors using legitimate .wav audio files as a delivery method for malware. These files appear normal and will play sound, but they do not contain hidden data like in steganography. Instead, the…