Author: Staff Writer

Summary Points In September 2025, Arctic Wolf detected a new attack where SocGholish delivered a RomCom Mythic Agent loader, marking the first time RomCom payloads are distributed via SocGholish, with the potential for high-impact ransomware deployment. The threat actors, likely linked to Russia’s GRU Unit 29155, exploit compromised legitimate websites using fake updates to gain initial access, with targeting efforts biased toward entities connected to Ukraine. The attack chain from infection to payload delivery took less than 30 minutes, utilizing obfuscated JavaScript, PowerShell reconnaissance, and Mythic C2 infrastructure, which Arctic Wolf’s defenses successfully blocked. Arctic Wolf’s proactive detection and layered…

Top Highlights Canon was targeted in a global attack exploiting a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite, conducted by the Clop ransomware group. The breach impacted only a specific web server within one subsidiary, with Canon swiftly isolating the affected systems, preventing broader network disruption or data theft. Clop exploited the flaw early in August 2025 to plant web shells and exfiltrate data before Oracle released a patch in October, part of a wider extortion campaign targeting nearly 30 organizations. Security experts recommend immediate scanning and patching of Oracle EBS environments, as indicators include malicious IPs, web shells,…

Summary Points Over half of ransomware attacks occur during weekends, holidays, or after major corporate events, exploiting times of reduced staffing and organization flux. Most organizations cut SOC staffing significantly during high-risk periods, with 78% reducing staff by 50% or more, increasing vulnerability to attacks. Despite high vulnerability, many lack comprehensive remediation and recovery plans—only 45% have procedures to remediate vulnerabilities, and 63% automate identity system recovery. Strengthening identity system defenses, especially around Active Directory, and integrating recovery plans into crisis response are critical steps for organizational resilience against ransomware threats. The Issue A recent report by Semperis reveals that,…

Fast Facts Canon confirmed its subsidiary was targeted in an Oracle E-Business Suite (EBS) hacking campaign, but only its web server was affected, and no Canon data has been leaked yet. Over 100 organizations across various sectors, including healthcare, manufacturing, and telecoms, have been named as victims in the campaign linked to Cl0p ransomware; some, like Cox, have confirmed data breaches. The threat actor group Cl0p claims responsibility, but the attacks are believed to be orchestrated by an unknown cluster, FIN11, suggesting possible exaggeration of the breach scope. High-profile companies including Michelin, Broadcom, and Bechtel have not yet publicly confirmed…

Quick Takeaways Effective Data Loss Prevention (DLP) strategies are crucial for organizational resilience, protecting sensitive data from both external cyberattacks and internal mishaps, thus safeguarding reputation and compliance. Building a robust DLP framework involves establishing clear data management policies, classifying data based on sensitivity, identifying vulnerabilities, and automating policy enforcement across all systems. DLP solutions are categorized into Network, Endpoint, and Cloud types, each monitoring and securing data in transit, at rest, or in use within their respective environments. Emerging trends such as multicloud infrastructures, AI-driven data handling, and stricter privacy regulations demand adaptive, intelligence-led DLP strategies to manage complex,…

Quick Takeaways Effective management of Non-Human Identities (NHIs) is critical for reducing security risks, ensuring compliance, and boosting operational efficiency across industries. A holistic NHI lifecycle approach—covering discovery, classification, monitoring, and decommissioning—enables organizations to secure machine secrets and assets comprehensively. Leveraging automation, AI, and contextual, platform-based tools enhances threat detection, streamlines routine tasks, and provides deeper visibility and control. Success depends on strong interdepartmental collaboration, continuous monitoring, and adapting strategies to evolving technologies and regulatory landscapes for resilient cybersecurity postures. The Core Issue The article reports on a cybersecurity professional’s concern about non-human identities (NHIs), which include machine secrets like…

Fast Facts NVIDIA disclosed two high-severity code injection vulnerabilities (CVEs-2025-33183 and CVE-2025-33184) in its Isaac-GR00T robotics platform, affecting all versions across platforms. Exploiting these flaws, which stem from improper handling of user input in Python components, could allow attackers with local access to execute arbitrary code, escalate privileges, and compromise system integrity. The vulnerabilities have a CVSS score of 7.8, pose serious security risks, and require immediate patching through the available update on NVIDIA’s GitHub. Organizations using Isaac-GR00T should prioritize deployment of the security fix, restrict system access if patching isn’t immediate, and monitor for exploitation attempts. Key Challenge NVIDIA…

Fast Facts Evolving Threat Landscape: Browser extensions have become vital productivity tools, but they are also increasingly targeted by cyberattacks across all major browsers, necessitating heightened security measures. Cross-Platform Vulnerabilities: Organizations can no longer rely on a single-browser security approach as users frequently switch between browsers, expanding the attack surface for malicious extensions. AI-Powered Risks: The rise of AI browsers introduces new vulnerabilities like prompt injection attacks, posing significant risks due to elevated extension permissions and automated data collection. Comprehensive Defense Strategy: To combat multi-platform extension threats, organizations should implement Secure Enterprise Browser (SEB) technology and prioritize user education to…

Top Highlights Threat actors are now using a sophisticated fake Windows Update screen to deploy malware, making the scam more convincing with realistic animations and prompts, leading victims to manually execute malicious commands via the Run prompt. The campaign utilizes steganography to hide payloads like LummaC2 and Rhadamanthys within image pixels, aiming to trick users into running commands that install infostealers and other malware. These ClickFix attacks have skyrocketed by over 500% in H1 2025, becoming the second most common attack vector after phishing, with threats expanding to ransomware, Trojans, cryptominers, and nation-state malware. Law enforcement actions have disrupted some…

Summary Points A self-replicating worm has compromised nearly 500 npm packages, impacting over 26,000 GitHub repositories, with major packages like Zapier and Postman affected, indicating widespread exposure. The malware, linked to the Shai-Hulud worm, rapidly propagates using stolen tokens to infect more packages, creating malicious files and stealing developer secrets for potential deeper supply-chain attacks. Attackers targeted open-source ecosystems just weeks before npm’s plan to revoke classic tokens, exploiting trusted distribution channels and highlighting vulnerabilities in developer workflows and security practices. Experts warn that open-source developers are high-value targets, with attacks growing more sophisticated and entrenched, emphasizing the urgent need…