Author: Staff Writer

Fast Facts AI-generated deepfakes can convincingly mimic real people, enabling scams, disinformation, and identity theft, with some being impossible to distinguish from genuine content. UC Riverside researchers developed SAGA, a tool that detects AI-generated videos, identifies the specific generative model used, and provides forensic insights for authenticity verification. SAGA utilizes temporal signatures (T-Sigs) to differentiate source models based on unique video frame evolution patterns, enhancing source attribution accuracy. The researchers aim to foster collaboration with generative model creators for proactive safety measures, shifting focus from detection to prevention of harmful content creation. New Technology Traces the Source of AI-Generated Videos…

Top Highlights Attackers can exploit a vulnerability in Active Storage with Vips image processing to perform arbitrary file reads, potentially exposing sensitive Rails secrets like signing material. By reusing signed variation keys and crafting malicious MAT/HDF5 files, attackers can bypass content-type checks and trigger remote code execution via libvips, Kernel#spawn, or Kernel#eval. The flaw enables recovering critical environment secrets, leading to complete server compromise, including remote code execution and data exfiltration, without requiring access to the Rails secret key. Threat, Attack Techniques, and Targets Rapid7’s analysis details a vulnerability called KindaRails2Shell, affecting Active Storage in Ruby on Rails applications that…

Essential Insights The INC Ransomware group is actively exploiting SonicWall SMA 1000 VPN vulnerabilities (CVE-2026-15409 and CVE-2026-15410) to gain persistent access, extract credentials, and facilitate lateral movement into internal networks. The attacks leverage zero-day exploits, weaponized through chaining vulnerabilities, with threat clusters using custom scripts, web shells, and HTTP proxies to deploy malware and maintain long-term access. Victims include global organizations, with threat actors using social engineering (e.g., fake technical support calls) to pressure victims into negotiations, increasing the risk of data breaches and operational disruptions. The Threat, Attack Techniques, and Targets The INC Ransomware group has become the main…

Top Highlights Modern ransomware groups employ legitimate tools (e.g., Sliver, native admin tools) and compromised credentials to conduct stealthy, multi-stage intrusions over days, evading traditional signature detection. Attacks often start with VPN credential breaches, followed by reconnaissance, privilege escalation, lateral movement, and data exfiltration, culminating in encryption—highlighting missed early detection opportunities. Attackers utilize cloud services and legitimate infrastructure (e.g., VPS, Wasabi storage) for command and control, exfiltration, and anonymization, emphasizing the need for anomaly-based detection over signature-based methods. The Threat, Attack Techniques, and Targets Ransomware attacks are increasing worldwide. In May 2026, there were 698 incidents, a 48% rise from…

Quick Takeaways The webinar will discuss high-impact phishing and ransomware campaigns encountered in Q2 2026. It will include real-world incident handling, containment, and remediation strategies used by Cisco Talos IR. Participants will gain insights into attack patterns and their strategic implications for organizational security. Threats, Attack Techniques, and Targets The webinar discusses high-impact incidents from Q2 2026, focusing on real-world cyber threats. Attacks included phishing campaigns and ransomware infections. These attacks often targeted organizations with sensitive data or critical infrastructure. The attackers used social engineering techniques, such as convincing emails, to deceive users into clicking malicious links. Once inside, they…

Quick Takeaways Default configurations and outdated firmware on fleet routers pose vulnerabilities that cyber attackers can exploit. Implementing basic cyber-hygiene measures like disabling risky legacy features, patching vulnerabilities, and using multi-factor authentication can significantly thwart attacks. Sharing actionable threat intelligence within trusted industry channels enables targeted, informed responses to emerging cyber threats, reducing overall risk. Threat, Attack Techniques, and Targets The threat discussed in the advisory focuses on vulnerabilities in critical infrastructure, especially those related to edge devices like routers. Many fleet operations use routers and other equipment with default settings or outdated firmware. Such configurations are easy targets because…

Essential Insights The Police National Legal Database (PNLD) experienced a breach exposing police, government, and customer contact details on the dark web, with no evidence of passwords or credentials compromise. The breach potentially stems from misconfigured Power Pages portals utilizing Microsoft Power Platform, granting broad anonymous access to sensitive data. Authorities, including the NCA and ICO, are investigating the incident, which they haven’t yet quantified in terms of affected individuals or total data loss. Experts recommend reviewing Power Pages permissions and security settings to prevent further unauthorized data exposure, although the exact breach method remains unconfirmed. Data Breach Exposes Sensitive…

Quick Takeaways Cybercriminals are using a Microsoft Teams-themed phishing campaign to deliver remote monitoring and management (RMM) tools via fake update pages and concealed PowerShell downloads. Attackers are deploying multiple RMM tools simultaneously on infected hosts to establish resilient, persistent remote access, and are actively exploring system details for further exploitation. The campaign, called Operation BlueDash, is attributed to a Nigerian threat group and has been active since at least February 2026, utilizing sophisticated infrastructure and GitHub-hosted phishing payloads. This attack framework is part of broader schemes, including multi-brand phishing (e.g., Zoom, Microsoft 365) and credential harvesting, highlighting ongoing threats…

Quick Takeaways The Larva-24009 actor primarily uses phishing emails with decoy documents and LNK malware to deploy PowerShell backdoors and malware like QuasarRAT and UltraVNC for remote control and persistence. Attackers gather sensitive data using keyloggers, credential stealer tools, and NirSoft utilities, while maintaining persistence through scheduled tasks and malicious scripts. They exploit remote access protocols and backdoor accounts to control infected systems, risking data theft and remote system compromise at targeted enterprises globally. Threat, Techniques, and Targets The Larva-24009 threat actor has been active since 2023. They mainly launch phishing email attacks targeting users in Korea and around the…

Quick Takeaways Michigan and Minnesota experienced cyberattacks on their water systems, but all were operational and posed no public health risks. The FBI and cybersecurity agencies suspect Iranian hackers are behind the targeted attacks on water infrastructure. Vulnerable water facilities are prime targets due to limited resources and security measures, with Iran having a history of such operations. Politicized claims about the attacks have been made, but investigations continue to determine the culprits and motives. [gptA technology journalist, write a short news story divided in two subheadings, at 12th grade reading level about ‘Michigan and Minnesota report cyberattacks on water…