Author: Staff Writer

Fast Facts The first Chrome zero-day of 2025 (CVE-2025-2783) was exploited in a sophisticated espionage operation targeting Russian organizations, linked to tools used by Hacking Team’s spyware. The campaign, dubbed Operation ForumTroll, used phishing to deliver a payload that bypassed Chrome’s sandbox, installing malware that logs keystrokes and steals files via the LeetAgent spyware. LeetAgent operates via commands over HTTPS, with the ability to inject shellcode and run processes, and has been used since 2022, often deploying more advanced spyware like Memento Labs’ Dante. Memento Labs’ Dante, a successor to Hacking Team’s RCS, features anti-analysis and self-deletion mechanisms; while not…

Quick Takeaways Qilin Ransomware Activity: The Qilin ransomware group has been highly active, claiming over 40 victims monthly since early 2025, with a peak of 100 cases in June, primarily affecting sectors like manufacturing and professional services. Attack Techniques: Qilin affiliates utilize leaked admin credentials from the dark web for initial access, followed by reconnaissance and credential harvesting using tools like Mimikatz and Cyberduck, indicating a sophisticated, multi-phased attack. Evasion Strategies: To evade detection, attackers execute PowerShell commands to disable security features, using legitimate software for malicious activities, and implementing advanced techniques such as BYOVD (Bring Your Own Vulnerable Driver).…

Fast Facts BreachForums has resurfaced on the clearnet after previous law enforcement takedowns, claiming enhanced anonymity and functionality. The forum, a hub for cybercriminal activities like data leaks and exploits, is rebuilding its escrow system to fix vulnerabilities exposed in a recent breach. Its return aims to attract less tech-savvy criminals by abandoning the dark web, though experts warn it may be a law enforcement honeypot. Cybersecurity professionals advise caution, as clearnet access makes monitoring easier but also increases risks for users. The Issue BreachForums, a well-known cybercriminal hub historically involved in data leaks, hacking tools, and illicit transactions, has…

Quick Takeaways Law enforcement from the U.S. and France seized the onion leak site operated by the Scattered LAPSUS$ Hunters, disrupting their data extortion operations related to the BreachForums infrastructure. The group, formed in August 2025 from hacking collectives like Scattered Spider and ShinyHunters, claimed to have stolen over a billion records from major corporations, blending data theft with extortion. Despite the seizure and temporary shutdown, the group leaked data from six companies and announced a pause in activity, threatening to relaunch with new, covert operations and potentially target agencies like the FBI and NSA. Experts warn such groups often…

Quick Takeaways Data Breach: Coinbase reported that criminals improperly accessed personal customer information, leading to threats of releasing this data unless a $20 million ransom is paid. Internal Compromise: Customer service agents located outside the U.S. were bribed to provide sensitive customer data, enabling social engineering scams that target Coinbase users. Financial Impact: The company anticipates remediation and reimbursement costs between $180 million to $400 million and witnessed a 6% drop in its shares following the news. Response Strategy: Coinbase will not pay the ransom, instead offering a $20 million reward for information leading to the attackers’ arrest, promising to…

Fast Facts Effective management of Non-Human Identities (NHIs) is vital for cybersecurity, enabling automated discovery, classification, monitoring, and swift response to threats, thereby reducing risks and enhance organizational security. Strategic NHI management improves compliance, reduces operational costs, and increases efficiency by automating routine tasks and providing centralized visibility and control over digital assets across regulated industries. Automating NHI processes with AI fosters proactive threat detection, predictive analytics, and streamlined compliance, allowing security teams to focus on strategic initiatives and reinforce organizational resilience. Cultivating a security-first organizational culture, integrating NHI management into development pipelines and fostering collaboration between security and R&D…

Top Highlights Vendors often risk losing trust by offering "perfect pitches" during sales, which can appear insincere or overly scripted, making CISOs question their true capabilities. When EDRs are bypassed by sophisticated malware, layered defense strategies—including network telemetry, identity verification, and resilience controls like immutable backups—are critical as backup measures. Transparently admitting product limitations and understanding one’s cybersecurity solutions foster trust; vendors should be honest about what their tools can and cannot handle. Configurations management tools, like ThreatLocker’s Defense Against Configurations, aim to identify and remediate security misconfigurations preemptively, enhancing compliance and reducing attack surfaces through continuous monitoring. The Core…

Fast Facts Russian state hackers have developed and deployed new malware strains, NOROBOT, YESROBOT, and MAYBEROBOT, to evade detection and conduct data theft on high-value targets. Recent Windows updates are causing login failures on systems with duplicate SIDs, requiring rebuilding or support assistance for resolution. A Chinese-speaking threat actor is executing the "PassiveNeuron" campaign targeting government, financial, and industrial servers across multiple continents using custom implants. Zero-day exploits at Pwn2Own Ireland 2025 resulted in over $500,000 in rewards, demonstrating ongoing vulnerabilities across devices like NAS, routers, and IoT gadgets. Key Challenge Recent developments in cybersecurity reveal a series of sophisticated…

Essential Insights The event focuses on critical strategies for effective cybersecurity remediation, emphasizing timely, prioritized action on alerts to reduce noise and prevent vulnerabilities. Key discussions include building credibility with engineering teams, translating alerts into actionable developer language, and balancing security fixes with potential system breakage risks. The session will explore frameworks for prioritizing vulnerabilities, the impact of AI on speeding up fixes, and managing risks from high-profile supply chain attacks. Attendees are encouraged to share feedback, participate actively, and consider success metrics like time-to-fix, with a special emphasis on improving developer experience and organizational security posture. What’s the Problem?…

Top Highlights TP-Link warns of critical vulnerabilities in Omada gateway devices, urging immediate firmware updates and security measures. Iran-linked group MuddyWater is conducting a global espionage campaign using custom malware and legitimate tools to target over 100 organizations. Critical flaw “SessionReaper” in Adobe Commerce is being actively exploited, with most stores unpatched six weeks after an emergency patch release. Canada fined Cryptomus $176 million for AML violations and processing transactions linked to cybercrime, marking the largest penalty of its kind. Problem Explained Recently, multiple cybersecurity threats and incidents have emerged, revealing the vulnerabilities in various systems and the ongoing efforts…