Author: Staff Writer

Top Highlights Chinese-language Telegram-based “guarantee” marketplaces, resembling trusted escrow systems, facilitate massive trade in stolen data, fake identities, and illicit services, processing billions in cryptocurrency and operating like professional businesses before being banned in 2025. These platforms, managed by corporate-style operators with escrow and security deposits in USDT, quickly recovered and expanded into proprietary messaging platforms, demonstrating rapid adaptation and resilience despite US sanctions. They actively trade in stolen credentials, PII, fake identity tools, and facilitate money laundering, directly threatening Western organizations by funding scams, enabling corporate impersonation, and supplying attack tools. Security teams must prioritize monitoring these Chinese-language channels…

Summary Points Attacker infrastructure hosted malicious staging servers with open directories exposing sensitive data, including custom backdoored agents mimicking legitimate services for remote access. Attackers used open staging environments to deploy and configure remote management tools (MeshCentral) and staged malware, enabling internal reconnaissance and persisting control. The threat actors conducted targeted internal network mapping, extracting configuration files and establishing outbound connections, indicating preparatory espionage and potential lateral movement. Threat Overview, Techniques, and Targets ShinyHunters has targeted the education sector using an exploit involving Oracle PeopleSoft systems. The threat actors set up staging servers and exposed directories that included malicious files,…

Quick Takeaways Ransomware attacks surged by 48%, targeting businesses predominantly in North America, with established groups like Qilin leading ongoing ecosystem expansion. GenAI tools pose a significant risk of sensitive data leaks, with 4% of prompts containing high or potential risks, driven by rapid adoption outpacing security controls. Despite a slight decrease in overall attack volume, targeted sectors such as education, government, and telecoms experience persistent high levels of cyber threats, especially in Latin America. Threats, Attack Techniques, and Targets In May 2026, organizations faced an average of 2,055 cyber attacks weekly. Although this is slightly higher than last year,…

Fast Facts Legacy reputation scoring based on domain age is increasingly unreliable, allowing sophisticated attackers to exploit aged domains withclean histories to bypass filters. Attackers can acquire aged domains through drop-catch services or hijack active domains via credential theft, enabling them to host malicious content with reputations that appear legitimate. Long-term certificate histories of compromised domains can mislead security systems, allowing malicious subdomains to appear trustworthy and infiltrate enterprise email defenses. The Threat, Attack Techniques, and Targets The threat involves cyber operators using aged domains to carry out phishing attacks. These attackers acquire domains that look legitimate because they have…

Quick Takeaways Threat actors are increasingly leveraging global infrastructure for cyber campaigns targeting critical infrastructure, financial services, and government sectors in APJ. Public-private collaboration and shared visibility into adversary infrastructure are crucial for proactive defense against well-resourced cyber adversaries. The expansion of Team Cymru’s operations aims to enhance early detection and disruption of adversary campaigns through real-time visibility into malicious infrastructure. Threat, Attack Techniques, and Targets This announcement by Team Cymru does not describe specific cyber threats or attack techniques. Instead, it focuses on their efforts to improve cyber defenses in the APJ region. The company provides threat intelligence through…

Quick Takeaways Coralogix secured a $200M Series F, indicating strong investor confidence in its belief that the observability market is entering a significant inflection point driven by AI advancements. Traditional observability tools, designed for human-scale data analysis, are inadequate for the full-fidelity, real-time telemetry needs of AI-powered infrastructure, prompting a shift towards architectures built for complete data access. As AI agents become operational participants, platforms must enable programmatic, full-fidelity data access to support autonomous incident investigation and operational reasoning at machine speed. Security and compliance concerns are escalating with AI-driven observability, emphasizing the importance of customer-controlled storage and open data…

Summary Points The JDY botnet, now over 1,500 compromised IoT and SOHO devices, primarily in the U.S. and Brazil, is used for large-scale service scanning and infrastructure mapping, facilitating targeted attacks. Attackers exploit recent vulnerabilities in edge devices with a multi-stage payload, including system profiling, reconnaissance, and exploit delivery, often leveraging Tor for command-and-control. The botnet’s adaptive scanning techniques—high-speed SYN scans and standard connections—enhance asset discovery, vulnerability identification, and support subsequent exploitation efforts. Threat Overview, Techniques, and Targets Cybersecurity experts from Lumen’s Black Lotus Labs reported a major increase in the JDY botnet. This botnet is linked to Chinese state-sponsored…

The IoT Advisory Board report highlights significant barriers to IoT adoption in the U.S., including trust issues, cybersecurity concerns, privacy worries, supply chain vulnerabilities, and a lack of skilled workforce. Establishing trust requires a multi-dimensional approach focusing on cybersecurity, privacy, system reliability, and supply chain integrity to ensure public confidence in IoT. Addressing workforce gaps involves integrating IoT skill development into education and training programs, emphasizing cybersecurity, privacy, and system maintenance expertise. The report offers 104 recommendations across themes like trust and workforce readiness, encouraging collaboration across industry, academia, and government to unlock IoT’s transformative potential. Understanding the Role of…

Top Highlights CISA’s new directive adopts a risk-based, tiered patching approach, prioritizing critical vulnerabilities for remediation within three days, while allowing deferrals for lower-risk issues. The policy emphasizes rapid patching and forensic triage, reflecting concerns about AI-enabled exploits and automation, which can outpace traditional patching efforts. Agencies must update their vulnerability management policies within 60-180 days, establishing processes aligned with KEV catalog and CVE metadata to meet new timelines. Experts note that meeting the three-day patch deadline is challenging and relies heavily on asset visibility, operational maturity, and the accuracy of CISA’s exploit automation data. A New Approach to Federal…

Summary Points Patching practices are now insufficient, with only 26% of active exploited vulnerabilities remediated, highlighting the urgent need for a risk-based, prioritized approach. CISA’s Binding Operational Directive 26-04 introduces a new framework focusing on four key factors—exposure, known exploitation, automation potential, and post-exploitation impact—to enhance vulnerability management. The directive emphasizes quick patching for high-risk vulnerabilities (within three days) while allowing delays for lower-risk issues, shifting from severity scores to dynamic, context-aware prioritization. Recognizing AI’s accelerating role in vulnerability discovery, experts warn that current systems relying on retroactive data like KEV may lag behind, necessitating future updates leveraging predictive and…