Author: Staff Writer

Summary Points A new threat group, UNC6692, employs a sophisticated attack chain involving social engineering, custom malware, and abuse of legitimate cloud infrastructure, specifically AWS S3 buckets. The attacker uses multi-stage tactics, including phishing via email and Teams, malicious AutoHotkey scripts, and a custom Chrome extension (Snowbelt) for remote command execution. They extensively conduct lateral movement, credential theft, and network reconnaissance, culminating in extracting sensitive data and furthering access through pass-the-hash techniques. Defenders must enhance visibility into browser activity, cloud traffic, and cross-platform events as attackers utilize legitimate cloud services to evade traditional detection methods. New Attack Tactics Use Social…

Top Highlights Senators Hassan and Banks criticized Navigate360 for a cyberattack that stole sensitive student data from its anonymous school safety tip line, risking student safety and public trust. Over 30,000 schools and 5,000 safety agencies use Navigate360, which hackers accessed, allegedly stealing 93 GB of data, including personally identifiable information. The senators demanded transparency regarding the data breach, the company’s response, cybersecurity practices, and guarantees of the tip line’s anonymity. The incident highlights rising cyber threats in education, with most schools experiencing cyberattacks, often for financial motives, exacerbated during the COVID-19 pandemic. Problem Explained Senators Maggie Hassan and Jim…

Top Highlights NIST’s new prioritized CVE enrichment strategy limits vulnerability visibility by focusing only on select sources like CISA KEV and federal software, leaving many exploited vulnerabilities untracked. This shift creates significant detection gaps, as NIST’s approach omits numerous exploited vulnerabilities not in the prioritized lists, increasing risk exposure for organizations relying solely on the NVD. Tenable maintains comprehensive, independent vulnerability intelligence, tracking more exploitable vulnerabilities and delivering timely, accurate checks independent of NVD delays. To effectively manage risk in a rapidly evolving threat landscape accelerated by AI, organizations must utilize real-world, contextual vulnerability data—like Tenable’s solutions—beyond NVD’s limited, delayed…

Essential Insights An unpatched Windows RPC vulnerability, PhantomRPC, allows attackers with limited local access to impersonate legitimate services and escalate privileges to SYSTEM or administrator levels. The flaw stems from an architectural weakness in how Windows handles RPC connections to unavailable services, enabling malicious RPC servers to deceive higher-privileged processes. Despite Microsoft classifying it as moderate severity and not patching it, attackers can exploit five different paths, risking full system takeover for vulnerable Windows environments. Threat, Attack Techniques, and Targets The vulnerability, called PhantomRPC, exploits a weakness in how Windows handles connections to unavailable RPC services. An attacker with limited…

Summary Points Checkmarx’s supply chain attack resulted in a cybercriminal group leaking company data on the dark web, believed to have originated from their GitHub repository. The compromised GitHub repository is separate from customer environments, and no customer data is currently confirmed to be involved. The attack followed a series of breaches involving tampered GitHub workflows, plugins, and Docker images, attributed to the TeamPCP group and LAPSUS$. Checkmarx is investigating the incident, has secured the repository, and will notify affected customers if any customer data is found to be compromised. Checkmarx Confirms Data Leak from GitHub Repository Checkmarx announced that…

Summary Points Researchers warn that BlackFile, an extortion group linked to The Com, uses voice-phishing and social engineering to impersonate IT support, targeting organizations across various industries since February. The group aims to extract large ransom payments, often in the seven-figure range, by gaining persistent access through social engineering and credential theft of executives. BlackFile overlaps with ongoing campaigns like Cordial Spider, engaging in data theft and creating data-leak sites to extort victims who refuse to comply. Organizations are advised to strengthen multi-factor verification and limit IT support actions to prevent escalation and mitigate BlackFile’s tactics. The Issue Researchers have…

Essential Insights PhantomCore, a pro-Ukrainian hacktivist group, has been actively targeting Russian servers since September 2025. The group is exploiting a chain of three vulnerabilities in TrueConf video conferencing software to gain remote command execution. The attacks pose a significant threat to affected organizations by enabling potential system control and disruption through exploited software vulnerabilities. The Threat, Techniques, and Targets PhantomCore is a hacktivist group with pro-Ukrainian motives. They have been targeting Russian networks since September 2025. Their main focus has been on servers running TrueConf video conferencing software. The group uses a series of three vulnerabilities to carry out…

Essential Insights Frontier AI systems can autonomously discover vulnerabilities, analyze code, and orchestrate multi-stage cyber attacks at unprecedented speed and scale. AI-generated phishing and impersonation attacks, including multilingual social engineering, make cyber threats more convincing, widespread, and difficult to detect. Rapid weaponization of AI tools allows for near-instant exploitation of newly disclosed vulnerabilities, drastically shrinking defensive response windows and increasing systemic risks. The Threat, Attack Techniques, and Targets CERT-In warns that frontier AI systems are increasingly gaining cyber capabilities once limited to skilled human attackers. These AI systems can find vulnerabilities in software, analyze source code, plan multi-step attacks, and…

Summary Points Modern security relies on Network Detection and Response (NDR) platforms analyzed in real-time through behavioral machine learning, critical for identifying evasive threats beyond traditional firewalls and endpoint defenses. Key features of leading NDR solutions include advanced decryption of encrypted traffic, MITRE ATT&CK mapping, automated containment, and seamless integration with firewalls, EDRs, and cloud platforms. The top NDR platforms differ in specialization: from Darktrace’s unsupervised AI for autonomous threat interruption to ExtraHop’s high-speed decryption, Vectra’s alert prioritization, and Cisco’s scalable telemetry-based analysis; selection depends on organizational needs. Effective NDR solutions empower enterprises to drastically reduce dwell time, enhance visibility…

Fast Facts Cybercriminals exploit fake CAPTCHA pages to trick users into sending international SMS messages, generating revenue and causing unexpected charges for consumers. The scheme leverages traffic distribution and advertising infrastructure to obscure perpetrators and scale fraud activities discreetly. This form of fraud risks significant revenue loss for telecom operators, increases customer disputes, and erodes trust in web verification processes. Threat, Attack Techniques, and Targets Infoblox reports that cybercriminals are using fake CAPTCHA pages to carry out SMS fraud. Instead of authentic verification, these pages instruct users to send international SMS messages. This trick turns normal web browsing behavior into…