StopRansomware Advisory: SafePay Ransomware Targets Global Infrastructure
SafePay ransomware has targeted over 600 global victims, leveraging multiple CVEs and sophisticated evasion tactics to demand cryptocurrency ransoms.
Tag
#Incident Response
75 results in the archive.
Hackers Exploit Plex2Shell Flaws to Deploy Crypto Miners and Proxy Backdoor
A chain of four vulnerabilities in Plex Media Server named Plex2Shell is actively exploited to install cryptocurrency miners and reverse proxy backdoors, following a public proof-of-concept release.
Attackers Delivered Backdoor via AOMEI Backupper Update Server Tampering
Between May and July 2026, attackers intermittently modified files on AOMEI Backupper's update servers to deliver a backdoor to Windows systems updating during specific periods, representing a supply-chain compromise.
NIST, NSA, and CISA Release Incident Readiness Practices for Super Intelligence
NIST, NSA's Super Intelligence Security Center, and CISA published voluntary core practices for incident readiness and response in training and evaluating highly capable super intelligence agents.
UAT-11985 Targets Taiwan Research with Google AitM Phishing via Fake Invites
APT group UAT-11985 uses fake event invites in spear phishing attacks against Taiwan research targets to deploy an adversary-in-the-middle phishing framework targeting Google credentials and MFA codes.
Hackers Exploit Critical RCE Flaw in Collabora to Backdoor Nextcloud
Threat actors are actively exploiting a critical remote code execution vulnerability in the Collabora Online CODE Server app used by Nextcloud servers, enabling unauthorized system access and backdoors.
Microsoft Disrupts 3 Phishing Kits Behind Over 1 Billion Scam Messages
Microsoft, Health-ISAC, JC3, and private partners disrupted three major phishing kits responsible for over 1 billion scam messages since January 2026, targeting global phishing campaigns.
Chinese Hacker Uses ARTEX AI and Claude Agents in South Korean Bank Attacks
A Chinese hacker deployed the ARTEX AI penetration testing suite and Claude agents in cyberattacks targeting South Korean banks, marking an advanced use of AI tools in active threat campaigns.
Denmark's Population Registry Data Breach Affects 8.8 Million People
Denmark's Central Population Register suffered a data breach exposing personal information of approximately 8.8 million individuals, raising serious privacy and security concerns.
Dell CSM Flaws Allow Unauthenticated Admin and Root Access on Kubernetes
Dell patched critical Container Storage Module vulnerabilities that enable unauthenticated admin and root access on Kubernetes nodes.
Critical Vulnerabilities Found in Armatura One Affecting Access Control Systems
Critical vulnerabilities in Armatura LLC's Armatura One expose access control systems to unauthorized access and arbitrary code execution risks.
WordPress Backdoor Rebuilds Itself Using Files, Database, and Shared Memory
Researchers uncovered a WordPress backdoor named SC that self-heals using multiple persistence methods, complicating removal efforts and increasing ongoing risks.
Automated AI Agent Used to Breach Cybersecurity Nonprofit DIVD
The Dutch Institute for Vulnerability Disclosure (DIVD) experienced a disruptive cyberattack executed by an automated AI agent, illustrating emerging AI-driven threats.
OpenAI AI agents accidentally upload user images to third-party sites
OpenAI disclosed that its AI agents unintentionally uploaded user-provided images to third-party image hosting services, raising concerns about data privacy in AI systems.
Tracking Storm-2570's Consistent Ransomware Tradecraft
Storm-2570 is a ransomware affiliate using consistent tools and techniques across multiple ransomware operations, posing detection and disruption challenges.
Check Point Warns of Active Exploitation in Security Gateway VPN RCE Flaw
Check Point confirmed active exploitation of a pre-authentication remote code execution vulnerability (CVE-2026-85102) affecting the VPN certificate handling of its Security Gateway product, enabling remote attackers to execute code without authentication.
MikroTrick Chain Lets Attackers Control MikroTik Routers Without Credentials
Two linked vulnerabilities in MikroTik RouterOS allow attackers to gain full administrative access without needing passwords or SSH keys, identified by CERT Polska as CVE-2026-67279 and CVE-2026-86060 in the MikroTrick exploit chain.
Check Point Fixes Critical Management Server Zero-Day Exploited in Attacks
Check Point Software released emergency hotfixes for a critical zero-day vulnerability in its Security Management Server actively exploited to run arbitrary scripts, impacting enterprise environments.
Critical Bifrost AI Gateway Flaw Allows Credentialless Command Execution
A critical vulnerability in the open-source Bifrost AI gateway allows attackers to execute arbitrary commands without authentication, affecting versions before 2.1.0.
EvilTokens PhaaS Disrupted After Compromising 12,000 Microsoft Accounts
The EvilTokens phishing platform compromising over 12,000 Microsoft accounts across 10,000 organizations was disrupted through an operation led by Microsoft's Digital Crimes Unit, halting ongoing account takeovers.
Critical Pre-Auth RCE Found and Exploited in Orkes Conductor Platform
A critical unauthenticated remote code execution vulnerability (CVE-2026-58138) in Orkes Conductor affecting versions prior to 3.30.2 is actively exploited and presents severe security risks.
Gyazo Server Vulnerability Leads to Theft of 23.6 Million User Records
Gyazo confirmed a data breach after a server vulnerability was exploited to steal 23.6 million user records, underscoring risks in platform security.
Attacker Hijacks AI Coding Assistant, Spreads Malware Across 100 Repos
An attacker hijacked an AI coding assistant session to distribute the Shai-Hulud worm within approximately 100 internal code repositories at a SaaS provider, resulting in theft of repository secrets and source code.
CISA Guidance on Using Cyber Decoys to Enhance Detection and Response
CISA has published guidance to help security teams deploy cyber decoys that improve detection of adversaries using legitimate credentials and living off the land tactics.
Critical Issabel Framework Flaw Enables Unauthenticated OS Command Execution
A critical vulnerability in the Issabel Framework allows unauthenticated remote OS command execution, actively exploited and posing a severe security risk.
Critical ScreenConnect Flaw Now Actively Exploited in Real Attacks
CISA reports active exploitation of a critical vulnerability in ConnectWise ScreenConnect that risks unauthorized remote access.
CenterPoint Energy Confirms Customer Data Stolen in Cyberattack
CenterPoint Energy confirmed a breach where attackers exfiltrated customers' personal data, emphasizing the ongoing threats faced by critical utility providers.
Critical Vulnerabilities Discovered in mySCADA myPRO Manager
Two critical vulnerabilities in mySCADA myPRO Manager allow unauthenticated attackers to access privileged management functions and send arbitrary SMS via connected GSM modems, affecting versions through 2.1.
Microsoft Issues Emergency Windows Updates for RDS Failures
Microsoft released out-of-band updates to address Remote Desktop Services failures and issues affecting Hyper-V and USB audio on certain Windows versions.
Hackers Exploited Claude AI to Extract Secrets from 1.8M Android Apps
Threat actors exploited Anthropic's Claude AI to extract sensitive data from 1.8 million Android apps, highlighting growing risks of AI misuse.
AdaptHealth Confirms Data Exposure of 4.1 Million in July Cyberattack
Healthcare provider AdaptHealth confirmed that data of 4.1 million people was exposed in a July cyberattack tied to the ShinyHunters threat group, highlighting ongoing risks to healthcare organizations.
Cisco confirms active exploitation of critical FMC authentication bypass flaw
Cisco has confirmed active exploitation of a critical authentication bypass vulnerability (CVE-2026-20079) in its Secure Firewall Management Center software, risking enterprise defenses.
Critical Citrix NetScaler Auth Bypass Flaw Exploited in Attacks
Attackers are actively exploiting a critical authentication bypass vulnerability in Citrix NetScaler, significantly impacting enterprise security.
IDScan sued over breach exposing 153 million driver’s licenses
IDScan faces multiple lawsuits after hackers allegedly breached its identity verification service and sold data on over 153 million driver’s licenses, highlighting critical risks in personal data security.
New 'Ted' Backdoor Hides in HAProxy to Intercept Web Traffic
A Linux backdoor named 'Ted' has been found in trojanized HAProxy builds at South Korean organizations, intercepting and modifying web traffic while requiring prior code execution on the host.
Aesto Health Data Breach Exposes Over 9.5 Million Patients
Aesto LLC, operating as Aesto Health, disclosed a data breach impacting over 9.5 million patients, highlighting critical risks to patient data security.
Berlin Confirms Data Theft After Rhysida Ransomware Attack
Berlin's city administration confirmed data theft following a ransomware attack by the Rhysida group, who are demanding ransom.
TerminalFix campaign uses reverse tunnel and DLL sideloading in complex intrusion
Microsoft Threat Intelligence analyzes the TerminalFix campaign, which leverages fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel for multistage intrusion.
Critical ownCloud Flaw Exploited to Steal Nuclear Records in Philippines
A critical ownCloud vulnerability tracked as CVE-2023-49105 has been added to CISA's KEV catalog following exploitation by a Chinese-speaking threat actor targeting a Philippine nuclear research organization.
PaperCut issues second emergency patch for exploited NG and MF flaws
PaperCut released a second emergency patch addressing two actively exploited vulnerabilities in its NG and MF print management software after initial mitigations were bypassed.
Australia Arrests Suspected TeamPCP Hackers Behind Supply Chain Attacks
Australian authorities arrested two men linked to the TeamPCP group known for extensive developer supply chain attacks, disrupting a significant threat actor.
CISA Red Team Tests Expose Critical SOC and Cloud Security Gaps
CISA's red team assessments identified significant detection and response weaknesses in IT, cloud, and OT environments, revealing misconfigured Active Directory and excessive cloud permissions.
CISA Adds Oracle HTTP Server Vulnerability to Known Exploited Catalog
CISA has added CVE-2026-21962, an Oracle HTTP Server and WebLogic Server Proxy Plug-in vulnerability, to its Known Exploited Vulnerabilities Catalog due to active exploitation.
GitLab CVE-2026-19478 Exploited Days After Disclosure
A critical code injection vulnerability in GitLab, CVE-2026-19478, is actively exploited shortly after disclosure, enabling unauthenticated attackers to modify or delete certain publicly accessible projects.
CISA Adds Critical Zimbra OS Command Injection to Known Exploited Vulnerabilities
CISA added CVE-2026-73570, an OS command injection vulnerability in Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities Catalog after active exploitation was observed.
CISA Adds Two Critical TrueConf Vulnerabilities to KEV Catalog
CISA has included two actively exploited TrueConf Server vulnerabilities in its Known Exploited Vulnerabilities Catalog, emphasizing critical risks to federal agencies and beyond.
Critical NetScaler Flaw Can Bypass Authentication on Gateway Servers
Citrix has patched critical authentication bypass vulnerabilities affecting NetScaler ADC and Gateway, impacting specific FIPS and NDcPP builds used on gateway and AAA servers.
CareCloud Data Breach Exposes Records of 3.7 Million Patients
Healthtech firm CareCloud disclosed a data breach impacting over 3.7 million patients, exposing sensitive healthcare information.
Critical RCE Flaw in Windows IKE Extension Actively Exploited
CISA warns of active exploitation of a critical remote code execution vulnerability in the Windows Internet Key Exchange Service Extensions, enabling attacker code execution without user interaction.
CISA: Ransomware Gangs Exploiting Windows Task Host Flaw
CISA confirms ransomware groups are actively exploiting a high-severity Windows Task Host vulnerability, posing increased risk to enterprise environments.
Critical Vulnerabilities Found in Johnson Controls Airwall Affecting Sensitive Data
Two medium-to-high severity vulnerabilities in Johnson Controls Airwall could allow attackers to decrypt sensitive data and read arbitrary files, impacting critical infrastructure security.
RingCentral Data Breach Exposes 1.6 Million User Accounts
The ShinyHunters group breached RingCentral in July, compromising personal data of 1.6 million user accounts.
DeadLock ransomware uses decentralized infrastructure for extortion
Microsoft Threat Intelligence analyzes DeadLock ransomware, a Rust-based encryptor that employs decentralized victim communication and negotiation infrastructure alongside double extortion tactics.
LexisNexis Shuts Down Services After Suspicious Server Activity
LexisNexis took down several services after detecting unusual activity on servers managed by a third-party vendor, raising concerns about potential data breaches.
#StopRansomware: Emerging Gunra Ransomware Threat
Gunra ransomware, a double-extortion RaaS exploiting VPN and RDP vulnerabilities, threatens government and critical infrastructure with data encryption and leaks.
North Carolina Ports Hit by Cyberattack Disrupting Operations
The North Carolina Ports Authority confirmed a cyberattack on IT systems at multiple ports causing operational delays and highlighting risks to critical infrastructure.
Unlimited Technology Systems Breach Affects 3.8 Million People
Healthcare software provider Unlimited Technology Systems disclosed an October 2025 breach impacting over 3.8 million individuals and sensitive healthcare data.
Inside the Keyv/Cacheable npm Token Worm: Why Not to Revoke Tokens Yet
A compromise affecting the Keyv and Cacheable npm packages is leading to reconsideration of token revocation policies due to an active malware that triggers upon premature token revocation.
Critical Integrity Flaw in Thermo Fisher Genetic Analyzers Could Alter DNA Data
A high-severity vulnerability in Thermo Fisher Applied Biosystems Genetic Analyzers allows modification of DNA data output files, risking inaccurate test results in healthcare settings.
Microsoft Teams Vishing Attacks Deploy Chaos Ransomware in North America
Attackers use vishing via Microsoft Teams to impersonate IT support and deploy Chaos ransomware targeting organizations in North America through social engineering.
Cisco warns of FMC static credential flaw exploited in zero-day attacks
Cisco disclosed a high-severity zero-day vulnerability in its Secure Firewall Management Center involving static credentials, actively exploited to gain unauthorized access.
Coordinated Cyberattack Disrupts 30+ Minnesota Water Systems
A coordinated cyberattack targeted operational technology at over 30 Minnesota community water systems in late July, causing outages and communication disruptions.
Three Critical VMware Flaws Enable Auth Bypass and VM Escape
Broadcom published updates for critical VMware vulnerabilities in ESX, vCenter, Workstation, and Fusion enabling authentication bypass and VM escape with high severity.
Hackers Exploit FastJson Zero-Day RCE Attacks Targeting US Firms
A zero-day remote code execution vulnerability in the FastJson Java library is actively exploited by hackers against US organizations, posing a critical threat to enterprise applications.
Nimbus Manticore Uses NightLedger Backdoor to Target Middle East, Africa, Asia
Iranian state-backed group Nimbus Manticore deploys NightLedger backdoor and custom WebSocket tunnelers in attacks across the Middle East, Africa, and South Asia, enhancing stealth and covert activity.
Fastjson 1.x RCE Vulnerability Actively Targeted, No Patch Available
Attackers are exploiting a critical remote code execution vulnerability in Fastjson 1.x used in Spring Boot applications, enabling unauthenticated code execution with Java process privileges and no patch currently available.
Swiss Rail Firm Stadler Rejects $12.3M Ransom Demand After Cyberattack
Swiss rail manufacturer Stadler Rail faced a ransomware attack by the Everest gang targeting a shared supplier data exchange platform, refusing a $12.3 million ransom demand.
Anubis ransomware claims Coca-Cola Fairlife attack, threatens data leak
The Anubis ransomware group has claimed responsibility for a cyberattack on Coca-Cola's Fairlife brand and threatened to leak stolen data if ransom demands are not met.
Critical Authentication Bypass in Tycon Systems TPDIN-Monitor-WEB2
A critical authentication bypass vulnerability in Tycon Systems TPDIN-Monitor-WEB2 allows unauthenticated attackers full administrative control, risking critical infrastructure disruptions.
Critical wp2shell WordPress Flaw Allows Unauthenticated Code Execution
A critical vulnerability in WordPress core enables unauthenticated attackers to execute code on default installations, prompting urgent patch releases.
Two Scattered Spider Hackers Sentenced for £29M TfL Hack
Two hackers were sentenced for their 2024 attack on Transport for London, which disrupted 148 systems and forced a password reset for 27,000 employees, causing significant operational and financial impact.
US Charges Russian Operators of Bulletproof Hosting for Ransomware Gangs
US prosecutors charged three Russian nationals for operating a bulletproof hosting service that enabled ransomware gangs causing over $62 million in damages globally.
SAP Patches Critical CVSS 9.9 Flaw in NetWeaver ABAP
SAP released updates fixing a critical CVSS 9.9 out-of-bounds write vulnerability in NetWeaver ABAP that may allow authenticated attackers to corrupt memory and manipulate data.
CISA warns of active RCE flaws in Joomla iCagenda and Balbooa Forms extensions
CISA warns that remote code execution vulnerabilities are actively exploited in Joomla iCagenda and Balbooa Forms extensions through arbitrary file uploads, risking full compromise of affected sites.
Progress Warns ShareFile Customers to Shutdown Storage Zone Controllers
Progress Software advises ShareFile customers to shut down Windows servers running Storage Zone Controllers due to a credible security threat, disabling account access as a precaution.