Popular
Nothing found for . Try a course, an exam code (SC-200), a tool or a topic.
↑↓ moveEnter openEsc close
Cyber security news, as it breaks.
Updated 125 stories in 24 hours
Nation-State Threats
The incidents, breaches and state campaigns making headlines.
15stories this week
2today
the last seven days
Most fromThe Hacker News, Securelist (Kaspersky), Cybersecurity Dive, CyberScoop
In the news hereConnectWise2Lazarus2APT28 (Fancy Bear)2Microsoft1Ivanti1Citrix1APT411
MyCyberWay trainingBreaches like this get investigated, not just reported.See Blue Team Specialist
-
Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.
Securelist (Kaspersky)
-
Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse against South Korean financial institutions, to speed up…
The Hacker News+2 sources
-
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware.
BleepingComputer
-
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.
Microsoft Threat Intelligence
-
Symantec, which discovered the operation, urged companies to scan their networks for signs of compromise.
Cybersecurity Dive
-
Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security software.
Securelist (Kaspersky)
-
It’s the work of the infamous group behind the attacks on Democrats during the 2016 presidential election, Symantec said.
CyberScoop
-
The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO). The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail, involved the use of a backdoor called HOOKEDGE and…
The Hacker News
-
The Russian group known as APT28 and Fancy Bear used a recently documented backdoor to dwell in the networks of two defense contractors and a law enforcement agency in two NATO allies, researchers said.
The Record
-
The FBI raided 40 Texas homes over a North Korean scheme that used fake IT workers to target 70 US companies and generate $3 million. The Justice Department (DoJ) announced coordinated enforcement actions this week targeting North Korea’s long-running scheme to place fake IT workers inside American companies. Two US nationals were arrested, 14 people…
Security Affairs
-
Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers.
CyberScoop
-
Researchers say the hacker is harvesting credentials and stealing sensitive information.
Cybersecurity Dive
