Popular
Nothing found for . Try a course, an exam code (SC-200), a tool or a topic.
↑↓ moveEnter openEsc close
Cyber security news, as it breaks.
Updated 133 stories in 24 hours
Nation-State Threats
The incidents, breaches and state campaigns making headlines.
15stories this week
2today
the last seven days
Most fromThe Hacker News, Securelist (Kaspersky), Cybersecurity Dive, CyberScoop
In the news hereConnectWise2Lazarus2APT28 (Fancy Bear)2Microsoft1Ivanti1Citrix1APT411
MyCyberWay trainingBreaches like this get investigated, not just reported.See Blue Team Specialist
-
An alleged Chinese state-backed group is using a new zero-day affecting BeyondTrust IT support software to conduct espionage attacks.
The Record
-
Organizations running self-hosted BeyondTrust Remote Support should treat exposed appliances as potentially compromised after a suspected Chinese espionage group exploited a critical zero-day to gain root control, access credential vaults, and establish footholds for lateral movement, according to Mandiant and Google Threat Intelligence Group. “Organizations should prepare for potential widespread exploitation following this disclosure,” Google…
CSO Online UK
-
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could…
The Hacker News
-
Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft.
Unit 42
-
Exploited
ARMORY CASTLE Exploits BeyondTrust
Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances. BeyondTrust Remote Support is an enterprise secure remote access solution that enables IT teams to securely access and troubleshoot remote endpoints. The successful…
Google Threat Intelligence
-
US authorities have arrested two suspects and seized nearly 190 devices in a crackdown on North Korea’s fake remote IT workers. The FBI warns that the scheme is expanding to include identity theft, extortion and even threats of physical violence. North Korean operatives have been posing as US-based workers to quietly land remote IT jobs…
Bitdefender
-
The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group’s operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes.
BleepingComputer
-
The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea’s fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70…
The Hacker News
-
The latest operation targeted “laptop farms” across Texas that allegedly aided North Korea’s moneymaking plots.
Cybersecurity Dive
-
North Korean IT workers used stolen and fabricated identities to land remote jobs at more than 70 US companies, with help from Americans who allegedly kept company-issued laptops running from their homes, according to the US Department of Justice. Arrests in Ohio, raids in Texas Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo…
Help Net Security
-
Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators (tracked as Storm-2990), and an illicit marketplace (tracked as Storm-3119) selling tools and infrastructure for large-scale phishing. In collaboration with law enforcement agencies and other partners worldwide, Microsoft’s Digital Crimes Unit (DCU) facilitated a disruption of the ecosystem.
Microsoft Threat Intelligence
-
Investigators stormed 40 locations in Texas and seized 187 laptops used by North Korean IT workers to hide their location.
SecurityWeek
