Exploitation

Microsoft Warns of ‘Payroll Pirates’ Hijacking HR SaaS Accounts to Divert Employee Salaries

A cyber threat group identified as Storm-2657 has been observed taking over employee accounts with the intent of redirecting salary payments to attacker-controlled bank accounts. According to a report from the Microsoft Threat Intelligence team, “Storm-2657 is actively targeting various U.S.-based organizations, especially employees in sectors such as higher education, to infiltrate third-party Human Resources […]

Microsoft Warns of ‘Payroll Pirates’ Hijacking HR SaaS Accounts to Divert Employee Salaries Read More »

Fortra Discloses Full Timeline of CVE-2025-10035 Exploitation, from Detection to Patch

Fortra has officially disclosed the complete timeline of events surrounding the exploitation of CVE-2025-10035, a critical vulnerability in its GoAnywhere Managed File Transfer (MFT) software. The flaw has reportedly been under active attack since at least September 11, 2025. Investigation and Initial Discovery According to Fortra, the investigation began on September 11 after a customer

Fortra Discloses Full Timeline of CVE-2025-10035 Exploitation, from Detection to Patch Read More »

Stealit Malware Abuses Node.js Single Executable Feature, Hides in Game and VPN Installers

Security researchers have uncovered an active malware campaign, named Stealit, that uses a newer Node.js capability to ship malicious code as single-file executables, enabling infections on systems without Node.js installed. Researchers at Fortinet FortiGuard Labs also note some variants are built with the Electron framework, making delivery simpler and more covert. How the malware is

Stealit Malware Abuses Node.js Single Executable Feature, Hides in Game and VPN Installers Read More »

CL0P-Linked Hackers Exploit Oracle Software Flaw to Breach Multiple Organizations

Dozens of organizations may have been impacted after threat actors exploited a zero-day vulnerability in Oracle E-Business Suite, starting around August 9, 2025, researchers from Google Threat Intelligence Group, GTIG, and Mandiant reported. The intrusion campaign, which shows hallmarks associated with the Cl0p ransomware brand, used a chain of vulnerabilities to gain remote code execution,

CL0P-Linked Hackers Exploit Oracle Software Flaw to Breach Multiple Organizations Read More »

From HealthKick to GOVERSHELL: Tracking the Evolution of UTA0388 Espionage Malware

A China aligned threat actor tracked as UTA0388 has run multiple spear phishing campaigns across North America, Asia, and Europe, with the main aim of delivering a Go based implant known as GOVERSHELL. Volexity reported these operations on Wednesday, noting that initial messages impersonated senior researchers and analysts from fabricated organizations, to trick recipients into

From HealthKick to GOVERSHELL: Tracking the Evolution of UTA0388 Espionage Malware Read More »

ThreatsDay Bulletin: MS Teams Breach, MFA Hijacking, $2B Crypto Theft, Apple Siri Investigation & More

Cybersecurity threats are advancing faster than ever, with attackers increasingly combining social engineering, AI-driven manipulation, and cloud exploitation to target systems once deemed secure. From communication platforms to smart devices, every technological convenience simultaneously expands the potential attack surface. This edition of ThreatsDay Bulletin highlights these overlapping risks and the necessary measures to maintain trust in

ThreatsDay Bulletin: MS Teams Breach, MFA Hijacking, $2B Crypto Theft, Apple Siri Investigation & More Read More »

Hackers Breach SonicWall Cloud Firewall Backups, Prompting Urgent Security Reviews

SonicWall revealed on Wednesday that an unauthorized party gained access to firewall configuration backup files of customers using its cloud backup service. The compromised files contain encrypted credentials and configuration data. While the encryption remains active, possession of these files may increase the risk of targeted attacks The company is actively notifying all affected partners

Hackers Breach SonicWall Cloud Firewall Backups, Prompting Urgent Security Reviews Read More »

Mustang Panda Employs New DLL Side Loading Technique to Deploy Malware

Security researchers have observed a renewed Mustang Panda campaign that uses a fresh DLL side-loading method to deliver malicious payloads, targeting Tibetan advocacy groups with politically themed lures. The operation first appeared in June, 2025, and combines archive-based phishing, hidden library files, dynamic API resolution, and periodic task scheduling to maintain persistence and execute stolen

Mustang Panda Employs New DLL Side Loading Technique to Deploy Malware Read More »

Lapsus$ Hunters Launch New Leak Site to Publish Data Stolen from Salesforce

The cybercriminal collective known as Scattered Lapsus$ Hunters has intensified their extortion efforts by launching a dedicated leak portal aimed at publishing stolen Salesforce data. This alliance, which includes prominent threat actors such as ShinyHunters, Scattered Spider, and Lapsus$, represents a new level of sophistication in ransomware-as-a-service operations, specifically targeting one of the most widely

Lapsus$ Hunters Launch New Leak Site to Publish Data Stolen from Salesforce Read More »

Hackers Abuse Legitimate Database Commands to Actively Compromise Databases

A new wave of sophisticated ransomware attacks is targeting organizations worldwide by abusing legitimate database commands, bypassing traditional security tools through “malware-free” operations. Unlike typical ransomware that relies on malicious binaries to encrypt files, attackers are exploiting exposed database services, using standard database functionality to steal, erase, and demand ransom for critical information. This technique

Hackers Abuse Legitimate Database Commands to Actively Compromise Databases Read More »