Collaborate Disseminate
Google has significantly degraded NetNut, one of the biggest networks that turns home devices into rented relays for other people’s traffic.
Working with the FBI, Lumen, and others, Google’s Threat Intelligence Group (GTIG) said this week it… Continue reading Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices
Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial access.
“Although tactics differ between affiliates, common patterns emerged in tradecraft t… Continue reading Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials
This week’s security news is mostly about weak spots.
Browsers, bots, sandboxes, AI systems, and email flows all show the same problem in different ways. Everything looks normal until someone tests a small gap and finds a way through.
This is not one… Continue reading ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories
The threat actor known as ToddyCat has been attributed to a new malware called Umbrij that’s designed to gain surreptitious access to a victim’s email correspondence via the Google API.
“In this campaign, the attackers focused their attention on corpo… Continue reading ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API
Identity lifecycle management was architected around a person with an employment record, a manager, and a departure date. AI agents have none of those. As autonomous principals proliferate across enterprise environments, the governance model built for … Continue reading Identity Lifecycle Management Wasn’t Built for AI Agents
Security firm Sysdig says it has found what it believes is the first ransomware attack run from start to finish by an AI agent.
Its Threat Research Team calls the operator JADEPUFFER and says a large language model handled the whole job: bre… Continue reading AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack
The recently discovered financially-motivated FortiBleed campaign has been attributed to INC and Lynx ransomware operations, indicating that the verified, stolen credentials were intended for follow-on intrusions.
“An operator tied to FortiBleed’s inf… Continue reading FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations
Attackers are hiding a data-stealing trojan inside fake exploit code aimed at the people who hunt bugs for a living. The malware, called ChocoPoC, travels in Python proof-of-concept (PoC) repositories on GitHub that claim to exploit hot new CVEs.
Run … Continue reading New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The vulnerabil… Continue reading SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
Argo CD, a widely used tool for deploying software to Kubernetes, has an unpatched flaw in its repo-server component that lets an unauthenticated attacker run code, provided they can reach the component’s internal network port.
Synacktiv, which found … Continue reading Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters