Delivery and Initial Access Phishing Attachments or Links Malicious documents, compressed files, or URLs designed to lure targets into executing spyware payloads. Malvertising and SEO Poisoning Fake ads and manipulated search results leading to trojanized installers or compromised websites. Cracked Software and Bundles Spyware hidden inside pirated applications or repacked
CVE-2025-48543
CVE-2025-9074 Critical Docker Desktop CONTAINER ESCAPE A flaw in Docker Desktop allows local Linux containers to access the Docker Engine API at 192.168.65.7:2375, enabling control over other containers, image management, and in some cases, host drive access. This represents a significant container escape vulnerability. Mitigation: Update
PagerDuty
TRENDING TOPICS SEPT 04, 2025 Update: PagerDuty Drawn into Salesloft OAuth Fallout PagerDuty has confirmed that it was impacted by the ongoing Salesloft Drift OAuth breach, which has already affected several high-profile companies. The compromise was traced back to August 20, 2025, when Salesloft first alerted PagerDuty to a security
Iran
TRENDING TOPICS SEPT 03, 2025 Iranian Hackers Exploit Embassy Email Accounts in Coordinated Phishing Campaign Iranian-aligned threat actors tied to the Homeland Justice cluster have carried out a coordinated, multi-wave spear-phishing campaign targeting embassies, consulates, and diplomatic organizations across the Americas, Africa, the Middle East, Asia, and Europe. Researchers at
Monthly Wrap
MONTHLY WRAP MONTHLY WRAP Overview Adversaries doubled down on trusted channels, identity systems, and edge infrastructure. Campaigns abused Telegram, Microsoft Teams, OAuth consent, and link-wrapping services to bypass controls; mobile banking and RAT operations surged via malvertising and fake app stores; and cloud-n
UNC6395
TRENDING TOPICS SEPT 02, 2025 Update: Palo Alto Networks Confirmed in OAuth Supply-Chain Breach Palo Alto Networks has confirmed that it was among the companies affected by the ongoing OAuth supply-chain campaign, which first came to light with the Salesloft Drift breach. Attackers leveraged compromised tokens to infiltrate Palo Alto’
CVE-2025-52970 High Fortinet FortiWeb AUTHENTICATION BYPASS Improper parameter handling flaw in FortiWeb allows unauthenticated attackers with certain non-public information to log in as any user via crafted requests. Affects versions 7.6.0–7.6.3, 7.4.0–7.4.7, 7.2.0–7.2.10, and 7.
Storm-0501
TRENDING TOPICS AUG 28, 2025 Update: Storm-0501 Shifts to Cloud-Based Ransomware and Data Extortion Storm-0501, a financially motivated threat actor active since at least 2021, has shifted from traditional on-premises ransomware to a new model centered on cloud-based data theft, encryption, and extortion. Historically tied to Sabbath, Hive, BlackCat, LockBit,
Government
TRENDING TOPICS AUG 27, 2025 Nevada Shuts Down State Offices After Major Cyberattack Disrupts IT Systems The State of Nevada has entered its third day of disruption following a large-scale cyberattack that began early Sunday morning and has forced the closure of all state offices. The Governor’s Technology Office
1 Initial Access Attack Method Malware dropper creates a scheduled task triggered at user logon or system boot Real-World Example A malicious payload set to execute every hour after phishing-based delivery 2 Reconnaissance (Post-Exploitation) Attack Method Task beacons every 16–19 minutes with host/user IDs Real-World Example TA397 tasks
Iran
TRENDING TOPICS AUG 26, 2025 Iranian Shipping Crippled Through Maritime Communications Hack In late August 2025, a coordinated cyberattack crippled Iran’s maritime communications, severing satellite links, navigation data, and port coordination for 64 vessels. The operation, attributed to the hacktivist group Lab-Dookhtegan, did not directly breach each ship but
Python
TRENDING TOPICS AUG 25, 2025 Obfuscated Python Attacks on the Rise Threat actors are increasingly embedding malicious code into Python packages on PyPI, often within projects that appear normal yet still provide the expected features. These trojanized libraries often keep their advertised functionality but quietly execute hidden routines once installed.