Topic
67 articles on Threat Intel & Research, newest first.
Anthropic Mythos represents a turning point in cybersecurity that goes beyond incremental improvements in scanning or automation. It signals a change in who can discover…
Critical infrastructure cybersecurity is no longer only about preventing financial loss. It is about protecting trust, continuity, and public confidence. In today’s…
Iran’s approach to cyber operations is not random, purely criminal, or limited to espionage. It is a doctrine shaped by asymmetric power projection, plausible…
Typosquatting is one of the oldest techniques in the threat actor playbook, yet it remains one of the most effective. Attackers exploit minor spelling mistakes, visual…
Wiper attacks exist to destroy, not to extort. Unlike ransomware that encrypts files and holds them for payment, wipers overwrite data, corrupt system structures, and…
President Trump’s Cyber Strategy for America, released on March 6, 2026, sets a sweeping vision aimed at securing the nation’s digital infrastructure while reinforcing…
The geopolitical landscape shifted sharply after the coordinated strikes on Iran on 28 February 2026, marking the beginning of a hybrid conflict that fuses kinetic…
The recent Notepad++ incident is not a traditional software vulnerability in the editor itself. It is a supply chain style compromise where attackers interfered with how…
Fix‑type attacks are a family of social engineering techniques that coerce users to copy, paste, and execute attacker‑supplied content under the guise of fixing an error…
VoidLink is the latest malware that has captured the headlines with it novel stealthy techniques. In this article, let’s deep dive into what is VoidLink, its…
The RansomHouse ransomware-as-a-service (RaaS) has recently upgraded its encryptor, switching from a relatively simple single-phase linear technique to a more complex…
On December 9, 2025, the Cybersecurity and Infrastructure Security Agency (CISA), in coordination with the FBI, NSA, DOE, EPA, and international partners, issued…
On December 4, 2025, the Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the National Security Agency (NSA) and the Canadian Centre for…
Qilin ransomware, previously known as Agenda, has emerged as one of the most sophisticated ransomware-as-a-service (RaaS) operations in recent years. Its evolution from…
Cybercrime is undergoing a structural transformation. What was once a fragmented ecosystem of independent ransomware operators and data extortion gangs has evolved into…
In August 2025, attackers exploited OAuth tokens from Salesloft’s Drift integration to infiltrate hundreds of Salesforce customer environments, triggering one of the…
LockBit 5.0 has resurfaced as a hardened, cross‑platform ransomware family designed to disrupt heterogeneous enterprise estates at scale. Beyond simply updating an…
These days CISOs rarely sleep when they hear Cisco ASA. This September, a chilling new threat has jolted many security teams awake: the disclosure and active…
If you thought phishing was just about shady links in emails, think again. A new technique called ClickFix is making waves in the cybercrime world—and not in a good way.
Executive Summary The People’s Republic of China (PRC) has deployed a sophisticated and multi-faceted cyber strategy that presents a significant and evolving threat to…
As cyber threats continue to evolve, organizations must remain vigilant against a growing list of highly sophisticated adversaries. In 2025, both nation-state Advanced…
Quick Reality Check: Attackers Can’t “Grab ntds.dit From Any Workstation” (But Attackers Don’t Need To) There’s a persistent myth that adversaries routinely pull the…
In an era dominated by cutting-edge malware and zero-day exploits, one of the most dangerous attack techniques remains surprisingly low-tech: social engineering. The…
In a disturbing new development, cybersecurity researchers have uncovered a stealthy and effective method that enables cybercriminals to completely bypass a popular and…
Deepfake technology has rapidly evolved from internet curiosity to a serious cybersecurity threat. Once relegated to amusing face-swaps or political satire videos…
Cyber warfare has evolved into a new battleground where state-sponsored actors from China and Russia continually refine their tactics to infiltrate businesses, critical…
In the ever-evolving landscape of cybersecurity, a new threat has emerged that demands our attention. The RansomHub ransomware operation has recently been linked to a…
What is Active Directory (AD)? Active Directory (AD) is a critical component in many organizations’ IT infrastructure, providing a centralized and standardized system…
Living-Off-The-Land (LotL) is a term used in cybersecurity to describe a set of techniques employed by attackers that leverage legitimate tools, software, and features…
Picture this: you’re going about your day, working on important tasks or maybe catching up with colleagues over an online meeting. Suddenly, your screen freezes, and a…
Ransomware continues to be a formidable threat in the cyber security landscape, evolving with sophisticated techniques and causing significant disruptions across various…
The digital landscape is a battlefield, and in the shadows lurk cyber threats that can cripple infrastructure, steal secrets, and sow discord. Among these threats…
Volt Typhoon (also known as Vanguard Panda, BRONZE SILHOUETTE, Dev-0391, UNC3236, Voltzite, and Insidious Taurus) is a state-sponsored cyber actor group believed to be…
Phobos ransomware emerged as a significant threat in 2019, plaguing businesses and individuals. This malicious software encrypts valuable files, rendering them…
In the realm of cybersecurity, the landscape is constantly evolving, and with it, the tools and techniques employed by both defenders and attackers. Mimikatz, a powerful…
Cybersecurity remains a paramount concern as technology advances and cyber threats evolve. Predicting the landscape of cybersecurity for 2024 involves understanding…
The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Multi-State Information Sharing & Analysis Center (MS-ISAC), and…
Cyber attacks by Russia on Ukraine have erased data, degraded communication, and stolen information, yet they haven’t caused the destruction many anticipated after the…
In the month of July 2023, the threat landscape witnessed a significant increase in Clop ransomware attacks, which accounted for a staggering 34 percent of overall…
President Biden’s administration’s released National Cybersecurity Strategy in March 2023 lays out a bold and affirmative vision for cyberspace. Specifically, it…
In recent years, the digital landscape has witnessed a significant surge in ransomware attacks. Especially after the MoveIT vulnerability ( CVE-2023-34362 ), data…
Sodinokibi, also known as REvil, is a ransomware strain that has become one of the most prominent threats in the cyber landscape since its emergence in April 2019.
NoName057(16) Threat Group Motivation NoName057 is a pro-Russian threat actor group that has been making headlines recently. The group is believed to be associated with…
The prevalence of ransomware attacks is on the rise in recent years, and Royal Ransomware is one of the most notorious threats. It is a type of malware that encrypts the…
Earlier today, the FBI and the Secret Service seized the dark web leak website of the Hive ransomware gang. The criminal enterprise behind Hive appears to be the target…
What is Black Basta? Black Basta is ransomware as a service (RaaS) that appeared in April 2022. There is, however, evidence that it has been developed since February.
LockBit ransomware gang has apologized for its attack on the SickKids Pediatric Hospital which is a Toronto based hospital for Sick Children and released a decryptor for…
Cuba Ransomware is a highly sophisticated and dangerous piece of malware that has been used in targeted attacks against a wide range of organizations and individuals. It…
What is QBot? The QakBot banking Trojan, also known as QBot, QuackBot, and Pinkslipbot, has been around for over a decade. It was discovered in 2007 and is continuously…
Summary: While performing a security investigation, researchers at Vietnamese cybersecurity firm GTSC identified that threat actors are exploiting yet-to-be-disclosed…
What is LockBit 3.0 Ransomware? The LockBit 3.0 ransomware (also known as LockBit Black) belongs to the LockBit ransomware family. A wave of ransomware attacks took…
A breach of Uber’s computer network was discovered on Thursday, prompting the company to temporarily shut down several internal communication and engineering systems…
Summary AvosLocker is a Ransomware as a Service (RaaS) affiliate-based group that targets victims across multiple critical infrastructure sectors in the United States…
Introduction TrickBot is an advanced banking Trojan that was first identified in 2016. Malicious threat actors spread this trojan primarily by spearphishing campaigns…
Introduction: MuddyWater APT group has been active since 2017, focusing primarily on victims in the Middle East countries using in-memory vectors leveraging PowerShell.
Scenario An organization was hacked using the SQL injection and database access through its website. After penetrating the network and machine, the attacker created an…
Introduction ‘BlackMatter’ is a ransomware-as-a-service (RaaS) that first appeared in July 2021, when rumors began circulating that it was linked to the DarkSide attack.
In this article, we will discuss Conti Ransomware in detail. We’ll present our analysis results and the tactics, techniques, and procedures (TTP). Let’s look at some…
What is Ransomware? Ransomware is malware that infects a computer, restricts users’ access to their device, and threatens to publish a victim’s personal information…
What is Cyber Threat Intelligence? Cyber Threat Intelligence is the enriched and aggregated knowledge of the cyber threats extracted by collecting, processing, and…
What is an APT? An Advanced Persistent Threat (APT) is a sophisticated cyber threat where an attacker tries to intrude on a target network stealthily and maintain…
Summary: WannaCry is a ransomware worm that exploits SMB V1 vulnerability ( CVE-2017-0144 ) and caused a worldwide cyberattack by encrypting data and demanding ransom…
Summary: As an upgrade to LockBit, LockBit 2.0 first appeared in June 2021 as a ransomware service (RaaS). In the third quarter of the calendar year 2021, the LockBit…
Summary: During the SolarWinds hack ( CVE-2020-10148 ), thousands of organizations, including the U.S. government, were affected, not only because a single company was…
What is MedusaLocker Ransomware? MedusaLocker is a RaaS (Ransomware as a Service) variant that was first discovered in 2019 and has taken over the world. To increase the…
Summary: On December 9th of, 2021, a critical vulnerability was discovered affecting a Java logging package log4j. Log4j is an open-source logging framework written in…
Introduction Cybercriminal groups continue to emerge worldwide, launching dreadly ransomware and malware attacks at alarming rates. According to the Cyber Crime…
