cyberattack
Mallox Ransomware Surges: MS-SQL Servers in the Crosshairs
Mallox ransomware is exploiting poorly secured MS-SQL servers at scale. Here's how the attacks work and what defenders should patch…
▚malware
CERTUA
SOC Prime cookie list exposes third-party trackers on security sites
SOC Prime's website sets cookies from AddThis, Lotame and other ad-tech vendors, raising questions about tracking on a security vendor…
cyberattack
Quantum Ransomware: How a Fast-Moving Threat Targets Healthcare
Quantum ransomware encrypts files within hours of initial access and has breached 657 healthcare providers, exposing over 1.9 million victims.…
CERTUA
GhostWriter Targets Ukrainian Military University With PicassoLoader
UAC-0057, tracked as GhostWriter, hit a Ukrainian military university with PicassoLoader and Cobalt Strike Beacon. Here is the breakdown for…
antivirus software
Ransomware as a Service: How Low-Skill Attackers Now Launch Sophisticated Attacks
RaaS explained: the business model enabling amateur criminals to run enterprise-grade ransomware campaigns.
Cyber Attacks
Operational Resilience Is the CISO’s 2023 Battleground
CyberTalk's 2023 playbook for CISOs leans on risk management, Zero Trust, threat intel, and tested IR plans to keep the…
Cities
Why Ransomware Keeps Hitting Local Governments—and What Actually Works
Ransomware attacks on cities have surged. We break down the tactics that work against municipal targets and what defenders can…
Detection Content
AndoryuBot Returns: Ruckus Wireless RCE Flaw Under Active Attack
AndoryuBot botnet is exploiting CVE-2023-25717, a critical 9.8 RCE flaw in Ruckus Wireless admin panels, for DDoS. Here's what defenders…
Detection Content
APT37 ROKRAT Switches to LNK Files: Detection Rules for Defenders
North Korea-linked APT37 has shifted ROKRAT malware delivery to LNK files. Here are Sigma detections and what defenders should hunt…
malware
What Security Teams Get Wrong About Modern Ransomware—and How to Fix It
Check Point expert breaks down triple extortion, RaaS, and maximizing your existing security stack
AI
Breach Disclosure Reality: Why Hiding an Attack Now Guarantees Worse Outcomes
CISA and GDPR both mandate 72-hour reporting; cover-ups rarely survive public scrutiny
Conti
FIN7 and Ex-Conti Collaboration Delivers Domino Backdoor Malware
Russian-linked threat actors FIN7 and Conti affiliates deploy Domino backdoor in joint malware campaign.