Category
Intrusions
- 63
- stories
- OCT 27
- latest
Hive, Nefilim Ransomware Affiliate Sentenced to 70 Months in Jail
A 36-year-old Ukrainian national who acted as a Nefilim and Hive ransomware affiliate and targeted hospitals and government entities has been sentenced to 70 months in prison.
LINDSEY O'DONNELL-WELCH · OCT 27 · 2 min
All Intrusions
FBI Warns of FortiBleed Attacks Leading to Lockouts, Ransomware
FortiBleed attacks are continuing, with the FBI and Secret Service warning of compromised Fortinet firewalls, account lockouts and potential ransomware activity.
Lindsey O'Donnell-Welch · 2 min
New Campaign Weaponizes Microsoft Teams for Remote Access
Unlike standard commodity malware that aims for quick credential theft, this campaign features a manual, hands-on-keyboard scheme designed to escalate rapidly from a single compromised workstation to broad, network-wide access.
Dennis Fisher · 2 min
OpenAI, Anthropic AI Agents Performed ‘Unsanctioned’ Actions During Cyber Tests
OpenAI and Anthropic models made “unsanctioned” actions during tests by the AI Security Institute. Here’s what we know.
Lindsey O'Donnell-Welch · 5 min
OpenAI-Hugging Face Breach: Five New Things We Learned
New details emerged this week about an intrusion by OpenAI models on Hugging Face’s infrastructure.
Lindsey O'Donnell-Welch · 4 min
The Joy and Pain of OT Cybersecurity: A Conversation With Lesley Carhart
Lesley Carhart has been cleaning up malware, intrusions, ransomware, and other messes in OT networks for the better part of two decades and recently joined Dennis Fisher on the Decipher podcast to talk about the special challenges OT networks present
Dennis Fisher · 4 min
Chinese APT UAT-7810 Expands Malware Arsenal
The investigation into UAT-7810 shows significant evolution in their toolkit, specifically the development of a successor to their previously documented SHORTLEASH backdoor.
Dennis Fisher · 2 min
Evil Is as Evil Does: New EvilTokens Affiliate Panel Uncovered
This new ARToken operator panel has a clear lineage going back to the EvilTokens framework, which emerged in early 2026.
Dennis Fisher · 2 min
New Turla Stockstay Backdoor Emerges
Known historically for its tight ties to Russia’s FSB and its development of the Snake implant, Turla has leveraged STOCKSTAY to target sensitive government and military organizations.
Dennis Fisher · 2 min
FortiBleed Credential Theft Campaign Marches On
The campaign is not the result of a compromise of Fortinet itself, but rather involves the attackers testing a custom list of known passwords for Fortinet devices.
Dennis Fisher · 2 min
Check Point VPN Flaw Targeted by Ransomware Actors
The vulnerability is a critical one and Check Point Research said that it’s likely that the actor targeting the bug is a financially motivated group.
Dennis Fisher · 2 min
GitHub Confirms Internal Breach
The company said it is still working through the intrusion but does not believe any customer repositories or data was affected at this point.
Dennis Fisher · 3 min
Data Shows Thousands of Automatic Tank Gauges Exposed Across the US
As of May 2026, over 6,502 ATG services running on 6,057 unique hosts were found to be reachable on the public internet across more than 65 countries.
Dennis Fisher · 2 min
Ongoing Supply Chain Attack Expands to PyPi
Researchers have linked the compromise to the “Mini Shai-Hulud” campaign, which has been ongoing for several weeks and is associated with TeamPCP.
Dennis Fisher · 3 min
Alleged Silk Typhoon Hacker Extradited to US
The hacker was allegedly involved in Hafnium campaigns that targeted Exchange server flaws and in attacks against COVID-19 research institutions.
Lindsey O'Donnell-Welch · 2 min
Firestarter Malware Sparks Updated CISA Emergency Directive
CISA is warning of a persistent backdoor called Firestarter that’s being used in attacks against Cisco Firepower and Secure Firewall products.
Lindsey O'Donnell-Welch · 4 minCisco CVE-2026-20133 Targeted in Active Attacks
The three newly added bugs are CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133, the last of which had not been identified in active attacks before.
Dennis Fisher · 2 min
Vercel Says Internal Systems Hit in Breach
The incident came to light on Sunday and the company says it has brought in an incident response provider to investigate the intrusion. Details of the intrusion are scant at this point.
Dennis Fisher · 3 min
