Category
Intrusions
- 63
- stories
- OCT 27
- latest
All Intrusions · page 3
New Shai Hulud NPM Worm Emerges
Researchers from Wiz are currently tracking more than 25,000 affected repositories across approximately 350 unique users.
Dennis Fisher · 2 min
Marks and Spencer’s Profit Drop: The Financial Toll of Cyberattacks
The financial impacts of cyberattacks are hard to measure – but they lend critical context to conversations around security risk at the boardroom level.
Lindsey O'Donnell-Welch · 5 min
APT Targets Cisco and Citrix Zero Days
The chain of discovery began with Amazon’s security honeypot service, MadPot, which detected exploitation attempts for the Citrix Bleed Two vulnerability (CVE-2025-5777) before its public disclosure
Dennis Fisher · 2 min
Google: Threat Actors Testing AI During Malware Execution
Threat actors are now using LLMs in malware during execution, as a way to alter the malware’s behavior to enable detection evasion and more.
Lindsey O'Donnell-Welch · 3 min
New Lazarus Group Campaign Targets EU Defense Companies
The suspected objective of the Lazarus group was the exfiltration of proprietary information and manufacturing expertise, particularly pertaining to UAV technology.
Dennis Fisher · 3 min
F5: Attacker Accessed BIG-IP Source Code, Bug Data
The company discovered the intrusion in August but did not say when the attackers first gained access to F5’s systems or how long they had access.
Dennis Fisher · 2 min
Oracle Clop Data Theft Campaign Started Months Ago
The Clop extortion campaign on Oracle customers last week stemmed from months of intrusion activity tracking back to July 10.
Lindsey O'Donnell-Welch · 2 min
Akira Ransomware Actors Target SonicWall SSLVPN
This aggressive approach aligns with Akira’s historical tactics of exploiting VPN infrastructure as an initial access vector.
Dennis Fisher · 2 min
Cisco Warns of Attacks on Two ASA Flaws
Cisco’s Talos threat intelligence team said this campaign is the work of an actor it tracks as UAT4356, an APT team that has previously targeted ASA devices.
Dennis Fisher · 3 min
Three Takeaways From the EU Airport Outages
The incident is a pointed example of how an intrusion at a key point in the software supply chain can have a wide range of downstream effects.
Dennis Fisher · 2 min
Russian APT Groups Turla, Gamaredon Collaborate to Target High-Profile Ukrainian Entities
In a new report, ESET researchers have detailed several instances when the two groups’ tools have been found on the same compromised machines in Ukraine.
Dennis Fisher · 3 min
Microsoft, Cloudflare Disrupt RaccoonO365 Phishing Kit Service
Microsoft and Cloudflare this week announced that they paired up to disrupt RaccoonO365, a phishing-as-a-service cybercriminal enterprise.
Lindsey O'Donnell-Welch · 3 min
New Automated npm Attack Campaign Targets Dozens of Packages
The campaign does not appear to be connected to the previous npm phishing attacks, but it does seem to be related to a rash of GitHub and npm token and secret thefts from the end of August.
Dennis Fisher · 3 min
Senator Flags Microsoft’s Role in the Ascension Ransomware Hack
Sen. Ron Wyden (D-Ore.) wants the U.S. government to hold Microsoft responsible “for contributing to ransomware attacks against critical U.S. infrastructure” like Ascension.
Lindsey O'Donnell-Welch · 2 min
Attack Compromises Popular NPM Packages
The affected packages include Chalk and Debug, and one of the contributors to those packages said the compromise was the result of him clicking on a phishing email related to setting up 2FA on his account.
Dennis Fisher · 4 min
Wyden Slams Federal Judiciary After Court Hack
In a scathing letter, Sen. Ron Wyden (D-Ore.) blasted the federal judiciary for its handling of a (second) hack of the federal courts’ case management system earlier this year.
Lindsey O'Donnell-Welch · 3 min
Cloudflare Details Salesloft Drift Breach
This incident is the latest to stem from an intrusion at Salesloft in which attackers used OAuth tokens to target Salesloft customers’ Salesforce integrations.
Dennis Fisher · 3 min
UNC6395 Expands Data Theft Campaign to Email OAuth Tokens
Google researchers discovered the new attacks and are advising all customers to treat any authentication tokens for those integrations as compromised.
Dennis Fisher · 2 min
US Gov Links Private Chinese Firms to Salt Typhoon Hacks
Salt Typhoon has not been observed exploiting zero-day flaws, but instead targeting known bugs in exposed network edge devices – some of which are years old.
Lindsey O'Donnell-Welch · 3 min
Attacks Hit Possible SonicWall Zero Day
Attackers are exploiting a likely zero day vulnerability in some versions of SonicWall Firewall devices with the SSL VPN functionality enabled, and in some cases are able to bypass MFA protections. The intrusions have been ongoing since at least the end of last week, and researchers have observed some attackers deploying the Akira ransomware after…
Dennis Fisher · 2 min