2026-01-27 09:37 UTC
Other
Other
Your Cloud(s). Adversaries’ Chance At Control
Reconfigure multi-cloud security with the newly launched Group-IB Cloud Security Posture Management (CSPM)
P0
LATEST
Aggregated cybersecurity reporting, advisories and research. 5,236 matching records.
AUTO-POLL // 2026-10-20 18:25 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P1 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 20
RANSOMWARE
P1
COOL // 48 ARTICLES
MON
Oct 19
RANSOMWARE
P3
COOL // 51 ARTICLES
SUN
Oct 18
RANSOMWARE
P2
COOL // 8 ARTICLES
SAT
Oct 17
ACTIVE EXPLOITATION
P4
COOL // 12 ARTICLES
FRI
Oct 16
RANSOMWARE
P8
COOL // 56 ARTICLES
THU
Oct 15
ACTIVE EXPLOITATION
P7
COOL // 87 ARTICLES
WED
Oct 14
RANSOMWARE
P8
COOL // 74 ARTICLES
2026-01-23 16:58 UTC
Other
Other
ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025
The attack involved data-wiping malware that ESET researchers have now analyzed and named DynoWiper
P0
2026-01-23 10:00 UTC
Other
Other
Children and chatbots: What parents should know
As children turn to AI chatbots for answers, advice, and companionship, questions emerge about their safety, privacy, and emotional development
P0
2026-01-22 15:00 UTC
Security Journalism
Security Journalism
Huntress Catches SmarterMail Account Takeover Leading to RCE
SmarterMail versions prior to Build 9511 are vulnerable to privileged account takeover and remote code execution. Learn more about the latest Huntress DE&TH Team’s findings.
P15
2026-01-22 10:00 UTC
Other
Other
Common Apple Pay scams, and how to stay safe
Here’s how the most common scams targeting Apple Pay users work and what you can do to stay one step ahead
P0
2026-01-21 06:56 UTC
Other
Other
Peruvian Peaks: The Digital Loan Illusion
A deep dive into loan phishing scams in Peru and Latin America. Discover how scammers lure victims with fake loan offers, harvest sensitive banking credentials, and leverage advanced scripts to maximize fraud at scale.
P0
2026-01-21 06:00 UTC
Security Journalism
Security Journalism
How Hacked Construction Apps Are Bringing Down Jobsite Security
Vertical-specific construction applications face unique risks. Hacked apps stem from flaws in the software or its components, expanding the jobsite attack surface.
P0
2026-01-20 10:00 UTC
Other
Other
Old habits die hard: 2025’s most common passwords were as predictable as ever
Once again, data shows an uncomfortable truth: the habit of choosing eminently hackable passwords is alive and well
P0
2026-01-20 06:27 UTC
Other
Other
P0
2026-01-20 06:12 UTC
Other
Other
P0
2026-01-20 05:59 UTC
Other
Other
P0
2026-01-16 10:00 UTC
Other
Other
Why LinkedIn is a hunting ground for threat actors – and how to protect yourself
The business social networking site is a vast, publicly accessible database of corporate information. Don’t believe everyone on the site is who they say they are.
P0
2026-01-16 06:00 UTC
Security Journalism
Security Journalism
Dissecting CrashFix: KongTuke's New Toy
Fake ad blocker crashes your browser, then offers a "fix." Go inside KongTuke's CrashFix campaign, from malicious extension to ModeloRAT for VIP targets.
P0
2026-01-15 15:00 UTC
Security Journalism
Security Journalism
SDFlags | Huntress
While investigating LDAP filters and attributes, I completely missed "SDFlags" in my Event 1644 logs. When I finally noticed it, the investigation led to nTSecurityDescriptor, attack path discovery, and a high-confidence detection signature.
P0
2026-01-15 06:07 UTC
Other
Other
DeadLock Ransomware: Smart Contracts for Malicious Purposes
This blog uncovers DeadLock’s stealthy usage of Polygon smart contracts for proxy address storage, a poorly-documented and under-reported technique that Group-IB analysts have observed increased usage in the wild. Variants of this technique are very wide and offer great alternatives to threat actors for bypassing traditional defenses by abusing decentralized blockchains available worldwide.
P35
2026-01-14 10:00 UTC
Other
Other
Is it time for internet services to adopt identity verification?
Should verified identities become the standard online? Australia’s social media ban for under-16s shows why the question matters.
P0
2026-01-13 10:00 UTC
Other
Other
Your personal information is on the dark web. What happens next?
If your data is on the dark web, it’s probably only a matter of time before it’s abused for fraud or account hijacking. Here’s what to do.
P0
2026-01-13 06:39 UTC
Other
Other
PCI DSS v4.0.1 for Payment Integrations: A Realistic Security-First Approach
Modern payment integrations are fast, flexible, and increasingly complex. APIs talk to gateways, webhooks trigger state changes, third parties handle fraud, retries, refunds, and orchestration layers quietly sit in between. In most teams, the signal that things are “working” is simple: transactions go through. That signal is misleading. At RedHunt Labs, we found that the real-world payment pentests reveal the common mistake of treating PCI DSS as a finish line instead of a baseline. This blog r…
P0
2026-01-13 06:00 UTC
Security Journalism
Security Journalism
Cross-Platform Unity in EDR
Huntress researchers weigh in on the challenge of getting feature parity across Windows, macOS, and Linux. And learn how unique security models and platform maturity shape the way products are built.
P0
2026-01-12 08:00 UTC
Security Journalism
Security Journalism
Reflecting on AI in 2025: Faster Attacks, Same Old Tradecraft
Huntress outlines 2025 AI attack speed with automated scripts, but adversaries use familiar tradecraft. Detection and hygiene remain decisive.
P0
2026-01-08 10:00 UTC
Other
Other
Credential stuffing: What it is and how to protect yourself
Reusing passwords may feel like a harmless shortcut – until a single breach opens the door to multiple accounts
P0
2026-01-07 14:00 UTC
Security Journalism
Security Journalism
ESXi Exploitation in the Wild
Huntress outlines a complex, multi-step attack designed to break out of guest VMs and target the ESXi hypervisor, using potential zero-day vulnerabilities and sneaky VSOCK communication.
P45
2026-01-07 12:00 UTC
Government
Government
Digital Identities: Getting to Know the Verifiable Digital Credential Ecosystem
Understanding mDL credential formats Standards in the VDC Ecosystem In our first blog post in this series, we highlighted that VDCs can represent a wide range of credentials, from a driver’s license to a diploma to proof of age. The ability to use VDCs in a wide variety of use cases is a major reason why many are looking at the VDC ecosystem as technology that can change how we present identity and attributes (both in person and online). While credential variety is a good thing, interoperabilit…
P0
2026-01-07 07:00 UTC
Other
Other
Ghost Tapped: Tracking the Rise of Chinese Tap-to-pay Android Malware
Group-IB researchers detail the inner workings of Chinese tap-to-pay schemes on Telegram and examine the NFC-enabled Android apps fraudsters are using to steal money from victim’s bank cards and mobile wallets remotely.
P0
2026-01-05 15:00 UTC
Government
Government
Cyber Brief 26-01 - December 2025
Cyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.
P0
2026-01-05 08:15 UTC
Other
Other
The DocuSign Impersonation Wave with Real-Time Customizable LogoKit
Learn how Group-IB’s Business Email Protection stops the growing wave of DocuSign impersonation before users are exposed, and protects them from credential-capturing websites built with real-time customizable LogoKit.
P0
2025-12-31 06:00 UTC
Security Journalism
Security Journalism
Rogue RMMs: Common Social Engineering Tactics We Saw in 2025
From lures involving Social Security statements to top domains and hashes used in attacks, here's an in-depth look at incidents involving ScreenConnect in 2025.
P0
2025-12-30 06:00 UTC
Security Journalism
Security Journalism
The LDAP Whitespace Problem | Huntress
Your LDAP detection rules work in the lab but fail in production. Here's why Event 1644 whitespace variations break your Sigma rules and how to fix them.
P0
2025-12-29 10:00 UTC
Other
Other
This month in security with Tony Anscombe – December 2025 edition
As 2025 draws to a close, Tony looks back at the cybersecurity stories that stood out both in December and across the whole of this year
P0
2025-12-24 07:04 UTC
Other
Other
Empty Promises in MENA: How Online Quick Cash Schemes Exploit the Gig Economy
Fake online job ads continue to circulate across social media, especially in Arab countries, offering easy remote work and quick income. The sinister goal: to harvest sensitive information, from ID documents to banking details. This blog explains how the scheme operates, who the scammers target, and how to prevent falling victim to it.
P0