Threats, Cyberattacks & Vulnerabilities
Top Stories
-
Tip
24 Aug 2026
CISO's guide to RAG data security risks and protection strategies
Retrieval-augmented generation enhances AI security, but expands the attack surface. Organizations need to aggressively manage RAG security to protect their networks and data. Continue Reading
-
News
21 Aug 2026
AI attacks lack stealth -- nation-state actors are changing that
Today's AI attacks are still hard to miss and easy to stop, but nation-state threat actors are quietly pioneering low-and-slow adversarial AI. Learn what the shift means for defenders. Continue Reading
-
Answer
17 Jan 2019
Ping of death: What is it and how is Apple affected?
An Apple vulnerability recently resurfaced and is targeting Apple devices that are connected to public hotspots. Discover what this vulnerability is and how to protect your devices. Continue Reading
-
News
15 Jan 2019
Ryuk ransomware poses growing threat to enterprises
Cybersecurity vendors CrowdStrike and FireEye both published new research that shows an increase in Ryuk ransomware attacks on enterprises, which have earned hackers $3.7 million. Continue Reading
-
Answer
15 Jan 2019
How was a credit card skimmer used to steal data from Newegg?
Researchers believe that malicious JavaScript code was used to steal credit card data from online retailer Newegg. Learn more about this attack with Judith Myerson. Continue Reading
-
News
11 Jan 2019
Iran implicated in DNS hijacking campaign around the world
FireEye researchers investigating a DNS hijacking campaign against governments and telecom companies said those who are potential targets of Iran should take precautions. Continue Reading
-
News
10 Jan 2019
McAfee casts doubt on Ryuk ransomware connection to North Korea
New research from McAfee refutes the connection between recent Ryuk ransomware attacks and the North Korean government. Instead, it points the finger at cybercriminals. Continue Reading
-
Podcast
10 Jan 2019
Risk & Repeat: What APT10 means for managed service providers
This week's Risk & Repeat podcast discusses how a Chinese state-sponsored threat group known as APT10 hacked into managed service providers to gain access to their clients. Continue Reading
-
News
04 Jan 2019
Cloud provider blames Ryuk ransomware for Christmas Eve attack
News roundup: Data Resolution claimed the Ryuk ransomware attack on its systems originated from North Korea. Plus, the EU is set to launch 14 open source bug bounties, and more. Continue Reading
-
News
02 Jan 2019
Tribune Publishing cyberattack raises attribution questions
Malware hit the Tribune Publishing Company and disrupted the publication of several major newspapers, but the nature of the attack and threat actors remain unclear. Continue Reading
-
News
31 Dec 2018
Why dating app security flaws should concern enterprises
Vulnerable dating apps on BYODs pose risks to more than just individual users. Find out what security flaws are common in these apps and what they mean for enterprises. Continue Reading
-
News
27 Dec 2018
Malwarebytes: Fileless ransomware an emerging threat for U.S.
A new Malwarebytes report examines Sorebrect, a fileless ransomware threat that's been detected in the U.S. this year, as well as with three other fileless attacks. Continue Reading
-
Opinion
27 Dec 2018
How paradigms shifting can alter the goals of attackers and defenders
The use of disruptive technology is altering the way attackers and defenders set goals for network security. Learn more about the shifting field with Matt Pascucci. Continue Reading
-
News
21 Dec 2018
DOJ indicts two Chinese nationals for APT10 group cyberattacks
The Department of Justice indicted two alleged members of the Chinese state-sponsored hacking group APT10, which hacked managed service providers to steal data from enterprises. Continue Reading
-
News
21 Dec 2018
Microsoft patches Internet Explorer zero-day bug under attack
News roundup: Microsoft issues an emergency patch for an Internet Explorer bug exploited in the wild. Plus, authorities indict three individuals for 'stresser' services, and more. Continue Reading
-
Answer
21 Dec 2018
How is SamSam ransomware using a manual attack process?
Sophos researchers believe the SamSam ransomware campaign could be the work of one or a few threat actors using manual techniques. Learn how it works and if recovery is possible. Continue Reading
-
Answer
20 Dec 2018
Ticketmaster breach: How did this card skimming attack work?
The hacking group Magecart was recently found to have run a card skimming campaign that put customer information at risk. Learn how this attack worked from Nick Lewis. Continue Reading
-
Answer
19 Dec 2018
GandCrab ransomware: How does it differ from previous versions?
A new version of GandCrab was discovered by researchers in July 2018 and involves the use of legacy systems. Learn how this version differs and who is at risk with Nick Lewis. Continue Reading
-
News
18 Dec 2018
Huawei bans set to continue, despite lack of supporting evidence
While the number of countries with Huawei bans in place grows and more issue warnings, a German investigation found no evidence of spying to support the fear. Continue Reading
-
Answer
17 Dec 2018
Kronos banking Trojan: How does the new variant compare?
Proofpoint researchers found a Kronos variant after it targeted victims in Germany, Japan and Poland. Learn how this variant compares to the original banking Trojan with Nick Lewis. Continue Reading
-
News
14 Dec 2018
Facebook API bug exposed photos of 6.8 million users
GDPR regulators are already investigating a new Facebook API bug the social media giant announced Friday that might have exposed photos belonging to up to 6.8 million users. Continue Reading
-
News
14 Dec 2018
Mozilla distrusts all Symantec certificates with Firefox 64 release
News roundup: Mozilla finally removes trust for Symantec certificates with Firefox 64. Plus, Supermicro's investigation challenges Bloomberg Businessweek's report, and more. Continue Reading
-
Answer
14 Dec 2018
How does the new Dharma Ransomware variant work?
Brrr ransomware, a Dharma variant, was found adding malicious extensions to encrypted files. Discover how this is possible and how this attack can be mitigated with Judith Myerson. Continue Reading
-
News
13 Dec 2018
Project Zero finds Logitech Options app critically flawed
Tavis Ormandy of Google's Project Zero discovered a serious authentication vulnerability in Logitech's Options application, but the peripheral device maker has yet to address the flaw. Continue Reading
-
News
13 Dec 2018
Operation Sharpshooter targets infrastructure around the world
Operation Sharpshooter is a recently discovered global cyberattack campaign targeting critical infrastructure organizations, including nuclear, defense and financial companies. Continue Reading
-
Answer
13 Dec 2018
Why is preloading HTTP Strict Transport Security risky?
Despite being designed to improve security, infosec experts have warned against preloading the HSTS protocol. Learn about the risks of preloaded HSTS with Judith Myerson. Continue Reading
-
Tip
13 Dec 2018
How a flaw in Apple DEP misuses an MDM server
Hackers are able to enroll their devices in an organization's MDM server via a flaw in Apple DEP. Expert Michael Cobb explains how hackers conduct these attacks. Continue Reading
-
News
12 Dec 2018
Equifax breach report highlights multiple security failures
An Equifax breach report, based on a government investigation, blamed the incident on multiple security failures and concluded the breach was preventable. Continue Reading
-
Answer
11 Dec 2018
FragmentSmack: How is this denial-of-service exploited?
FragmentSmack, a DDoS vulnerability first discovered in Linux, affects Windows as well as nearly 90 Cisco products. Discover how it can be exploited with Judith Myerson. Continue Reading
-
Answer
07 Dec 2018
How did WhatsApp vulnerabilities get around encryption?
WhatsApp vulnerabilities can enable hackers to bypass end-to-end encryption and spoof messages. Expert Michael Cobb explains how these attacks work and how to prevent them. Continue Reading
-
News
06 Dec 2018
NRCC email breach confirmed eight months later
A security company was brought in to investigate a National Republican Congressional Committee breach from April, but little is known about the NRCC email theft. Continue Reading
-
News
06 Dec 2018
NSO Group's Pegasus spyware linked to Saudi journalist death
Soon after the Pegasus spyware was linked to the death of a Mexican journalist, a new lawsuit alleged the NSO Group and its spyware were also linked to the death of a Saudi journalist. Continue Reading
-
Answer
04 Dec 2018
How do L1TF vulnerabilities compare to Spectre?
Foreshadow, a set of newly discovered L1TF vulnerabilities, exploits Intel processors via side-channel attacks. Learn about L1TF and its variations from expert Michael Cobb. Continue Reading
-
Blog Post
30 Nov 2018
Are US hacker indictments more than Justice Theater?
New hacker indictments and U.S.Treasury Department sanctions highlight the disconnect between government action and real world consequences for threat actors. Continue Reading
-
News
30 Nov 2018
Marriott discloses Starwood data breach affecting 500 million guests
Marriott International admitted to a Starwood data breach that began in 2014 and affects about 500 million customers. Experts are unsure about the GDPR implications. Continue Reading
-
Opinion
30 Nov 2018
Why U.S. election security needs an immediate overhaul
There's no evidence that threat actors have been able to manipulate or change vote counts in our elections, but Kevin McDonald says that doesn't mean it can't -- or won't -- happen. Continue Reading
-
News
29 Nov 2018
SamSam ransomware actors charged, sanctioned by US government
The FBI indicted two threat actors involved with the SamSam ransomware attacks while the US Treasury sanctioned two others for their role in exchanging Bitcoin earned from attacks. Continue Reading
-
Blog Post
29 Nov 2018
Breaking down Dell's "potential cybersecurity incident" announcement
Dell provided some information about a "potential cybersecurity incident" earlier this month, but it's unclear how the company and customers should be reacting. Continue Reading
-
Blog Post
29 Nov 2018
Will cybersecurity safety ever equal air travel safety?
Guaranteeing cybersecurity safety is one of the biggest challenges facing the tech industry, but using aviation safety as a model may help achieve that goal. Continue Reading
-
News
28 Nov 2018
Botnet takedown snares 3ve, Methbot ad fraud campaigns
The Justice Department indicted eight individuals accused of running major ad fraud campaigns, including the 3ve botnet, which generated millions of dollars in fake ad revenue. Continue Reading
-
Answer
28 Nov 2018
How did the Emotet banking Trojan lead to a rise in attacks?
A report on cybercrime shows a rise in banking Trojans, such as Emotet, targeting businesses over consumers. Malwarebytes' Adam Kujawa shares his thoughts on what's behind this shift. Continue Reading
-
Tip
27 Nov 2018
How bring-your-own-land attacks are challenging enterprises
FireEye researchers developed a new technique called bring your own land, which involves attackers creating their own tools. Discover more about how this works with Nick Lewis. Continue Reading
-
Answer
23 Nov 2018
How was a MikroTik router hack used to hijack traffic?
Qihoo 360 Netlab researchers found that TZSP traffic was being redirected from vulnerable routers. Learn what this type of traffic is and how this attack is possible. Continue Reading
-
Answer
22 Nov 2018
How was a black box attack used to exploit ATM vulnerabilities?
Researchers from Positive Technologies found flaws affecting NCR ATMs. Discover how these ATM vulnerabilities work and how a patch can mitigate this attack. Continue Reading
-
News
20 Nov 2018
Recorded Future names Tessa88 suspect in LinkedIn, Myspace breaches
Researchers at Recorded Future identified the individual behind the notorious Tessa88 hacker handle, but it's unclear what role he played in the LinkedIn and Myspace breaches. Continue Reading
-
Answer
20 Nov 2018
Can a D-Link router vulnerability threaten bank customers?
A D-Link router vulnerability was used to send banking users to a fake site in order to steal their information. Learn more about this vulnerability with expert Judith Myerson. Continue Reading
-
Answer
19 Nov 2018
How does a Bluetooth vulnerability enable validation attacks?
Bluetooth devices might be at risk after a new Bluetooth vulnerability was found targeting firmware and operating system software drivers. Learn how it works and can be mitigated. Continue Reading
-
News
16 Nov 2018
Firefox Monitor offers breach alerts on visited websites
The promised integration with Have I Been Pwned is expanding in Firefox Monitor with new breach alerts when a user visits a recently compromised website. Continue Reading
-
News
16 Nov 2018
Google BGP route leak was accidental, not hijacking
Despite early speculation, experts concluded the BGP route leak that sent Google traffic through China and Russia was due to an accidental misconfiguration and not malicious activity. Continue Reading
-
Podcast
16 Nov 2018
Risk & Repeat: Are we winning the war on cybercrime?
On this week's Risk & Repeat podcast, Chet Wisniewski of Sophos discusses his company's latest research and explains why there's reason for optimism in the war on cybercrime. Continue Reading
-
News
16 Nov 2018
After 2015 OPM data breach, agency failed to update security
News roundup: Three years after the OPM data breach, the agency still hasn't implemented basic security. Plus, seven new Meltdown, Spectre attacks were uncovered, and more. Continue Reading
-
Answer
15 Nov 2018
How is the Trezor cryptocurrency online wallet under attack?
A phishing campaign targeting Trezor wallets may have poisoned DNS or hijacked BGP to gain access. Learn how the attack worked and how to mitigate it with expert Nick Lewis. Continue Reading
-
News
14 Nov 2018
Cybercrime agreement signed by 50 nations, not U.S., China and Russia
An international cybercrime agreement was signed by 50 nations and 150 companies in Paris, but the U.S., China and Russia were not part of the accord. Continue Reading
-
News
12 Nov 2018
SSD encryption failures made worse by BitLocker settings
Researchers discover major manufacturers poorly implemented SSD encryption, allowing easy access to data, and Microsoft BitLocker made the issue worse. Continue Reading
-
Answer
12 Nov 2018
How does new MacOS malware target users through chat?
New malware targets cryptocurrency investors through MacOS and chat platforms were recently discovered. Learn how OSX.Dummy malware works and what users can do to spot the attack. Continue Reading
-
News
09 Nov 2018
New spam botnet infects over 100,000 home routers
News roundup: A new spam botnet infected over 100,000 home routers through a UPnP vulnerability, according to researchers. Plus, HSBC Bank reported a data breach, and more. Continue Reading
-
Answer
09 Nov 2018
How is Plead malware used for cyberespionage attacks?
Cyberespionage hackers have used stolen digital certificates to steal data. Expert Michael Cobb explains how hackers sign Plead malware to conduct these attacks. Continue Reading
-
News
08 Nov 2018
U.S. Cyber Command malware samples to be logged in VirusTotal
The Cyber National Mission Force will share unclassified U.S. Cyber Command malware samples to VirusTotal and one expert hopes there will be more action taken to help researchers. Continue Reading
-
Answer
08 Nov 2018
What is behind the growing trend of BEC attacks?
BEC attacks cost over $676 million in 2017, according to the FBI's Internet Crime Report. Learn how to recognize possible BEC attacks from expert Michael Cobb. Continue Reading
-
Answer
07 Nov 2018
How does site isolation defend against Spectre vulnerabilities?
Spectre exploits how processors manage performance-enhancing features. Expert Michael Cobb explains Google Chrome's initiative to use site isolation as a defense mechanism. Continue Reading
-
News
06 Nov 2018
PortSmash side-channel attack targets Intel Hyper-Threading
The latest side-channel attack against Intel chips, known as PortSmash, targets Hyper-Threading in order to steal data, such as private OpenSSL keys from a TLS server. Continue Reading
-
Tip
05 Nov 2018
How deception technologies improve threat hunting, response
Deception tech tools enable more effective threat hunting and incident response. Learn how these tools can give security pros an edge in defending their company systems and data. Continue Reading
-
News
05 Nov 2018
As PHP v5 nears its end, enterprises face serious threats
The majority of websites still use the outdated PHP v5, according to recent data, causing concern over the fact that it will stop receiving security support at the end of the year. Continue Reading
-
News
02 Nov 2018
Bleedingbit vulnerabilities put Wi-Fi access points at risk
Armis researchers discovered two chip-level Bluetooth vulnerabilities -- dubbed Bleedingbit -- that could allow pseudo-remote code execution on wireless access points. Continue Reading
-
News
02 Nov 2018
SamSam ransomware campaigns continue to target U.S. in 2018
News roundup: SamSam ransomware targeted 67 organizations in 2018, according to research. Plus, Equifax is sending its breach victims to Experian for credit monitoring, and more. Continue Reading
-
News
02 Nov 2018
Kraken ransomware gets packaged into Fallout EK
Researchers found Kraken ransomware has become more popular after being packaged in the Fallout exploit kit and becoming part of an affiliate program. Continue Reading
-
Tip
30 Oct 2018
Enterprises should reconsider SMS-based 2FA use after breach
A Reddit breach was triggered by threat actors intercepting SMS messages used to authenticate employees to access sensitive data. Learn why enterprises should reconsider SMS for 2FA. Continue Reading
-
News
26 Oct 2018
Settlement in Yahoo data breach leaves company to pay $50M
News roundup: The Yahoo data breach will cost the company another $50 million in a settlement deal. Plus, Check Point acquired cloud security company Dome9, and more. Continue Reading
-
News
26 Oct 2018
WebExec vulnerability leaves Webex open to insider attacks
A remote code execution flaw in Cisco Webex -- called WebExec -- could be an easy vector for insider attacks, and the researchers who found it say it's easier to exploit than detect. Continue Reading
-
News
25 Oct 2018
Malwarebytes cybercrime report shows increase in attacks on businesses
Malwarebytes' report, 'Cybercrime Tactics and Techniques Q3 2018,' highlights how businesses became the focus of cyberattacks versus consumers over the past three months. Continue Reading
-
News
25 Oct 2018
FireEye ties Russia to Triton malware attack in Saudi Arabia
FireEye security researchers claimed the Russian government was 'most likely' behind the Triton malware attack on an industrial control system in Saudi Arabia last year. Continue Reading
-
Answer
25 Oct 2018
Does pcAnywhere put election management systems at risk?
ES&S admitted it installed the insecure remote access program pcAnywhere on election management systems. Learn what pcAnywhere is and what this risk means for election systems. Continue Reading
-
Answer
24 Oct 2018
Siemens Siclock: How do threat actors exploit these devices?
Siemens disclosed six Siclock flaws that were found within its central plant clocks. Discover why three flaws have been rated critical and how threat actors can exploit devices. Continue Reading
-
News
22 Oct 2018
Zero-day jQuery plugin vulnerability exploited for 3 years
A zero-day in jQuery File Upload could affect thousands of projects because the jQuery plugin vulnerability has existed for eight years and actively exploited for at least three years. Continue Reading
-
News
19 Oct 2018
Facebook hack the work of spammers, not foreign adversary
News roundup: The Facebook hack was the work of spammers, according to The Wall Street Journal. Plus, 35 million voter records are for sale on the dark web, and more. Continue Reading
-
News
19 Oct 2018
GreyEnergy threat group detected attacking high-value targets
Researchers claim a new threat group called GreyEnergy is the successor to BlackEnergy, but experts are unsure if the evidence supports the claims or warnings of future attacks. Continue Reading
-
Podcast
19 Oct 2018
Risk & Repeat: Military cybersecurity scrutinized in GAO report
This week's Risk & Repeat podcast discusses the GAO report on vulnerabilities and weaknesses in modern weapons systems and what they mean for the U.S. military. Continue Reading
-
Tip
18 Oct 2018
The implications of the NetSpectre vulnerability
The NetSpectre vulnerability could enable a slow leak of data remotely via side channels. Expert Michael Cobb explains why data on secure microprocessors is not actually safe. Continue Reading
-
Answer
17 Oct 2018
How did the IcedID and TrickBot banking Trojans join forces?
The TrickBot banking Trojan joined forces with IcedID to form a dual threat that targets victims for money. Discover how this union occurred and how it has changed their behaviors. Continue Reading
-
Answer
16 Oct 2018
How does the APT attack Double Kill work in Office documents?
The Qihoo 360 Core Security team found a Microsoft vulnerability -- named Double Kill -- that affects applications via Office documents. Learn how this is possible with Nick Lewis. Continue Reading
-
Answer
15 Oct 2018
How does the MnuBot banking Trojan use unusual C&C servers?
IBM X-Force found MnuBot -- a new banking Trojan -- manipulating C&C servers in an unusual way. Learn how this is possible and how this malware differs from those in the past. Continue Reading
-
News
12 Oct 2018
Facebook breach affected 20 million fewer than thought
The recent Facebook breach affected 20 million fewer accounts than was previously thought. The company now says 29 million accounts had data exposed to attackers. Continue Reading
-
News
12 Oct 2018
Mozilla delays distrust of Symantec TLS certificates, Google doesn't
Mozilla delays plans to distrust Symantec TLS certificates in Firefox because despite more than one year's notice, approximately 13,000 websites still use the insecure certificates. Continue Reading
-
News
12 Oct 2018
Industroyer, NotPetya linked to TeleBots group by ESET researchers
News roundup: An APT group called TeleBots group was linked to Industroyer malware and NotPetya ransomware, according to researchers. Plus, Imperva is acquired by Thoma Bravo and more. Continue Reading
-
News
11 Oct 2018
Paul Vixie wants to stop malicious domains before they're created
Farsight Security's Paul Vixie says his company's new research into domain name lifespans and causes of death shows the need for new policies and action to curb malicious domains. Continue Reading
-
News
11 Oct 2018
U.S. weapon systems cybersecurity failing, GAO report says
A U.S. Government Accountability Office report gave failing grades to military weapon systems cybersecurity, but some experts say the report should be a source of encouragement. Continue Reading
-
News
11 Oct 2018
Patched MikroTik router vulnerability worse than initially thought
Tenable Research finds new exploits of an already patched MikroTik router vulnerability that could enable hackers to launch remote code execution attacks. Continue Reading
-
News
05 Oct 2018
GRU indictment accuses 7 Russians in global cyberattacks
The U.S., U.K. and other allies accused seven Russian military officers in cybercrimes around the world, and the GRU indictment from the U.S. formally pressed charges. Continue Reading
-
News
05 Oct 2018
Compromised Supermicro chips reportedly infiltrated US
News roundup: A Bloomberg report claimed China infiltrated U.S. companies and government agencies through tiny Supermicro chips on motherboards. Plus, a new Telegram flaw and more. Continue Reading
-
Answer
05 Oct 2018
How does FacexWorm malware use Facebook Messenger to spread?
Researchers at Trend Micro found a new strain of malware -- dubbed FacexWorm -- that targets users via a malicious Chrome extension. Discover how this attack works with Nick Lewis. Continue Reading
-
News
04 Oct 2018
North Korean cybertheft of $100-plus million attributed to APT38
Security researchers tracked an aggressive cybertheft campaign -- attributed to North Korean APT38 -- in which threat actors attempted to steal more than $1 billion and destroy all evidence along the way. Continue Reading
-
Answer
04 Oct 2018
How does stegware malware exploit steganography techniques?
Researchers at the 2018 RSA Conference discussed the increasing availability of malware that uses steganography, dubbed stegware. Discover how this works with expert Nick Lewis. Continue Reading
-
Tip
04 Oct 2018
How is Android Accessibility Service affected by a banking Trojan?
ThreatFabric researchers uncovered MysteryBot, Android malware that uses overlay attacks to avoid detection. Learn how this malware affects Google's Android Accessibility Service. Continue Reading
-
Infographic
02 Oct 2018
Beware of the gray hat hacker, survey warns
Close to 40% of security professionals either know, or have known, a legitimate security practitioner who has participated at some point in black hat activities. Continue Reading
-
Answer
02 Oct 2018
How does MassMiner malware infect systems across the web?
Researchers from AlienVault found a new cryptocurrency mining malware -- dubbed MassMiner -- that infects systems across the web. Learn how this malware operates with Nick Lewis. Continue Reading
-
Blog Post
01 Oct 2018
FBI, DHS blaming the victims on Remote Desktop Protocol
FBI, DHS call on users to mitigate Remote Desktop Protocol vulnerabilities and handle RDP exploits on their own, even as the "going dark" campaign continues unabated. Continue Reading
-
Answer
01 Oct 2018
SamSam ransomware: How is this version different from others?
Sophos recently discovered a SamSam extortion code that performs company-wide attacks using a range of vulnerability exploits. Discover how this version differs from past variants. Continue Reading
-
News
28 Sep 2018
DEF CON report: Election equipment plagued by 10-year-old flaw
The DEF CON report from the 2018 Voting Village paints a troubling picture for election equipment vendors, including a machine with a flaw known since 2007 left unpatched. Continue Reading
-
Answer
28 Sep 2018
How can live chat widgets leak personal employee data?
Project Insecurity researchers found live chat software leaking personal employee data. Learn how attackers can use this leaked information and data to hurt organizations. Continue Reading
-
News
27 Sep 2018
Congressional websites need to work on TLS
Congressional websites may not always have the best security, according to Joshua Franklin. Although, senators may be better at website security than House representatives. Continue Reading
-
News
27 Sep 2018
Election website security a mess for states and candidates alike
Joshua Franklin has been researching election website security for congressional candidates, and he found a lot of misconfigurations on official pages and other sites meant to confuse voters. Continue Reading
-
News
26 Sep 2018
Browser Reaper POC exploit crashes Mozilla Firefox
A security researcher developed a proof-of-concept attack on Firefox, called Browser Reaper, which can crash or freeze the browser. But he gave Mozilla short notice of the flaw. Continue Reading