Threats, Cyberattacks & Vulnerabilities
Top Stories
-
News
21 Aug 2026
AI attacks lack stealth -- nation-state actors are changing that
Today's AI attacks are still hard to miss and easy to stop, but nation-state threat actors are quietly pioneering low-and-slow adversarial AI. Learn what the shift means for defenders. Continue Reading
-
Video
19 Aug 2026
Cutting through the Claude Mythos hype: What it means for CISOs
In this Reporters' Notebook video, Informa TechTarget journalists discuss what we know -- and don't know -- about Claude Mythos, and what CISOs should do next. Continue Reading
-
News
27 Feb 2025
CrowdStrike: China hacking has reached 'inflection point'
In its 2025 Global Threat Report, CrowdStrike observed an increase in China's cyber capabilities, with a focus on espionage and 'pre-positioning' itself in critical environments. Continue Reading
-
News
26 Feb 2025
NCC Group tracks alarming ransomware surge in January
NCC Group found ransomware activity in January surpassed previous monthly highs with 590 attacks, as one notorious gang experienced a notable resurgence. Continue Reading
-
News
25 Feb 2025
Black Basta ransomware leak sheds light on targets, tactics
VulnCheck found the ransomware gang targeted CVEs in popular enterprise products from Microsoft, Citrix, Cisco, Fortinet, Palo Alto Networks, Confluence Atlassian and more. Continue Reading
-
News
25 Feb 2025
Dragos: Ransomware attacks against industrial orgs up 87%
Ransomware attacks continue to be a major pain point for industrial organizations, as the sector has historically struggled with vulnerability management. Continue Reading
-
News
21 Feb 2025
Palo Alto Networks vulnerabilities exploited in chained attack
The cybersecurity vendor urges customers to take immediate action to mitigate recently disclosed vulnerabilities that are being actively exploited in the wild. Continue Reading
-
Podcast
20 Feb 2025
Risk & Repeat: Salt Typhoon hasn't stopped hacking
Although the Salt Typhoon telecom breaches from last year appear to have been remediated, the Chinese state-sponsored threat group continues to target critical organizations. Continue Reading
-
News
20 Feb 2025
CISA, FBI warn of Ghost/Cring ransomware attacks
Ghost is a China-based financially motivated ransomware group that has launched attacks against organizations in more than 70 countries -- including its own. Continue Reading
-
Definition
19 Feb 2025
What is an attack vector?
An attack vector is a path or means by which an attacker or hacker can gain access to a computer or network server to deliver a payload or malicious outcome. Continue Reading
-
Definition
19 Feb 2025
What is email spoofing?
Email spoofing is a form of cyber attack in which a hacker sends an email that has been manipulated to seem as if it originated from a trusted source. Continue Reading
-
News
18 Feb 2025
Palo Alto Networks PAN-OS vulnerability exploited in the wild
Palo Alto Networks says threat actors used a publicly available PoC exploit in attack attempts against firewall customers with PAN-OS management interfaces exposed to the internet. Continue Reading
-
Definition
18 Feb 2025
What are social engineering attacks?
Social engineering is an attack vector that relies heavily on human interaction and often involves psychological manipulation of people into breaking normal security procedures and best practices to gain unauthorized access. Continue Reading
-
Definition
18 Feb 2025
What is a botnet?
A botnet is a collection of internet-connected devices -- including PCs, servers, mobile devices and internet of things (IoT) devices -- infected and controlled by a common type of malware, often unbeknownst to their owners. Continue Reading
-
News
13 Feb 2025
Salt Typhoon compromises telecom providers' Cisco devices
Salt Typhoon's latest campaign exploits older vulnerabilities in Cisco edge devices to gain access to the networks of several telecom companies, including two based in the U.S. Continue Reading
-
Definition
13 Feb 2025
What is a denial-of-service attack?
A denial-of-service (DoS) attack is a security threat that occurs when an attacker makes it impossible for legitimate users to access computer systems, networks, services or other IT resources. Continue Reading
-
Definition
12 Feb 2025
What is cyber hijacking?
Cyber hijacking, or computer hijacking, is a type of network security attack in which the threat actor takes control of computer systems, software programs and network communications. Continue Reading
-
News
11 Feb 2025
Apple zero day used in 'extremely sophisticated attack'
CVE-2025-24200 is a zero-day vulnerability that bypasses Apple's USB Restricted Mode in iPhones and iPads and was exploited in the wild against 'specific targeted individuals.' Continue Reading
-
News
10 Feb 2025
Trimble Cityworks zero-day flaw under attack, patch now
CVE-2025-0994 is a high-severity deserialization vulnerability that enables remote code execution in unpatched versions of Cityworks enterprise asset management software. Continue Reading
-
News
07 Feb 2025
Ransomware hits healthcare, critical services in January
Ransomware attacks against healthcare organizations in January reflect an increasing need for threat actors to adapt and get aggressive as defenders improve. Continue Reading
-
News
05 Feb 2025
Zyxel won't patch end-of-life routers against zero-day attacks
Networking hardware vendor Zyxel has no plans to patch multiple end-of-life routers against new zero-day flaws and advises customers to replace affected devices entirely. Continue Reading
-
News
04 Feb 2025
AMD, Google disclose Zen processor microcode vulnerability
AMD said CVE-2024-56161, which first leaked last month, requires an attacker to have local administrator privileges as well as developed and executed malicious microcode. Continue Reading
-
News
30 Jan 2025
German police disrupt Cracked, Nulled cybercrime forums
Cracked and Nulled had a combined community of approximately 10 million users who used the sites to discuss cybercrime and sell malware and hacking tools. Continue Reading
-
News
29 Jan 2025
Google details adversarial AI activity on Gemini
Google identified APTs from more than 20 nations misusing its Gemini AI chatbot but noted that threat actors were unsuccessful in finding novel techniques or vulnerabilities. Continue Reading
-
News
28 Jan 2025
Apple zero-day vulnerability under attack on iOS devices
Apple said the zero-day vulnerability, tracked as CVE-2025-24085, affects its CoreMedia framework and 'may have been actively exploited against versions of iOS before iOS 17.2.' Continue Reading
-
Definition
28 Jan 2025
What is spyware?
Spyware is a type of malicious software (malware) that is installed on a computing device without the end user's knowledge. Continue Reading
-
News
27 Jan 2025
Former CSRB members largely silent on dismissal
The Cyber Safety Review Board was investigating recent attacks by Chinese state-sponsored threat actor Salt Typhoon when DHS terminated all advisory board memberships. Continue Reading
-
News
24 Jan 2025
DOJ indicts 5 individuals in North Korea IT worker scam
An unsealed indictment revealed threat actors working for North Korea tricked at least 64 U.S. businesses into hiring fake IT workers for financial and propriety data gains. Continue Reading
-
News
23 Jan 2025
Zero-day vulnerability in SonicWall SMA series under attack
SonicWall released a hotfix for a critical pre-authentication remote code execution vulnerability in Secure Mobile Access 1000 products amidst reports of zero-day exploitation. Continue Reading
-
News
23 Jan 2025
Eclypsium finds security issues in Palo Alto Networks NGFWs
Eclypsium researchers stressed how essential supply chain security is as threat actors increasingly target and exploit vulnerabilities in firewalls, VPNs and other edge devices. Continue Reading
-
Definition
22 Jan 2025
What is hacktivism?
Hacktivism is the act of misusing a computer system or network for a socially or politically motivated reason. Continue Reading
-
News
21 Jan 2025
Threat actors abusing Microsoft Teams in ransomware attacks
Sophos researchers observed two separate threat campaigns in which attackers used Microsoft Teams to pose as IT support personnel and gain access to victims' systems. Continue Reading
-
News
16 Jan 2025
Threat actor publishes data of 15K hacked FortiGate firewalls
Although the threat actor published the alleged stolen Fortinet FortiGate firewall data this week, the data is apparently tied to older zero-day exploitation from 2022. Continue Reading
-
Feature
16 Jan 2025
The mystery of the $75M ransom payment to Dark Angels
The Dark Angels gang stole 100 TB of data from a Fortune 50 company last year for a record-setting ransom payment. But the victim organization still hasn't disclosed those details. Continue Reading
-
News
16 Jan 2025
ESET details UEFI Secure Boot bypass vulnerability
ESET researchers last year discovered an unsigned binary in a third-party UEFI application that could have been abused to bypass the Secure Boot process. Continue Reading
-
News
15 Jan 2025
FBI removes Chinese PlugX malware from 4,258 U.S. computers
The FBI did not inform individuals that it deleted PlugX malware from users' computers beforehand, citing the possibility of Chinese state-sponsored hackers making adjustments. Continue Reading
-
Definition
15 Jan 2025
What is password cracking?
Password cracking is the process of using an application program to identify an unknown or forgotten password that allows access to a computer or network resource. Continue Reading
-
News
14 Jan 2025
Attackers exploiting critical Fortinet zero-day vulnerability
Fortinet disclosed another zero-day vulnerability in its FortiOS and FortiProxy products days after Arctic Wolf detailed a threat campaign targeting the vendor's devices. Continue Reading
-
News
14 Jan 2025
CISA: BeyondTrust flaw CVE-2024-12686 exploited in the wild
BeyondTrust discovered the flaw last month while investigating breaches of a 'limited number' of SaaS customers at the hands of Chinese state-sponsored threat actors. Continue Reading
-
News
14 Jan 2025
Ivanti zero-day patching increases amid ongoing attacks
Recent scans conducted by the Shadowserver Foundation show many organizations have patched Ivanti instances vulnerable to CVE-2025-0282 over the last week. Continue Reading
-
News
09 Jan 2025
Mandiant links Ivanti zero-day exploitation to Chinese hackers
Mandiant warned users to be prepared for widespread exploitation of CVE-2025-0282 as Ivanti products have become a popular target for attackers in recent years. Continue Reading
-
News
09 Jan 2025
December ransomware attacks slam healthcare, public services
In December, one victim organization paid a $1.5 million ransom to restore services, while another continued to experience disruptions for more than one month following an attack. Continue Reading
-
News
08 Jan 2025
Critical Ivanti Connect Secure zero-day flaw under attack
Although Ivanti has seen exploitation of CVE-2025-0282 in only Ivanti Connect Secure instances, Ivanti Policy Secure and ZTA gateways are also vulnerable to the flaw. Continue Reading
-
News
02 Jan 2025
Dozens of Chrome extensions hacked in threat campaign
Although data security vendor Cyberhaven disclosed that its Chrome extension was compromised on Dec. 24, additional research suggests the broader campaign could be months older. Continue Reading
-
News
30 Dec 2024
10 of the biggest ransomware attacks in 2024
Ransomware attacks against U.S. organizations in 2024 disrupted healthcare systems, supply chains and government services and led to tens of millions of dollars in ransom payments. Continue Reading
-
Podcast
23 Dec 2024
Risk & Repeat: The state of ransomware in 2024
Ransomware made major headlines in 2024, from the massive Change Healthcare attack to the creative takedown of the notorious LockBit ransomware-as-a-service gang. Continue Reading
-
News
18 Dec 2024
CISA issues mobile security guidance following China hacks
Following the Salt Typhoon attacks, CISA offers advice to 'highly targeted' individuals, such as using end-to-end encryption and moving away from purely SMS-based MFA. Continue Reading
-
News
16 Dec 2024
Cleo zero-day vulnerability gets CVE as attacks continue
The new Cleo zero-day vulnerability, CVE-2024-55956, is separate from CVE-2024-50623 despite both vulnerabilities being used by threat actors to target the same endpoints. Continue Reading
-
News
16 Dec 2024
ESET: RansomHub most active ransomware group in H2 2024
The antimalware vendor says law enforcement operations against the LockBit ransomware gang were successful, but a new prolific group has emerged in its place. Continue Reading
-
Podcast
13 Dec 2024
Risk & Repeat: Attacks ramp up on Cleo MFT software
Earlier this week, threat actors began exploiting a zero-day vulnerability in Cleo's managed file transfer products, but the details of the flaw remain unclear. Continue Reading
-
News
12 Dec 2024
Cleo patches file transfer zero-day flaw under attack
Cleo published a patch for its Harmony, VLTrader and LexiCom managed file transfer products, which addresses a 'critical vulnerability' that's separate from CVE-2024-50623. Continue Reading
-
News
10 Dec 2024
Citrix NetScaler devices targeted in brute force campaign
Citrix advised NetScaler customers to ensure that their devices are fully updated and properly configured to defend against the recent spike in brute force attacks. Continue Reading
-
Definition
10 Dec 2024
What is a stream cipher?
A stream cipher is an encryption method in which data is encrypted one byte at a time. Continue Reading
-
News
09 Dec 2024
Attackers exploit vulnerability in Cleo file transfer software
Cleo disclosed and patched the remote code execution vulnerability in late October, but managed file transfer products have proved to be popular targets for threat actors. Continue Reading
-
News
06 Dec 2024
Ultralytics YOLO AI model compromised in supply chain attack
While Ultralytics has not released an official security advisory, the company pulled two recent versions of its YOLO11 AI model after reports said they contained a cryptominer. Continue Reading
-
News
05 Dec 2024
Police bust cybercrime marketplace, phishing network
As part of Europol's announcement of the cybercriminal marketplace's disruption, the agency included an image of a takedown notice referencing the 'Manson Market.' Continue Reading
-
News
04 Dec 2024
FBI: Criminals using AI to commit fraud 'on a larger scale'
As AI technology becomes more widely adopted, attackers are abusing it for their scams, which the FBI says are becoming increasingly more difficult to detect. Continue Reading
-
News
04 Dec 2024
FOSS security concerns increase amid widespread adoption
A new report from the Linux Foundation, OpenSSF and Harvard University calls for transparency and standardization to address growing security risks in open source software. Continue Reading
-
News
03 Dec 2024
Ransomware attacks on critical sectors ramped up in November
Supply chain software vendor Blue Yonder and energy management giant Schneider Electric SE experienced some of the most notable ransomware incidents in November. Continue Reading
-
News
26 Nov 2024
New York fines Geico, Travelers $11.3M over data breaches
The two insurance giants were fined millions by New York state regulators and are required to enhance security protocols around authentication and penetration testing. Continue Reading
-
News
26 Nov 2024
Russian hackers exploit Firefox, Windows zero-days in wild
RomCom threat actors chain two Firefox and Windows zero-day vulnerabilities together in order to execute arbitrary code in vulnerable Mozilla browsers. Continue Reading
-
News
22 Nov 2024
Volexity details Russia's novel 'Nearest Neighbor Attack'
The security company warned that the new attack style highlights the importance of securing Wi-Fi networks, implementing MFA and patching known vulnerabilities. Continue Reading
-
News
21 Nov 2024
DOJ charges 5 alleged Scattered Spider members
The defendants, charged for conducting alleged phishing scams across the U.S., are suspected members of a prolific threat group responsible for last year's casino attacks. Continue Reading
-
Podcast
20 Nov 2024
Risk & Repeat: China hacks major telecom companies
The FBI and CISA confirmed reports that Salt Typhoon breached several major telecom companies and accessed data related to law enforcement requests. Continue Reading
-
Definition
20 Nov 2024
What is Common Vulnerabilities and Exposures (CVE)?
Common Vulnerabilities and Exposures (CVE) is a publicly listed catalog of known security threats. Continue Reading
-
News
20 Nov 2024
Apple warns 2 macOS zero-day vulnerabilities under attack
The macOS Sequoia vulnerabilities are the latest to be targeted and exploited by threat actors as cybersecurity vendors report a shift in the landscape. Continue Reading
-
News
19 Nov 2024
Microsoft to offer hackers millions in Zero Day Quest event
Microsoft launched Zero Day Quest on Tuesday with a preliminary event offering bug bounty researchers rewards with multipliers for select security scenarios. Continue Reading
-
News
19 Nov 2024
2 Palo Alto Networks zero-day vulnerabilities under attack
CVE-2024-9474 marks the second zero-day vulnerability in Palo Alto Networks' PAN-OS firewall management interface to come under attack in the last week. Continue Reading
-
News
18 Nov 2024
Chinese APT exploited unpatched Fortinet zero-day flaw
Volexity reported that a Chinese APT actor exploited a zero-day vulnerability in Fortinet's Windows VPN FortiClient software that enables credentials to be stolen from a system. Continue Reading
-
Definition
18 Nov 2024
What is a whaling attack (whaling phishing)?
A whaling attack, also known as 'whaling phishing' or a 'whaling phishing attack,' is a specific type of phishing attack that targets high-profile employees, such as the chief executive officer (CEO) or chief financial officer, to steal sensitive information from a company. Continue Reading
-
News
15 Nov 2024
Palo Alto Networks PAN-OS management interfaces under attack
Palo Alto Networks confirmed that threat actors are exploiting a vulnerability in PAN-OS firewall management interfaces after warning customers to secure them for nearly a week. Continue Reading
-
News
14 Nov 2024
Infoblox: 800,000 domains vulnerable to hijacking attack
While the 'Sitting Ducks' attack vector continues to pose a problem, Infoblox says domain registrars, DNS providers and government bodies remain inactive. Continue Reading
-
News
13 Nov 2024
Most widely exploited vulnerabilities in 2023 were zero days
While zero-day exploitation surged throughout 2023, CISA said threat actors continue to exploit known vulnerabilities that were disclosed and patched as far back as 2017. Continue Reading
-
News
12 Nov 2024
Amazon employee data leaked from MoveIt Transfer attack
Although Amazon confirms that employee data was leaked, it stresses that data was stolen via a third-party vendor and that only contact information was obtained. Continue Reading
-
News
07 Nov 2024
Ransomware attacks caused prolonged disruptions in October
The Ransomhub, Rhysdia and Interlock ransomware gangs claimed responsibility for attacks that knocked victims' services offline, sometimes for several weeks. Continue Reading
-
News
05 Nov 2024
Canadian authorities arrest alleged Snowflake hacker
Alexander Moucka was arrested last week and is expected to appear in court Tuesday for allegedly breaching dozens of Snowflake customers. Continue Reading
-
News
31 Oct 2024
China-based APTs waged 5-year campaign on Sophos firewalls
For years, several advanced persistent threat groups tied to the Chinese government targeted Sophos firewall products with custom malware and zero-day exploits. Continue Reading
-
News
31 Oct 2024
Lottie Player NPM package compromised in supply chain attack
Threat actors published compromised versions of the Lottie Player component on NPM, and the malicious code prompted users to access their cryptocurrency wallets. Continue Reading
-
News
30 Oct 2024
Play ransomware attack tied to North Korean nation-state actor
A relationship between North Korean actor Jumpy Pisces and Play ransomware would be unprecedented, as the former has not collaborated with cybercrime gangs previously. Continue Reading
-
News
30 Oct 2024
Microsoft warns of Midnight Blizzard spear phishing campaign
The tech giant is notifying users affected by a recently observed campaign, which has targeted more than 100 victim organizations globally so far. Continue Reading
-
News
29 Oct 2024
REvil convictions unlikely to curb Russian cybercrime
In a rare action against cybercrime, a court in Russia sentenced four individuals tied to the Revil ransomware gang for money laundering and malware distribution charges. Continue Reading
-
Tip
28 Oct 2024
How to identify and prevent insecure output handling
Sanitation, validation and zero trust are essential ways to reduce the threat posed by large language models generating outputs that could cause harm to downstream systems and users. Continue Reading
-
News
24 Oct 2024
Fortinet FortiManager zero-day flaw exploited since June
Mandiant researchers first observed exploitation activity against CVE-2024-47575 on June 27, with more than 50 FortiManager devices compromised since. Continue Reading
-
News
23 Oct 2024
Fortinet discloses critical zero-day flaw in FortiManager
According to Fortinet, the FortiManager vulnerability 'may allow a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.' Continue Reading
-
Tip
22 Oct 2024
How AI is making phishing attacks more dangerous
Cybercriminals are using AI chatbots, such as ChatGPT, to launch sophisticated business email compromise attacks. Cybersecurity practitioners must fight fire with fire. Continue Reading
-
News
21 Oct 2024
Cisco confirms attackers stole data from DevHub environment
While Cisco said its systems were not breached, the vendor did confirm that attackers stole sensitive information from the public-facing portal. Continue Reading
-
News
17 Oct 2024
DOJ charges alleged Anonymous Sudan ringleaders
Two Sudanese brothers are accused of leading the cybercriminal group that caused significant damage to healthcare organizations as well as other high-profile victims. Continue Reading
-
News
17 Oct 2024
September a quiet month for ransomware attacks
Notable ransomware attacks in September involved a Rhode Island public school district, a Texas hospital system, and Kawasaki Motors' European branch. Continue Reading
-
News
16 Oct 2024
Microsoft sees drop in ransomware reaching encryption phase
In its Digital Defense Report 2024, Microsoft observed a significant increase in the number of human-operated ransomware attacks, which often originated from unmanaged devices. Continue Reading
-
News
16 Oct 2024
Microsoft: Nation-state activity blurring with cybercrime
Microsoft's Digital Defense Report 2024 noted that Russia 'outsourced some cyberespionage operations' against Ukraine to otherwise independent cybercrime gangs. Continue Reading
-
News
16 Oct 2024
Experts slam Chinese research on quantum encryption attack
Researchers at Shanghai University claim to have cracked RSA encryption using D-Wave quantum systems, but infosec experts say the claims are overblown. Continue Reading
-
News
11 Oct 2024
Zero-day flaw behind Rackspace breach still a mystery
More than two weeks after threat actors exploited a zero-day vulnerability in a third-party utility to breach Rackspace, the details about the flaw and the utility remain unknown. Continue Reading
-
News
10 Oct 2024
FTC orders Marriott to pay $52M and enhance security practices
The Federal Trade Commission says an investigation revealed that poor security practices led to three data breaches at Marriott and Starwood hotels between 2014 and 2020. Continue Reading
-
News
10 Oct 2024
OpenAI details how threat actors are abusing ChatGPT
While threat actors are using generative AI tools like ChatGPT to run election influence operations and develop malware, OpenAI says the efforts are rarely successful. Continue Reading
-
News
10 Oct 2024
Coalition: Ransomware severity up 68% in first half of 2024
The cyber insurance carrier examined claims trends for the first half of 2024, which showed policyholders experienced disruptive and increasingly costly ransomware attacks. Continue Reading
-
News
09 Oct 2024
Ivanti zero-day vulnerabilities exploited in chained attack
The new exploit chains targeting Ivanti Cloud Service Application customers are connected to a previously disclosed critical path traversal flaw, CVE-2024-8963. Continue Reading
-
News
08 Oct 2024
High-severity Qualcomm zero-day vulnerability under attack
Qualcomm urges customers to patch the memory corruption vulnerability as Google researchers have observed targeted exploitation in the wild against the flaw. Continue Reading
-
News
07 Oct 2024
American Water discloses breach, utilities unaffected
American Water says in its 8-K filing that it disconnected and deactivated certain systems in its incident response, though the nature of the cyberattack is unknown. Continue Reading
-
Feature
03 Oct 2024
'Defunct' DOJ ransomware task force raises questions, concerns
A report from the Office of the Inspector General reviewed the U.S. Department of Justice's efforts against ransomware and found its task force was largely ineffective. Continue Reading
-
News
03 Oct 2024
Cryptomining perfctl malware swarms Linux machines
Aqua Security researchers believe that perfctl malware has infected thousands of Linux machines in the last three to four years and that countless more could be next. Continue Reading
-
News
01 Oct 2024
Law enforcement agencies arrest 4 alleged LockBit members
Operation Cronos' efforts to disrupt the LockBit ransomware gang continue as authorities announced the arrests of four alleged members, including one developer. Continue Reading
-
News
27 Sep 2024
CUPS vulnerabilities could put Linux systems at risk
Security researcher Simone Margaritelli discovered vulnerabilities in the Common UNIX Printing System that attackers could exploit during print jobs against Linux systems. Continue Reading