Threats, Cyberattacks & Vulnerabilities
Top Stories
-
News
14 Sep 2026
CISOs more confident -- and more stressed -- than ever
Security leaders are growing more confident in their abilities to withstand cyberattacks, yet the pressure on them continues to build. Proofpoint's latest survey of CISOs explains why. Continue Reading
-
News
11 Sep 2026
CISA Cyber Storm exercise offers blueprint for enterprise CISOs
The launch of CISA's Cyber Storm X puts national incident response to the test. For enterprise CISOs, the exercise serves as a practical model for evaluating supply-chain resilience and incident response playbooks under fire. Continue Reading
-
News
09 Feb 2023
Hypervisor patching struggles exacerbate ESXiArgs attacks
Ransomware hit a high number of unpatched VMware ESXi servers by exploiting two- and three-year-old flaws, which has put hypervisor patching difficulties in the spotlight. Continue Reading
-
News
09 Feb 2023
Thousands of victims apparently hit by ESXiArgs ransomware
A joint security advisory from CISA and the FBI said the ESXiArgs ransomware campaign has claimed over 3,800 servers globally since attacks first emerged last week. Continue Reading
-
Podcast
08 Feb 2023
ESXiArgs ransomware campaign raises concerns, questions
This Risk & Repeat podcast looks at the widespread ESXiArgs ransomware attacks and the questions they've raised about the threat landscape, vulnerability patching and more. Continue Reading
-
Definition
08 Feb 2023
reverse brute-force attack
A reverse brute-force attack is a type of brute-force attack in which an attacker uses a common password against multiple usernames in an attempt to gain access to a network. Continue Reading
-
News
06 Feb 2023
Vastaamo hacking suspect arrested in France
The suspect in the infamous cyber attack, Julius Kivimäki, is a 25-year-old Finnish man who was arrested after being remanded in absentia in October 2022. Continue Reading
-
News
06 Feb 2023
Widespread ransomware campaign targets VMware ESXi servers
The attacks exploited a two-year-old heap overflow vulnerability in VMware ESXi. Many questions remain about the scope of the campaign and the threat actor behind it. Continue Reading
-
News
02 Feb 2023
HeadCrab malware targets Redis to mine cryptocurrency
Aqua Security said the HeadCrab botnet has taken control of at least 1,200 servers via internet-facing instances of the opensource DBMS Redis and is using them for cryptomining. Continue Reading
-
News
02 Feb 2023
Ransomware attacks on public sector persist in January
Many of the attacks disclosed or reported in January occurred against the public sector, including multiple school districts that were hit within days of one another. Continue Reading
-
Tutorial
01 Feb 2023
How to use BeEF, the Browser Exploitation Framework
The open source BeEF pen testing tool can be used by red and blue teams alike to hook web browsers and use them as beachheads to launch further attacks. Continue Reading
-
Podcast
31 Jan 2023
Risk & Repeat: The FBI's Hive ransomware takedown
This podcast episode discusses the law enforcement operation that led to the infiltration and takedown of the Hive network and what it could mean for other ransomware gangs. Continue Reading
-
Definition
31 Jan 2023
Dridex malware
Dridex is a form of malware that targets victims' banking information, with the main goal of stealing online account credentials to gain access to their financial assets. Continue Reading
-
News
31 Jan 2023
Horizon3.ai releases POC exploit for VMware vulnerabilities
Penetration testing vendor Horizon3.ai published technical details and exploit code for three new CVEs in VMware vRealize Log Insight that can be chained for remote code execution. Continue Reading
-
News
26 Jan 2023
FBI hacked into Hive ransomware gang, disrupted operations
The FBI infiltrated Hive's network in July 2022 and obtained decryption keys, which it distributed to victims to prevent $130 million in ransom payments, according to the DOJ. Continue Reading
-
News
25 Jan 2023
Contractor error led to Baltimore schools ransomware attack
A security contractor for Baltimore County Public Schools mistakenly opened a suspicious phishing email attachment in an unsecure environment, leading to the ransomware attack. Continue Reading
-
Definition
24 Jan 2023
backdoor (computing)
A backdoor attack is a means to access a computer system or encrypted data that bypasses the system's customary security mechanisms. Continue Reading
-
News
19 Jan 2023
Chainalysis: Ransomware payments down, fewer victims paying
Ransomware payments dropped significantly this past year, falling more than 40% from 2021, according to new research from blockchain analysis firm Chainalysis. Continue Reading
-
Definition
19 Jan 2023
Heartbleed
Heartbleed was a vulnerability in some implementations of OpenSSL, an open source cryptographic library. Continue Reading
-
News
18 Jan 2023
Bitzlato cryptocurrency exchange founder arrested, charged
Russian national Anatoly Legkodymov is accused of using Bitzlato to process more than $700 million in illicit cryptocurrency transactions, including ransomware payments. Continue Reading
-
News
18 Jan 2023
LastPass faces mounting criticism over recent breach
LastPass disclosed a breach last month in which a threat actor stole personal customer information, including billing addresses and encrypted website login details. Continue Reading
-
News
12 Jan 2023
Windows zero day patched but exploitation activity unclear
Avast threat researchers detected exploitation of a Windows zero-day flaw in the wild, and organizations are being urged to patch the flaw immediately. Continue Reading
-
Podcast
10 Jan 2023
Risk & Repeat: Analyzing the Rackspace ransomware attack
This Risk & Repeat podcast episode discusses new details of the Rackspace ransomware attack, as well as the questions remaining following the company's final status update. Continue Reading
-
Tip
10 Jan 2023
How to prevent and detect lateral movement attacks
Reduce the success of lateral movement attacks by performing these eight key cybersecurity activities at strategic, operational and proactive levels. Continue Reading
-
News
06 Jan 2023
Rackspace: Ransomware actor accessed 27 customers' data
Rackspace said Personal Storage Tables of 27 customers were accessed in the attack last month, but added there was no evidence threat actors viewed, obtained or misused the data. Continue Reading
-
News
04 Jan 2023
Rackspace: Ransomware attack caused by zero-day exploit
The exploit that led to the Rackspace ransomware attack, referred to as OWASSRF, combines two Exchange Server flaws -- CVE-2022-41080 and a ProxyNotShell flaw, CVE-2022-41082. Continue Reading
-
News
04 Jan 2023
December ransomware disclosures reveal high-profile victims
Cloud provider Rackspace was just one of several major enterprises to suffer a ransomware attack, according to public disclosures and reports in December. Continue Reading
-
News
03 Jan 2023
Many Exchange servers still vulnerable to ProxyNotShell flaw
A new exploit chain using one of the ProxyNotShell vulnerabilities has bypassed Microsoft's URL Rewrite mitigations from September and put Exchange servers at risk. Continue Reading
-
News
21 Dec 2022
Play ransomware actors bypass ProxyNotShell mitigations
CrowdStrike is urging organizations to apply the latest Microsoft Exchange updates after investigations revealed attackers developed a bypass for ProxyNotShell mitigations. Continue Reading
-
Podcast
21 Dec 2022
Risk & Repeat: OT security progress, threats in 2022
This Risk & Repeat podcast episode discusses the current state of OT security, including the convergence with IT environments and an ever-evolving threat landscape. Continue Reading
-
News
20 Dec 2022
Malicious Python package in PyPI poses as SentinelOne SDK
No attacks resulting from the malicious Python package have been recorded to date. However, according to PyPI, more than 1,000 users had downloaded it before it was taken down. Continue Reading
-
News
20 Dec 2022
NCC Group: Ransomware attacks increased 41% in November
In addition to a month full of unexpected trends in both threat group activity and targeted sectors, NCC Group warned organizations to be aware of an increase in DDoS attacks. Continue Reading
-
Definition
16 Dec 2022
GPS jamming
GPS jamming is the act of using a frequency transmitting device to block or interfere with radio communications. Continue Reading
-
News
15 Dec 2022
Check Point classifies Azov as wiper, not ransomware
While Azov was initially considered ransomware, Check Point researchers warned the polymorphic malware is designed to inflict maximum damage to targeted systems. Continue Reading
-
News
14 Dec 2022
Cybereason warns of rapid increase in Royal ransomware
Enterprises need to be aware of the group's partial encryption technique because the less data it encrypts, the less chance the activity will be detected by a security product. Continue Reading
-
News
13 Dec 2022
Microsoft addresses two zero days in December Patch Tuesday
December's Patch Tuesday features fixes for 48 new bugs, including several critical vulnerabilities and two zero days, one of which is currently being exploited in the wild. Continue Reading
-
News
13 Dec 2022
Citrix ADC and Gateway zero day under active exploitation
The NSA said that APT5, a suspected Chinese nation-state threat group, is actively exploiting the Citrix zero-day flaw, which affects the vendor's ADC and Gateway products. Continue Reading
-
Podcast
08 Dec 2022
Risk & Repeat: Breaking down Rackspace ransomware attack
This Risk & Repeat podcast episode discusses the recent ransomware attack against cloud provider Rackspace, as well as the major service outage affecting its customers. Continue Reading
-
News
07 Dec 2022
Vice Society ransomware 'persistent threat' to education sector
New research from Palo Alto Networks supports recent government warnings that Vice Society poses an increased risk to K-12 schools and higher education. Continue Reading
-
News
06 Dec 2022
MegaRAC flaws, IP leak impact multiple server brands
MegaRAC BMC software from American Megatrends, Inc. have a trio of serious security vulnerabilities that were discovered following an intellectual property leak. Continue Reading
-
News
06 Dec 2022
Rackspace confirms ransomware attack after Exchange outages
The cloud service provider said that because the investigation of the ransomware attack is in the early stages, it is unknown what, if any, customer data was stolen. Continue Reading
-
News
05 Dec 2022
Education sector hit by Hive ransomware in November
The education sector remained a popular target last month, particularly from Hive, a ransomware-a-as-a-service group, that even warranted a government alert in late November. Continue Reading
-
News
05 Dec 2022
Rackspace 'security incident' causes Exchange Server outages
Rackspace has not said what caused the security incident, but the cloud provider said it proactively disconnected its Hosted Exchange offering as it investigates the matter. Continue Reading
-
Definition
05 Dec 2022
Evil Corp
Evil Corp is an international cybercrime network that uses malicious software to steal money from victims' bank accounts and to mount ransomware attacks. Continue Reading
-
Definition
02 Dec 2022
Trojan horse
In computing, a Trojan horse is a program downloaded and installed on a computer that appears harmless, but is, in fact, malicious. Continue Reading
-
News
02 Dec 2022
Experts argue 'sludge' could muck up cyber attacks
Network defenders can supplement their security postures with additional settings and policies that frustrate and discourage attackers, according to a new research paper. Continue Reading
-
News
01 Dec 2022
Archive files become preferred format for malware delivery
The team at HP Wolf Security found that cybercriminals are using archive files as the preferred method for spreading malware, beating Microsoft Office for the first time. Continue Reading
-
News
30 Nov 2022
Lockbit 3.0 has BlackMatter ransomware code, wormable traits
LockBit 3.0 or 'LockBit Black' includes anti-debugging capabilities, the ability to delete Volume Shadow Copy files and the potential ability to self-spread via legitimate tools. Continue Reading
-
News
30 Nov 2022
Exchange Server bugs caused years of security turmoil
The four high-profile sets of security vulnerabilities in Microsoft Exchange Server, disclosed by researcher Orange Tsai, are set to remain a major concern for organizations. Continue Reading
-
Podcast
30 Nov 2022
Risk & Repeat: Twitter, Elon Musk and security concerns
This podcast episode discusses Twitter's security concerns following Elon Musk's acquisition last month, as well as a possible data breach from 2021 that came to light recently. Continue Reading
-
News
30 Nov 2022
Tenable: 72% of organizations remain vulnerable to Log4Shell
New research shows the attack surface remains wide for the Log4j vulnerability, known as Log4Shell, which caused significant problems for organizations over the past year. Continue Reading
-
News
28 Nov 2022
Infosec researcher reports possible 'massive' Twitter breach
The alleged Twitter breach involves a data set from late 2021 and includes the phone numbers and personal information of millions of users in the U.S. and Europe. Continue Reading
-
News
23 Nov 2022
Cybereason warns of fast-moving Black Basta campaign
Threat actors with the Black Basta ransomware-as-a-service group are compromising networks in as little as one hour and stealing sensitive data before disabling DNS services. Continue Reading
-
News
22 Nov 2022
Google's new YARA rules fight malicious Cobalt Strike use
Google's YARA rules detect cracked versions of Cobalt Strike's older releases so that legitimate instances of the red teaming tool, which use the latest version, aren't targeted. Continue Reading
-
Definition
22 Nov 2022
buffer underflow
A buffer underflow, also known as a buffer underrun or a buffer underwrite, is when the buffer -- the temporary holding space during data transfer -- is fed data at a lower rate than it is being read from. Continue Reading
-
News
17 Nov 2022
Magecart malware menaces Magento merchants
Sansec researchers say as many as 38% of commercial customers running the Adobe Commerce and Magento platforms could be infected with Magecart's TrojanOrders malware. Continue Reading
-
News
17 Nov 2022
CISA: Iranian APT actors compromised federal network
CISA said Iranian nation-state actors exploited Log4Shell flaws on an unpatched VMware Horizon server before deploying a cryptominer and attempting to gain persistent access. Continue Reading
-
News
17 Nov 2022
LockBit ransomware activity nose-dived in October
LockBit, the most prolific ransomware group in 2022, had itself a down month as GuidePoint Security researchers reported a 49% decrease in its infections for October. Continue Reading
-
Podcast
16 Nov 2022
Risk & Repeat: Researchers criticize HackerOne
This podcast episode discusses a recent TechTarget Security article about bug bounty platform HackerOne in which researchers aired several complaints about the company. Continue Reading
-
News
16 Nov 2022
Rapid7 discloses more F5 BIG-IP vulnerabilities
While the severity of the issues is relatively low, F5 devices are commonly targeted by attackers to gain persistence inside a network. Continue Reading
-
News
14 Nov 2022
Moreno Valley school system shores up ransomware defenses
Moreno Valley Unified School District officials discuss the steps they've taken to better protect sensitive data and critical applications against the growing threat of ransomware. Continue Reading
-
News
10 Nov 2022
DOJ charges accused Lockbit ransomware actor
The U.S. Department of Justice filed criminal charges against a Canadian man with dual Russian citizenship who is accused of being part of the LockBit ransomware crew. Continue Reading
-
News
07 Nov 2022
Microsoft: Nation-state threats, zero-day attacks increasing
Microsoft's Digital Defense Report 2022 pointed the finger at China, which enacted a new vulnerability disclosure law last year, as the source of many zero-day attacks. Continue Reading
-
News
04 Nov 2022
Yanluowang ransomware gang goes dark after leaks
The Yanluowang ransomware operation appears to have shut down for the time being after an anonymous individual published a series of internal code and chat leaks. Continue Reading
-
News
03 Nov 2022
Ransomware on the rise, hitting schools and healthcare
October ransomware disclosures and public reports tracked by TechTarget Editorial increased from previous months, with notable attacks on education and healthcare organizations. Continue Reading
-
News
02 Nov 2022
U.S. Treasury: Ransomware attacks increased in 2021
A new report from the U.S. Treasury's Financial Crimes Enforcement Network showed an increase in businesses reporting ransomware attacks in the second half of 2021. Continue Reading
-
News
01 Nov 2022
OpenSSL vulnerabilities get high-priority patches
The OpenSSL Project released version 3.0.7 Tuesday to address a pair of high-severity buffer overflow vulnerabilities in the widely used cryptography library. Continue Reading
-
Tip
27 Oct 2022
Types of cloud malware and how to defend against them
Cloud malware isn't going away anytime soon, but organizations have a growing number of tools at their disposal to combat the threat. Continue Reading
-
News
26 Oct 2022
Ukraine: Russian cyber attacks aimless and opportunistic
Victor Zhora, a key Ukrainian cybersecurity official, says Russia is acting with "no particular strategy" in its cyber attacks on his country as their military invasion drags on. Continue Reading
-
News
26 Oct 2022
Cisco, CISA warn 2 AnyConnect flaws are under attack
CISA added two Cisco AnyConnect flaws to its Known Exploited Vulnerabilities catalog, which signals active exploitation and an urgency to patch. Continue Reading
-
News
26 Oct 2022
Researchers criticize HackerOne over triage, mediation woes
HackerOne researchers told TechTarget Editorial that they regularly encountered months-long wait times for responses and a mediation process that rarely favors researchers. Continue Reading
-
News
25 Oct 2022
Cryptomining campaign abused free GitHub account trials
Cloud security vendor Sysdig uncovered the largest cryptomining operation it's ever seen as threat actors used free account trials to shift the costs to service providers. Continue Reading
-
News
25 Oct 2022
Apple patches actively exploited zero-day iOS bug
The iOS zero-day was joined by a slew of other vulnerabilities in Apple's Oct. 24 security update. The iOS 16 update contained patches for 13 arbitrary code execution flaws. Continue Reading
-
News
24 Oct 2022
CISA warns of ransomware attacks on healthcare providers
A new CISA advisory warned administrators at hospitals and healthcare providers about newly discovered ransomware variant, dubbed Daixin Team, that poses a particular threat. Continue Reading
-
News
21 Oct 2022
BlackByte ransomware using custom data exfiltration tool
Symantec researchers say BlackByte ransomware may be poised to move into the elite ransomware ranks, as the group has begun developing its own custom malware tools. Continue Reading
-
News
20 Oct 2022
Brazil arrests alleged Lapsus$ hacker
Federal police in Brazil arrested a person accused of being a key member of the Lapsus$ hacking group on charges related to the takedown of government websites. Continue Reading
-
Definition
20 Oct 2022
RAT (remote access Trojan)
A RAT (remote access Trojan) is malware an attacker uses to gain full administrative privileges and remote control of a target computer. Continue Reading
-
News
19 Oct 2022
Azure vulnerability opens door to remote takeover attacks
Orca Security researchers uncovered a flaw in Azure Service Fabric that was fixed in last week's Patch Tuesday. It allows elevation of privilege and remote takeover of nodes. Continue Reading
-
News
18 Oct 2022
Python vulnerability highlights open source security woes
A 15-year-old unpatched vulnerability in a tarfile module for the Python programming language prompted researchers from cybersecurity vendor Trellix to take action. Continue Reading
-
Definition
18 Oct 2022
supply chain attack
A supply chain attack is a type of cyber attack that targets organizations by focusing on weaker links in an organization's supply chain. Continue Reading
-
News
13 Oct 2022
NPM API flaw exposes secret packages
A flaw in the API for NPM could potentially allow a threat actor to see the internal packages for corporate users -- a possible first step for a supply chain attack. Continue Reading
-
News
13 Oct 2022
Despite LockBit rebound, ransomware attacks down in 2022
LockBit cybercriminals are back in action with new ransomware attacks and publicity pushes. But many other new groups saw lower levels in activity in Q3, according to Cyberint. Continue Reading
-
News
11 Oct 2022
NPM malware attack goes unnoticed for a year
A cybercriminal crew known as "LofyGang" poisoned software supply chains with bad NPM packages for more than a year, according to Checkmarx researchers. Continue Reading
-
News
11 Oct 2022
Critical Fortinet vulnerability under active exploitation
Fortinet said the critical vulnerability affects three of its services -- FortiOS, FortiProxy and FortiSwitch Manager -- and urged customers to take immediate action. Continue Reading
-
Feature
11 Oct 2022
LinkedIn scams, fake Instagram accounts hit businesses, execs
Even the most secure business and executive social media accounts that have strong passwords and multifactor authentication are vulnerable to cloning schemes. Continue Reading
-
News
07 Oct 2022
CISA lists top vulnerabilities exploited by Chinese hackers
The U.S. government published a list of the most commonly exploited vulnerabilities exploited by Chinese state-sponsored actors, including Log4Shell and the ProxyLogon bugs. Continue Reading
-
News
05 Oct 2022
Ransomware attacks ravage schools, municipal governments
Attacks disclosed in September revealed that K-12 schools, universities and local governments continued to suffer at the hands of gangs such as Vice Society and BlackCat/Alphv. Continue Reading
-
News
03 Oct 2022
Intermittent encryption attacks: Who's at risk?
Threat analysts have observed some ransomware gangs using a new technique that only partially encrypts victims' files, which could evade some ransomware defenses. Continue Reading
-
News
30 Sep 2022
Microsoft Exchange Server targeted with zero-day vulnerabilities
Microsoft warned that two unpatched zero-day vulnerabilities are being exploited against Exchange Server, a problem that's causing déjà vu for some researchers. Continue Reading
-
News
29 Sep 2022
Cobalt Strike malware campaign targets job seekers
Cisco Talos researchers spotted a new wave of phishing attacks that target job seekers in the U.S. and New Zealand, infecting them with Cobalt Strike beacons. Continue Reading
-
News
29 Sep 2022
Unit 42 finds polyglot files delivering IcedID malware
Palo Alto Networks' Unit 42 says attackers are using decoy Microsoft Compiled HTML Help files containing multiple file formats to infect systems with information-stealing malware. Continue Reading
-
News
29 Sep 2022
Mandiant spots new malware targeting VMware ESXi hypervisors
Mandiant researchers said the backdoors were installed with a novel technique that used malicious vSphere Installation Bundles, though it's unclear how initial access was achieved. Continue Reading
-
News
28 Sep 2022
NCC Group: IceFire ransomware gang ramping up attacks
While the ransomware group was first observed in March, IceFire emerged on NCC Group's radar last month when attacks against English-speaking organizations soared. Continue Reading
-
News
23 Sep 2022
Malicious NPM package discovered in supply chain attack
Threat actors are circulating a look-alike version of the Material Tailwind NPM package to infect developers for supply chain malware attacks, according to ReversingLabs. Continue Reading
-
Podcast
23 Sep 2022
Risk & Repeat: Uber and Rockstar Games hacked
This podcast episode discusses recent hacks against Uber and Rockstar Games, the techniques of the attackers and the possible connection to the Lapsus$ cybercrime group. Continue Reading
-
News
22 Sep 2022
15-year-old Python vulnerability poses supply chain threat
Trellix researchers issued a call for help to patch a vulnerable software module, which was found in more than 300,000 open source GitHub repositories. Continue Reading
-
News
21 Sep 2022
Cobalt Strike gets emergency patch
The developer of Cobalt Strike issued an out-of-band security update to address a cross-site scripting vulnerability in the popular penetration testing suite. Continue Reading
-
News
19 Sep 2022
Uber says Lapsus$ hackers behind network breach
Uber said a hacker from the Lapsus$ group used stolen credentials from a contractor to gain access to several important silos within its internal network. Continue Reading
-
News
19 Sep 2022
Rockstar Games confirms hack after 'Grand Theft Auto' leak
A threat actor this weekend published in-development footage from a forthcoming 'Grand Theft Auto' video game and claimed to have breached its publisher, Rockstar Games. Continue Reading
-
News
16 Sep 2022
DOJ drops report on cryptocurrency crime efforts
The U.S. Department of Justice issued a report to President Biden on its various enforcement efforts around cybercrime and digital currency, as well as looming challenges. Continue Reading
-
Podcast
16 Sep 2022
Risk & Repeat: The White House wants secure software
This podcast episode discusses the implications of the Biden administration's new purchasing and usage guidelines for software utilized by U.S. federal agencies. Continue Reading
-
News
16 Sep 2022
Uber responds to possible breach following hacker taunts
Security researchers spotted suspicious activity on Uber's HackerOne page when the alleged hacker posted messages claiming they had compromised the ride-share company's network. Continue Reading