Summary: Since June 2022, the hacking group UNC1549, potentially connected to Tortoiseshell (aka Imperial Kitten) and linked with the Iranian IRGC, has implemented distinct backdoors known as MiniBike and MiniBus. Their primary focus lies in targeting defense-related entities in the Middle East. Threat Level – …

Summary: Cyber threat actors have been exploiting vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways, including CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893, which allow them to bypass authentication and execute arbitrary commands with elevated privileges. Despite Ivanti’s mitigation efforts, threat actors persist, emphasizing the need …

Summary: The SPIKEDWINE threat actor has been identified orchestrating a sophisticated cyber operation targeting European Union diplomats with a deceptive wine-tasting event. Its primary goal is to disrupt geopolitical relations between India and Europe through the deployment of a modular backdoor named WINELOADER. Threat Level – Amber …

Summary: Blackcat, a sophisticated Ransomware-as-a-Service operation, infiltrates networks using advanced social engineering and remote access tools, offering triple extortion tactics and cyber remediation advice for ransom payment, and resurged after a December 2023 disruption, causing widespread disruptions in U.S pharmacies. Threat Level – Red | …

Summary: The Xeno RAT, a remote access trojan (RAT) available on GitHub, has gained attention in the threat landscape due to its open-source nature. This C#-based malware is compatible with both Windows 10 and 11, specifically targeting consumers by presenting itself as disguised binaries that masquerade as …

Summary: Doppelgänger, a suspected Russia-aligned influence operation network targeting German audiences with propaganda and disinformation, potentially aiming to sway opinions ahead of elections. Doppelgänger employs coordinated social media activities and a dynamic infrastructure to maximize its impact and evade detection. Threat Level – Amber | …

Summary: Abyss Locker ransomware surfaced in July 2023, deriving from the HelloKitty ransomware source code, indicating a lineage predating its official release. Similar to other ransomware variants, Abyss Locker infiltrates corporate networks, exfiltrates data for extortion, and encrypts devices, posing a considerable threat to both Linux and …

Summary: LockBit ransomware, previously known as “ABCD,” remains a significant threat despite the recent takedown of its operations by global law enforcement. It reemerged within 4 days and its Affiliates were found exploiting vulnerabilities in ScreenConnect to install LockBit ransomware and deploy other malware. This underscores Lockbit’s …