Palo Alto Networks Unit 42 documented a campaign called Blinder Tunnel that targeted Iraq’s critical infrastructure sector through a fake Dubai Airports recruitment process. The attack delivered a trojanized Microsoft Visual Studio project that executed malware when opened—before the victim compiled or ran any code. The campaign is a clear example of how trusted developer […]
WindRose Health Network just disclosed a data breach affecting 33,000 patients. The details are still emerging, but the pattern is familiar: protected health information compromised, HIPAA notifications sent, and an organization left explaining to patients how their medical records ended up in the wrong hands. Healthcare breaches follow a predictable attack chain. A scumbag gets […]
The Attack: Legitimate Tools, Malicious Intent Microsoft’s Security Research team disclosed a phishing campaign in September 2026 that weaponized MSP360 Remote Monitoring and Management software. Attackers distributed digitally signed MSP360 installers disguised as meeting invitations, PDF readers, Zoom setups, and government documents. File names included: The installers were hosted on attacker infrastructure and legitimate cloud […]
The Problem: Backup Advice Assumes the Attack Already Succeeded Fox News published a helpful guide on protecting family photos and important documents from ransomware. The advice is sound: maintain 3-2-1 backups, use strong passwords, disconnect external drives when not in use, and avoid suspicious email attachments. But all of that advice operates on a fundamental […]
Spanish authorities arrested a 16-year-old suspected of running KillSec, a ransomware operation responsible for approximately 1,000 attacks worldwide since 2024. The group operated a double-extortion model: break into victim networks, steal data, encrypt files, then threaten to publish stolen information unless a ransom was paid. Operation KillSwitch, coordinated by Europol across multiple countries, seized five […]
Securonix recently published research on TASK#STOMP, a Windows intrusion framework that combines VBScript, PowerShell, scheduled tasks, and runtime C# compilation to steal business documents and maintain persistent remote access. The attack is clever — it uses legitimate Windows components, creates fake task names that look like system services, and even timestamps its artifacts to appear […]
Zscaler’s ThreatLabz 2026 Ransomware Report documents a 275% increase in ransomware data theft, with attackers exfiltrating 896.2 terabytes of data — equivalent to 90 times the print collection at the Library of Congress. The report highlights a strategic shift: ransomware groups are moving away from file encryption toward data theft and extortion, targeting privileged users, […]
Microsoft recently disclosed NeedyMantis, a previously unidentified malware framework deployed by a China-based threat actor against telecommunications companies, universities, medical organizations, and government agencies. The framework provided long-term access to compromised networks — exactly the kind of sophisticated, persistent threat that keeps CISOs awake at night. But here’s what the security industry doesn’t talk about […]
The Attack: Stealth Through Complexity Point Wild’s analysis of BotHelper RAT reveals a sophisticated multi-stage infection chain designed specifically to evade detection. A native x64 stager profiles the host, disables TLS certificate validation, downloads an encrypted payload from a remote URL, and decrypts it entirely in memory to avoid disk-based detection tools. Once decrypted, the […]
The Attack: Remote Access Disguised as Legitimate Software Attackers created fake desktop applications impersonating three major US payroll platforms that have never released desktop software. The lure pages, built with an AI app builder and hosted on Vercel behind bot-challenge screens, offered downloads that appeared to be official payroll management tools. The payload was a […]