The Attack: Payloads Hidden in Plain Sight Microsoft’s Threat Intelligence team just documented a new ClickFix variant that’s more clever than most. Instead of downloading a malicious payload when the victim runs the “fix” command, the attackers pre-cache the payload in the browser — disguised as a PNG file — then trick the user into […]
The Problem: Boards See the Explosion, Not the Fuse Terrell Cox, Microsoft’s deputy CISO, points out something that should make every hospital IT leader uncomfortable: ransomware briefings delivered to boards typically start at the moment files get encrypted. By that point, the attack is over. The scumbag has already won. The encryption event — the […]
Palo Alto Networks Unit 42 documented a campaign called Blinder Tunnel that targeted Iraq’s critical infrastructure sector through a fake Dubai Airports recruitment process. The attack delivered a trojanized Microsoft Visual Studio project that executed malware when opened—before the victim compiled or ran any code. The campaign is a clear example of how trusted developer […]
WindRose Health Network just disclosed a data breach affecting 33,000 patients. The details are still emerging, but the pattern is familiar: protected health information compromised, HIPAA notifications sent, and an organization left explaining to patients how their medical records ended up in the wrong hands. Healthcare breaches follow a predictable attack chain. A scumbag gets […]
The Attack: Legitimate Tools, Malicious Intent Microsoft’s Security Research team disclosed a phishing campaign in September 2026 that weaponized MSP360 Remote Monitoring and Management software. Attackers distributed digitally signed MSP360 installers disguised as meeting invitations, PDF readers, Zoom setups, and government documents. File names included: The installers were hosted on attacker infrastructure and legitimate cloud […]
The Problem: Backup Advice Assumes the Attack Already Succeeded Fox News published a helpful guide on protecting family photos and important documents from ransomware. The advice is sound: maintain 3-2-1 backups, use strong passwords, disconnect external drives when not in use, and avoid suspicious email attachments. But all of that advice operates on a fundamental […]
Spanish authorities arrested a 16-year-old suspected of running KillSec, a ransomware operation responsible for approximately 1,000 attacks worldwide since 2024. The group operated a double-extortion model: break into victim networks, steal data, encrypt files, then threaten to publish stolen information unless a ransom was paid. Operation KillSwitch, coordinated by Europol across multiple countries, seized five […]
Securonix recently published research on TASK#STOMP, a Windows intrusion framework that combines VBScript, PowerShell, scheduled tasks, and runtime C# compilation to steal business documents and maintain persistent remote access. The attack is clever — it uses legitimate Windows components, creates fake task names that look like system services, and even timestamps its artifacts to appear […]
Zscaler’s ThreatLabz 2026 Ransomware Report documents a 275% increase in ransomware data theft, with attackers exfiltrating 896.2 terabytes of data — equivalent to 90 times the print collection at the Library of Congress. The report highlights a strategic shift: ransomware groups are moving away from file encryption toward data theft and extortion, targeting privileged users, […]
Microsoft recently disclosed NeedyMantis, a previously unidentified malware framework deployed by a China-based threat actor against telecommunications companies, universities, medical organizations, and government agencies. The framework provided long-term access to compromised networks — exactly the kind of sophisticated, persistent threat that keeps CISOs awake at night. But here’s what the security industry doesn’t talk about […]