The DragonForce ransomware group has emerged as a significant threat, operating since December 2023 under a sophisticated Ransomware-as-a-Service (RaaS) model. Branding itself as a “cartel,” the group has aggressively expanded its influence, attracting a wide network of affiliates and distinguishing its operations within the cybercrime landscape. This evolving entity has…

Operational Relay Box (ORB) networks are an emerging cybersecurity threat, allowing threat actors to obscure their malicious activities by using compromised Internet-of-Things (IoT) devices, Small Office/Home Office (SOHO) routers, and Virtual Private Servers (VPS). These sophisticated mesh networks create a significant challenge for cybersecurity professionals, making it exceedingly difficult to…

North Korea-linked hackers are leveraging Google’s generative AI model, Gemini, to streamline cyber espionage operations. This development signifies a new frontier in the weaponization of artificial intelligence by state-sponsored threat actors, allowing for accelerated reconnaissance and campaign planning. The trend highlights the growing sophistication of cyber attacks as malicious groups…

Amazon Web Services (AWS) has announced a significant advancement in digital security with the widespread rollout of its passwordless login solutions. This move aims to eliminate traditional password vulnerabilities and create a more unified and secure online experience for millions of users. The initiative, which has been in development for…

A critical vulnerability within the WPvivid Backup & Migration WordPress plugin has exposed approximately 800,000 websites to high-risk remote code execution (RCE) attacks. This severe security flaw, identified as CVE-2026-1357 and rated with a CVSS score of 9.8 (Critical), allows unauthenticated attackers to upload arbitrary files and execute commands directly…

Cybersecurity researchers have identified a sophisticated, multi-pronged attack campaign orchestrated by the North Korea-linked Lazarus Group, targeting developers through malicious packages on both the npm and Python Package Index (PyPI) repositories. This operation, codenamed “graphalgo” after its initial npm package, has been active since at least May 2025, leveraging fake…

A sophisticated cyberattack in September 2025 exploited a rogue virtual machine within a VMware vSphere environment, granting attackers entry and enabling significant data theft. Investigators linked this breach with high confidence to the threat group Muddled Libra, also known as Scattered Spider and UNC3944. This incident highlights a critical vulnerability…

Feiniu (fnOS) Network Attached Storage (NAS) devices are currently under a large-scale botnet attack, with the Netdragon malware exploiting unpatched vulnerabilities to infect an estimated 1,500 devices. This campaign, observed since October 2024, specifically targets storage infrastructure, moving beyond opportunistic infections to compromise high-value hardware. The attackers gain access by…

A sophisticated malware campaign has infiltrated the NPM package registry, with the malicious package named “duer-js” discovered by JFrog Security Research. This dangerous threat poses a significant risk to developers and Windows users, as it actively distributes the “Bada Stealer” malware. Despite its relatively low download count, the package employs…

Attackers Embrace Familiar Tactics in Evolving Threat Landscape This week’s threat landscape reveals a clear trend: attackers are doubling down on proven methods, leveraging trusted tools and overlooked vulnerabilities rather than seeking novel exploits. This “if it ain’t broke, don’t fix it” mentality is reshaping the cybersecurity battlefield, with initial…

The notorious Lazarus Group, a state-sponsored hacking collective linked to North Korea, has initiated a sophisticated new cyberespionage campaign dubbed “Graphalgo.” This operation employs a cunning fake recruiter scheme to target cryptocurrency and blockchain developers, leveraging trusted code repositories like GitHub, npm, and PyPI as conduits for malware distribution. The…

LummaStealer, a notorious information-stealing malware, has resurfaced with a new and concerning distribution tactic: fake CAPTCHA verification pages. This resurgence follows a significant law enforcement disruption in 2025, indicating the malware’s persistent threat to cybersecurity. The shift away from traditional exploit kits towards aggressive social engineering campaigns, particularly the “ClickFix”…