Find what you’re looking for
Browse everything
6,892 results in Threat Reports
Surge in Automated Opportunistic Scanning Campaigns in 2026
In late January 2026, a coordinated automated scanning campaign targeted web servers globally, probing for exposed sensitive files such as compressed backups and database dumps. This activity, characterized by rapid, systematic requests, was detected by multiple honeypots worldwide, indicating a widespread and synchronized effort to exploit misconfigured or vulnerable web services. The surge in scanning activity underscores the persistent threat posed by opportunistic attackers leveraging automation to identify and exploit weaknesses in internet-facing systems. Organizations must prioritize secure configurations, continuous monitoring, and proactive defense strategies to mitigate the risks associated with such automated attacks.
Critical Vulnerability in Tauri Framework's Shell Plugin Leads to Remote Code Execution
In April 2025, a critical vulnerability (CVE-2025-31477) was identified in the Tauri framework's shell plugin, which is used for building cross-platform desktop applications. This flaw allowed unregulated access to system shell operations, enabling attackers to execute arbitrary code on affected systems. The vulnerability stemmed from improper validation of allowed protocols in the plugin's 'open' endpoint, permitting potentially dangerous protocols like 'file://', 'smb://', and 'nfs://'. Exploitation required either direct exposure of the endpoint to application users or code execution within the frontend of a Tauri application. The issue was addressed in version 2.2.1 of the plugin. ([github.com](https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-c9pr-q8gx-3mgp?utm_source=openai)) This incident underscores the importance of rigorous input validation and protocol handling in application development. As frameworks like Tauri gain popularity for their efficiency in building cross-platform applications, ensuring the security of their components becomes paramount. Developers are urged to promptly update to patched versions and adhere to best practices in secure coding to mitigate such vulnerabilities.
BadeSaba Calendar App Hack: A New Front in Cyber Warfare
In late February 2026, during coordinated military strikes by the United States and Israel on Iranian targets, the BadeSaba Calendar app—a widely used prayer-timing application with over 5 million downloads—was compromised. Users received push notifications in Persian urging military personnel and civilians to defect, lay down arms, or join opposition forces. Messages included phrases such as "Help has arrived" and "It's time for reckoning." This cyber operation coincided with physical airstrikes and resulted in a near-total internet blackout in Iran, disrupting government communications, state media, and public services. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Cyberwarfare_during_the_2026_Iran_war?utm_source=openai)) This incident underscores the evolving landscape of cyber warfare, where digital platforms are exploited to disseminate psychological operations alongside kinetic military actions. The strategic use of a trusted religious app to deliver propaganda highlights the need for robust cybersecurity measures, especially for applications with significant user bases in geopolitically sensitive regions.
Unveiling the 2025 Salesloft Drift Supply Chain Attack: Implications and Lessons
In August 2025, a significant supply chain attack targeted the Salesloft Drift AI chatbot integration, compromising OAuth tokens and affecting over 700 organizations, including Cloudflare, Palo Alto Networks, and Zscaler. Attackers exploited these tokens to gain unauthorized access to Salesforce instances, exfiltrating sensitive data such as AWS access keys and passwords. The breach originated from a compromised Salesloft GitHub account, accessed between March and June 2025, allowing attackers to manipulate repositories and establish malicious workflows. This incident underscores the critical vulnerabilities present in third-party integrations and the necessity for stringent security measures in interconnected systems. The attack highlights the growing trend of cybercriminals leveraging trusted platforms to infiltrate organizations, emphasizing the need for enhanced monitoring and control over third-party services.
LeakBase 2026: Global Law Enforcement Takedown of Major Cybercrime Forum
In early March 2026, an international coalition of law enforcement agencies from 14 countries, including the United States, executed a coordinated operation to dismantle LeakBase, one of the world's largest cybercrime forums. LeakBase, active since 2021, had over 142,000 registered members and hosted extensive archives of stolen data, including hundreds of millions of account credentials, credit card numbers, and sensitive personal information. The operation involved seizing the forum's domains, arresting multiple individuals, and collecting substantial evidence, effectively disrupting a major hub for cybercriminal activities. ([justice.gov](https://www.justice.gov/opa/pr/united-states-leads-dismantlement-one-worlds-largest-hacker-forums?utm_source=openai)) This takedown underscores the escalating global efforts to combat cybercrime and the increasing collaboration among international law enforcement agencies. The operation serves as a stark reminder of the persistent threat posed by online platforms that facilitate the trade of stolen data and hacking tools, highlighting the need for continuous vigilance and proactive measures in cybersecurity. ([justice.gov](https://www.justice.gov/opa/pr/united-states-leads-dismantlement-one-worlds-largest-hacker-forums?utm_source=openai))
Global Takedown of Tycoon 2FA Phishing Platform in 2026
In March 2026, a global coalition led by Microsoft and Europol dismantled Tycoon 2FA, a phishing-as-a-service platform active since August 2023. This service enabled cybercriminals to bypass multifactor authentication (MFA) using adversary-in-the-middle techniques, facilitating unauthorized access to services like Microsoft 365 and Gmail. The operation resulted in the seizure of 330 domains integral to Tycoon 2FA's infrastructure, disrupting a platform responsible for tens of millions of phishing emails monthly and affecting over 500,000 organizations worldwide. The takedown underscores the evolving sophistication of phishing threats and the critical need for robust cybersecurity measures. Despite the disruption, the incident highlights the persistent vulnerabilities in MFA implementations and the necessity for continuous vigilance and adaptation in security protocols to counteract emerging threats.
Unveiling a Ransomware Network Through Brute Force Attack Analysis
In March 2026, the Huntress Tactical Response Team investigated a routine brute-force alert on an exposed Remote Desktop Protocol (RDP) server. This led to the discovery of a successful login from multiple IP addresses, indicating a coordinated attack. Further analysis revealed the attackers' unusual behavior of manually searching for credentials within files, deviating from typical automated methods. This investigation uncovered a geo-distributed infrastructure and a suspicious VPN service, suggesting a sophisticated ransomware-as-a-service operation facilitated by initial access brokers. This incident underscores the evolving tactics of ransomware operators, highlighting the importance of vigilant monitoring and comprehensive security measures. The attackers' manual credential-hunting approach and the use of distributed infrastructure reflect a shift towards more targeted and persistent threats, necessitating adaptive defense strategies.
Global Operation Dismantles Tycoon2FA Phishing Platform
In March 2026, a coordinated international operation led by Europol and Microsoft successfully dismantled Tycoon2FA, a prominent phishing-as-a-service (PhaaS) platform active since August 2023. Tycoon2FA enabled cybercriminals to bypass multi-factor authentication (MFA) by intercepting live authentication sessions, capturing credentials, one-time passcodes, and session cookies in real time. This service was responsible for tens of millions of phishing emails each month, targeting over 500,000 organizations globally, including schools, hospitals, and public institutions. The takedown involved seizing 330 domains that formed the platform's core infrastructure, significantly disrupting its operations and mitigating further harm. ([blogs.microsoft.com](https://blogs.microsoft.com/on-the-issues/2026/03/04/how-a-global-coalition-disrupted-tycoon/?utm_source=openai)) The dismantling of Tycoon2FA underscores the evolving sophistication of cyber threats, particularly the commoditization of tools that facilitate large-scale MFA bypass attacks. This incident highlights the critical need for organizations to adopt phishing-resistant authentication mechanisms and enhance their cybersecurity posture to defend against such advanced threats. ([newsroom.trendmicro.com](https://newsroom.trendmicro.com/2026-03-04-TrendAI-TM-Helps-Drive-Global-Takedown-of-Tycoon-2FA-MFA-Bypass-Phishing-Service?utm_source=openai))
UMMC's 2026 Ransomware Attack: A Wake-Up Call for Healthcare Cybersecurity
In February 2026, the University of Mississippi Medical Center (UMMC) experienced a significant ransomware attack attributed to the Medusa ransomware group. The attack led to the closure of 35 clinics and the cancellation of elective procedures, severely disrupting healthcare services. UMMC's electronic health record system and communication networks were compromised, necessitating a shift to manual operations. The medical center collaborated with federal authorities, including the FBI, to investigate and mitigate the attack. After nine days, UMMC restored its systems and resumed normal operations. ([nationaltoday.com](https://nationaltoday.com/us/ms/jackson/news/2026/03/04/ummc-resumes-operations-after-ransomware-attack/?utm_source=openai)) This incident underscores the escalating threat of ransomware attacks targeting critical infrastructure, particularly in the healthcare sector. The Medusa group's double extortion tactics, involving data encryption and threats to release sensitive information, highlight the urgent need for robust cybersecurity measures to protect patient data and ensure uninterrupted medical services. ([aha.org](https://www.aha.org/news/headline/2025-03-14-advisory-warns-medusa-ransomware-activity?utm_source=openai))
HungerRush Faces 2026 Customer Data Extortion Threat
In early March 2026, customers of restaurants utilizing the HungerRush point-of-sale (POS) platform reported receiving extortion emails from a threat actor. The emails warned that both restaurant and customer data would be exposed if HungerRush did not comply with the attacker's demands. HungerRush, a provider of restaurant technology solutions, serves over 16,000 establishments, including notable chains like Sbarro and Jet's Pizza. The attacker initiated the campaign by sending emails from support@hungerrush.com, urging the company to address the extortion threats to prevent potential data exposure. This incident underscores the evolving tactics of cybercriminals, who are now directly targeting end-users to pressure service providers. The approach not only threatens customer trust but also highlights the critical need for robust cybersecurity measures and rapid incident response protocols within the restaurant technology sector.
FBI Dismantles LeakBase Cybercrime Forum in Coordinated International Operation
In early March 2026, the FBI, in collaboration with international law enforcement agencies, dismantled LeakBase, a major cybercriminal forum with over 142,000 members. LeakBase facilitated the trade of stolen data and hacking tools, hosting an extensive archive of compromised databases containing hundreds of millions of account credentials. The coordinated operation, known as 'Operation Leak,' involved synchronized actions across 14 countries, including domain seizures, arrests, and evidence collection. This takedown underscores the escalating global efforts to combat cybercrime networks and disrupt platforms that enable the proliferation of stolen data and cyberattack tools. The seizure of LeakBase serves as a stark warning to cybercriminals about the increasing reach and effectiveness of international law enforcement collaborations.
Coruna iOS Exploit Kit: A 2025 Cybersecurity Threat Analysis
In 2025, the Coruna iOS exploit kit emerged as a sophisticated tool targeting iPhone users across multiple campaigns. Initially identified in February 2025, it was deployed by a surveillance vendor's customer. By summer, the same exploit kit was utilized by the Russian espionage group UNC6353 in watering hole attacks on Ukrainian websites. Later in the year, the financially motivated Chinese threat actor UNC6691 employed Coruna to compromise fake Chinese gambling and cryptocurrency sites. The kit comprises 23 exploits forming five full exploit chains, affecting iOS versions 13.0 through 17.2.1. These exploits enable remote code execution, sandbox escapes, and kernel privilege escalation, leading to unauthorized access and data exfiltration. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/spyware-grade-coruna-ios-exploit-kit-now-used-in-crypto-theft-attacks/?utm_source=openai)) The proliferation of Coruna underscores a concerning trend: advanced exploit kits, possibly originating from state-sponsored entities, are increasingly accessible to a broader range of threat actors. This shift highlights the urgent need for organizations to stay vigilant, update their systems promptly, and implement robust security measures to mitigate the risks posed by such sophisticated tools. ([wired.com](https://www.wired.com/story/coruna-iphone-hacking-toolkit-us-government/?utm_source=openai))