Find what you’re looking for
Browse everything
6,854 results in Threat Reports
OpenAI’s Sora 2 Release Fuels New Deepfake Security Risks in 2024
In late 2024, OpenAI released Sora 2, a powerful AI-powered video generation model, without the robust guardrails needed to prevent deepfake abuse. Within weeks, numerous instances emerged of Sora 2 being used to create convincing disinformation, impersonate public figures, and generate unmoderated content, despite minimal or easily removable watermarking. The lack of initial safeguards—such as restrictions on political figures or copyrighted content—and insufficient content provenance led to viral circulation of malicious deepfakes and nonconsensual depictions, raising significant operational, reputational, and regulatory risks for both OpenAI and affected individuals. This incident highlights a critical phase in AI/ML risk management: rapid technology advancement is outpacing the establishment and enforcement of ethical and technical controls. Growing regulatory and societal scrutiny underscores the need for defensible guardrails, provenance tracking, and collaborative risk governance to address the threats posed by generative AI deepfakes.
Google Takes Legal Aim at Lighthouse Smishing Syndicate in 2024
In June 2024, Google initiated a civil lawsuit targeting the perpetrators of the 'Lighthouse' phishing-as-a-service operation, believed to be managed by individuals based in China. These actors used large-scale SMS phishing (smishing) campaigns, often spoofing Google and other trusted brands, to lure victims into divulging personal and financial information by clicking fraudulent links. Over a short period, the attackers deployed hundreds of thousands of fake sites and reportedly victimized more than one million people worldwide, resulting in significant financial losses and the compromise of millions of payment cards—primarily in the United States. The group’s abuse of Google’s trademarks also led the company to seek legal and technical disruption measures, including the removal of malicious domains. This case illustrates the growing impact and reach of phishing-as-a-service kits, which democratize sophisticated techniques for broader criminal use. The prevalence of smishing, coupled with international threat actor networks, reinforces the need for proactive legal and technical responses, as well as multi-stakeholder legislative and public awareness initiatives.
Amazon Detects APT Group Exploiting Cisco & Citrix Zero-Days in 2024
In summer 2024, Amazon’s threat intelligence team identified that an advanced persistent threat (APT) group exploited zero-day vulnerabilities in Cisco Identity Services Engine (CVE-2025-20337) and Citrix NetScaler (CVE-2025-5777), months before official patches were released. The attackers leveraged custom malware with advanced evasion capabilities, demonstrating a deep understanding of enterprise Java and network edge products. Exploitation was detected as early as May, prior to vendor disclosure, allowing the threat actor prolonged access to target environments for likely espionage purposes. Massive exploitation attempts followed public disclosure, impacting thousands of organizations globally. This incident underscores the increased speed and sophistication with which threat groups are identifying and weaponizing zero-day vulnerabilities in critical network and identity infrastructure. The trend poses escalating risks for organizations relying on edge devices, making timely patching and layered defenses more crucial than ever.
Operation Endgame 2024: Global Law Enforcement Strikes Down Major Malware Networks
In November 2024, a coalition of law enforcement agencies from 11 countries coordinated Operation Endgame, a major crackdown disrupting some of the most prolific malware networks globally. The operation targeted Rhadamanthys infostealer, VenomRAT remote access trojan, and the Elysium botnet—malware that collectively infected hundreds of thousands of computers and enabled the theft of millions of credentials. Authorities arrested the principal VenomRAT suspect in Greece, searched 11 sites across Europe, and dismantled more than 1,000 criminal servers and 20 illicit domains. With assistance from 30-plus cybersecurity companies, the operation also notified thousands of victims and exposed users of these illicit services, mitigating ongoing criminal campaigns. Operation Endgame underscores the rapidly evolving, cross-border nature of malware infrastructure and the growing need for coordinated responses by both public and private sectors. As attackers innovate and leverage distributed networks to evade law enforcement, regular collaborative enforcement actions and heightened detection capability are now critical to cybersecurity defenses worldwide.
Rhadamanthys Infostealer Brought Down: Lessons from a Major Malware Disruption
In June 2024, law enforcement and security vendors successfully disrupted the Rhadamanthys infostealer operation, a prominent 'malware-as-a-service' offering used by cybercriminals to harvest sensitive data from infected devices. The takedown resulted in many malware operators reporting loss of access to their command-and-control servers, crippling active campaigns and rendering stolen data inaccessible. This disruption impacted both the malware's customers and the broader illicit ecosystem that depended on Rhadamanthys for credential theft, data exfiltration, and distribution of stolen information for financial gain. The incident highlights growing law enforcement coordination targeting infostealer infrastructure and criminal-as-a-service marketplaces. As infostealers proliferate with new evasion methods, their disruption remains a critical priority for organizations and defenders seeking to reduce exposure to credential theft and secondary breaches.
Synnovis 2024 Ransomware Breach: UK Healthcare Services and Patient Data Exposed
In June 2024, Synnovis, a leading UK pathology services provider, suffered a significant ransomware attack that led to operational disruption and the exposure of sensitive patient data. The attack, attributed to Russian-speaking threat actor group Qilin, resulted in widespread IT outages across London hospitals, delaying critical healthcare procedures and temporarily halting diagnostic services. Investigations revealed that attackers were able to steal files containing patient information before encrypting core systems, underscoring the vulnerability of healthcare organizations to ransomware campaigns targeting their critical infrastructure. This incident is emblematic of a surge in highly targeted ransomware attacks against the healthcare sector globally. With a marked increase in double-extortion tactics and operationally disruptive attacks, this event highlights escalating cyber risk, increasing regulatory oversight, and the urgent need for robust cyber-resilience in healthcare.
Citrix & Cisco Face 2025 Zero-Day Onslaught: Custom Malware Targets Network Cores
In early 2025, a sophisticated threat actor leveraged zero-day vulnerabilities—CVE-2025-5777 ('Citrix Bleed 2') in NetScaler ADC/Gateway and CVE-2025-20337 in Cisco Identity Services Engine (ISE)—to gain initial access into targeted enterprise environments. Exploiting these flaws before vendor patches were available, attackers deployed custom malware to establish persistent command-and-control and facilitate lateral movement, affecting sensitive east-west and outbound network traffic. The advanced nature of this attack enabled the evasion of traditional security controls, resulting in unauthorized access to confidential data and business operations disruptions. This breach highlights a critical evolution in adversary tradecraft: coordinated and simultaneous exploitation of zero-day flaws in widely deployed network infrastructure. With threat actors increasingly chaining vulnerabilities to maximize impact, proactive threat detection and effective segmentation are more essential than ever for organizations seeking resilience against such rapid exploitation campaigns.
DanaBot Returns: Windows Banking Trojan Resurges After Global Takedown
In early 2024, the notorious DanaBot banking Trojan resurfaced after a six-month hiatus following major international law enforcement crackdowns under Operation Endgame in May 2023. This new version targets Windows systems through phishing campaigns, using malicious email attachments to gain initial access. Once deployed, DanaBot leverages modular capabilities for credential theft, lateral movement, and potential data exfiltration, threatening organizations and individuals with financial losses and malware proliferation. The resurgence highlights the continuously evolving tactics of threat actors in the financial malware ecosystem despite decisive takedown efforts. DanaBot's return signals the persistent threat posed by adaptive malware campaigns, with attackers quickly retooling to evade detection and capitalize on lapses in endpoint security. This incident stresses the importance of modern inbound threat detection measures and rapid response to evolving banking malware tactics.
Google Sues to Dismantle Chinese 'Lighthouse' Phishing Platform Orchestrating US Toll Scams
In June 2024, Google filed a lawsuit to dismantle the 'Lighthouse' phishing-as-a-service (PhaaS) platform operated out of China. Lighthouse enabled global cybercriminals to launch large-scale SMS phishing campaigns, targeting U.S. residents by impersonating the U.S. Postal Service and E-ZPass toll systems. Attackers used automated infrastructure to send convincing text messages, directing victims to fraudulent sites designed to steal credit card and personal information. The campaign resulted in substantial financial losses for consumers and posed major operational risks to U.S. businesses and government agencies. This incident underscores the growing sophistication and accessibility of phishing-as-a-service offerings. With such turnkey solutions readily available on the dark web, attackers are able to scale campaigns with minimal technical skill, escalating both the frequency and severity of credential theft and fraud worldwide.
2025 Microsoft Kernel Zero-Day: Privilege Escalation Risks & Response
In November 2025, Microsoft disclosed and patched 63 security flaws across its platforms, including a Windows Kernel zero-day vulnerability (CVE-2025-XXXX) that was exploited in the wild prior to the update. Attackers leveraged this privilege escalation flaw to gain elevated access on targeted devices, enabling them to bypass security controls, move laterally, and potentially deploy additional malicious payloads. While the majority of these vulnerabilities were rated as important, four—including the actively exploited zero-day—were rated critical, underlining the heightened risk for organizations that were slow to apply updates. The prompt response in releasing patches aimed to minimize further exploitation and potential operational disruptions for Microsoft enterprise customers globally. This incident highlights increasing attacker focus on privilege escalation flaws within widely-used platforms, particularly those with a large installed base like Windows. The ongoing exploitation of zero-days demonstrates the urgency of timely patch management, robust endpoint defenses, and threat detection as adversaries accelerate the weaponization of newly discovered vulnerabilities.
Amazon Discovers Zero-Day Exploits Targeting Cisco and Citrix Appliances
In October 2025, Amazon's threat intelligence division uncovered an advanced cyberattack that targeted undisclosed zero-day vulnerabilities in Cisco Identity Services Engine (ISE) and Citrix NetScaler ADC appliances. The attackers leveraged these flaws to gain privileged access within victim environments, deploying tailor-made malware to compromise critical identity and network infrastructure. By exploiting trusted network appliances, the threat actor bypassed conventional perimeter security, enabled persistent lateral movement, and threatened both operational continuity and data confidentiality for affected organizations. This incident underscores a growing shift in attacker tactics, with a strategic focus on exploiting zero-days in widely deployed network infrastructure. It highlights rising concerns about supply chain risks, the increasing sophistication of threat actors, and an urgent need for proactive detection and patch management across enterprise environments.
Critical Infrastructure Active Directory Breach Highlights the Need for Zero Trust Controls
In October 2025, a coordinated threat campaign targeted the Active Directory environment of a major North American critical infrastructure provider. Attackers exploited vulnerabilities in legacy on-premises and misconfigured cloud authentication bridges to gain initial access, leveraging unencrypted internal traffic and credential harvesting tools. By establishing persistence inside hybrid systems, they used lateral movement techniques to escalate privileges, eventually exfiltrating sensitive operational and personal data. The attack briefly disrupted authentication services, causing operational outages and impacting supply chain partners reliant on secure access. Regulators and cyber response teams were engaged, intensifying scrutiny of infrastructure identity security. This incident underscores how attackers increasingly target hybrid and cloud-integrated identity platforms like Active Directory, exploiting gaps in east-west traffic security and multifactor enforcement. As ransomware and nation-state campaigns leverage similar methods, the urgency for zero trust segmentation, encrypted traffic, and strong policy enforcement within hybrid infrastructure has never been greater.