Find what you’re looking for
Browse everything
6,844 results in Threat Reports
Critical Cisco SD-WAN Manager Vulnerability Enables Complete Network Takeover
In September 2026, Cisco disclosed active exploitation of CVE-2026-76504, a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager with a CVSS score of 9.8. The flaw allows remote attackers to use the Manager's API with administrator privileges without any credentials by exploiting URI encoding mishandling in HTTP requests. Attackers can bypass authentication rules and gain full control over SD-WAN networks, particularly targeting internet-exposed Manager instances. The vulnerability affects the core network infrastructure management system used by enterprises to control their Cisco SD-WAN deployments. This incident highlights the increasing sophistication of network infrastructure attacks and the critical importance of securing management interfaces. As organizations accelerate SD-WAN adoption for hybrid cloud connectivity, vulnerabilities in centralized management systems represent high-value targets that can compromise entire network architectures.
Critical Zilliz Attu Vulnerabilities Enable Kubernetes Namespace Takeover
In 2024, Bishop Fox security researchers discovered two critical vulnerabilities in Zilliz Attu version 2.6.5, a popular management interface for Milvus vector databases. The vulnerabilities included missing authentication controls that allowed unauthenticated request proxying and a regex bypass that defeated private IP address blocking mechanisms. When chained together, these flaws enabled complete Kubernetes namespace takeover in cloud deployments, potentially exposing sensitive vector database operations and stored embeddings. The vendor released patches in version 3.0.0 following responsible disclosure. This incident highlights the growing attack surface of AI infrastructure components as organizations rapidly deploy vector databases and machine learning pipelines without adequate security controls, making proper authentication and network segmentation critical for protecting AI workloads.
MSP360 RMM Phishing Campaign Deploys ScreenConnect for Persistent Access
In July 2026, Microsoft Defender Experts observed sophisticated phishing campaigns targeting multiple industries that distributed legitimate MSP360 Remote Monitoring and Management (RMM) software under deceptive filenames. Threat actors used social engineering themes including meeting invitations, PDF updates, and software installation prompts to trick victims into executing the masqueraded installer. Once deployed, the MSP360 RMM established persistent access and was used to download and install ConnectWise ScreenConnect, creating redundant remote access channels for credential harvesting, information collection, and follow-on malicious activities. This incident highlights the growing trend of threat actors abusing legitimate remote administration tools to blend into normal IT operations while maintaining persistent access. As organizations increasingly rely on remote management solutions, attackers are exploiting the inherent trust and broad privileges these tools possess to evade detection and establish durable footholds in enterprise environments.
CVE-2026-73570 Exploitation: Defending Against Zimbra Command Injection Attacks
Microsoft Threat Intelligence identified exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in Zimbra Collaboration Suite's SNMP notification path. Between July 2026 and August 2026, threat actors exploited internet-facing Zimbra mail servers through crafted SMTP requests, achieving initial access without authentication. The attacks involved JSP web shell deployment, privilege escalation through PAM configuration manipulation, credential harvesting of Zimbra authentication secrets, and attempted exfiltration of mailbox data using cloud storage tools. Multiple organizations across different regions and industries were compromised, with attackers demonstrating both automated payload delivery and hands-on-keyboard operations. This incident highlights the growing trend of attackers targeting mail server infrastructure as a gateway for enterprise compromise, particularly exploiting command injection vulnerabilities in widely deployed collaboration platforms before patches are broadly applied.
Major Cybercrime Takedown: ShinyHunters Leader Arrested in International Operation
Dutch authorities arrested 24-year-old Pepjin van der Stap in Amsterdam, identified as an alleged leader of the notorious ShinyHunters cybercrime group. The arrest occurred shortly before ShinyHunters claimed responsibility for breaching FBI systems and stealing sensitive data on federal agents. Since 2024, van der Stap and his co-conspirators allegedly compromised over 140 organizations, extracting at least $70 million in extortion payments by targeting third-party vendors and cloud platforms, then threatening to publish stolen sensitive data. The FBI stated this represents a major breakthrough in their ongoing investigation into one of the most prolific cybercrime groups currently operating, with seized evidence potentially leading to additional arrests of ShinyHunters members. This arrest highlights the escalating global law enforcement response to ransomware and extortion groups, particularly those exploiting cloud infrastructure vulnerabilities and supply chain weaknesses to maximize organizational impact.
State Actors Exploited Citrix NetScaler Zero-Days for Three Weeks Undetected
In September 2024, advanced persistent threat actors, suspected to be state-sponsored, exploited two critical zero-day vulnerabilities (CVE-2026-88772 and CVE-2026-88771) in Citrix NetScaler appliances for over three weeks before detection. The attacks began on September 3rd and remained undetected until late September, compromising dozens of organizations across government, financial services, education, telecom, and professional services sectors in North America and Europe. Attackers deployed novel tunneler malware, conducted internal reconnaissance, performed credential theft, and exfiltrated sensitive data through sophisticated lateral movement techniques. This incident highlights the growing trend of threat actors targeting edge devices and security appliances, which accounted for 48% of enterprise zero-day attacks in 2023. The extended dwell time and lack of endpoint detection capabilities on these devices create significant blind spots for defenders.
Iranian Cyberattacks on US Water Utilities Expose Critical Infrastructure Vulnerabilities
Throughout summer 2024, water utilities across the United States faced a sustained campaign of cyberattacks primarily attributed to Iranian threat actors, targeting internet-exposed operational technology (OT) systems and programmable logic controllers (PLCs). The attacks exploited aging infrastructure built for durability rather than cybersecurity, with attackers gaining initial access through exposed OT systems, vulnerable PLCs, and compromised integrator connections. The incidents prompted the Water Information Sharing and Analysis Center (WaterISAC) to accelerate threat intelligence sharing and partner with Cyware to enhance sector-wide cyber defense capabilities. These attacks underscore the growing threat to critical infrastructure as nation-state actors increasingly target industrial control systems amid escalating global tensions. The incidents highlight the vulnerability of legacy OT environments and demonstrate how threat actors are exploiting the convergence of IT and OT networks to compromise essential services.
Star Blizzard Scales Espionage Operations with RedFlick Malware Campaign
In 2026, Russian FSB-affiliated threat group Star Blizzard significantly expanded their espionage operations, shifting from targeted spear-phishing to large-scale automated phishing campaigns using novel RedFlick malware. The group launched at least 13 distinct campaigns targeting over 100 organizations primarily in the US and UK, including Ukrainian entities, NGOs, think tanks, and government organizations supporting Ukraine. RedFlick's streamlined infection flow requires only a single user interaction and deploys the CosmicPulse backdoor through scheduled tasks to evade detection. This tactical evolution demonstrates how state-sponsored actors are adapting to increase operational scale and success rates while maintaining stealth capabilities for long-term intelligence collection against geopolitically significant targets.
Apple Patches Critical CoreGraphics Zero-Day Used in Sophisticated Mobile Attacks
Apple patched a critical zero-day vulnerability (CVE-2026-86950) in CoreGraphics that was actively exploited in highly sophisticated targeted attacks against iOS users. The out-of-bounds write flaw, discovered by Meta Product Security, affected multiple Apple device generations and could lead to arbitrary code execution when processing maliciously crafted files. Apple confirmed the vulnerability was exploited in extremely sophisticated attacks against specific individuals on iOS versions prior to iOS 27, prompting immediate security updates across iOS, iPadOS, macOS, watchOS, and tvOS platforms. This incident highlights the continued evolution of nation-state and advanced persistent threat actors targeting mobile platforms with zero-day exploits, reflecting the growing sophistication of mobile device attacks and the critical need for rapid patch deployment in enterprise environments.
Kiteworks Emergency Response: Lessons from a Federal Cybersecurity Warning
In September 2026, Kiteworks (formerly Accellion) issued a precautionary advisory asking customers to shut down their systems after federal intelligence authorities warned of a potentially imminent cyberattack targeting a critical vulnerability in their Private Content Network platform. The company, which serves thousands of global corporations and government agencies with over 100 million end-users, quickly patched the unnamed critical flaw affecting less than 1% of customers and restored all hosted systems within 48 hours. No evidence of compromise or suspicious activity was detected during the shutdown period. This incident highlights the ongoing targeting of enterprise file-sharing platforms by cybercriminals, particularly given Kiteworks' history with the Clop ransomware gang's exploitation of their legacy FTA software in 2021, which resulted in breaches affecting hundreds of high-profile organizations including cybersecurity firms, energy companies, and government agencies.
Vietnamese Cybercriminal Charged in $16 Million Pig Butchering Cryptocurrency Scam
A Vietnamese national, Trung Nguyen Van, was arrested at the US-Mexico border and charged with money laundering for his role in a massive pig butchering cryptocurrency scam that defrauded victims of over $16 million. Van operated between February 2018 and December 2024, with his crypto wallets receiving approximately $53 million from wire fraud schemes targeting US citizens. The scammer used a fake investment platform called 'Triangle' to lure victims into transferring cryptocurrency, which was then moved to private, unhosted wallets off centralized blockchain networks, making recovery nearly impossible. This case highlights the growing sophistication of cryptocurrency-based social engineering attacks, which accounted for $8.6 billion in losses in 2025 according to FBI reports. As pig butchering scams increasingly target high-net-worth individuals through social media and dating platforms, organizations face heightened risks from both direct targeting and employee victimization that could compromise corporate assets.
The DIVD AI Agent Attack: When Machines Hack Autonomously
In September 2026, the Dutch Institute for Vulnerability Disclosure (DIVD) suffered an unprecedented AI-driven cyberattack that marked a new evolution in autonomous threat capabilities. The attack began with exploitation of an undisclosed technical vulnerability, followed by deployment of an automated AI agent that conducted post-exploitation activities independently. The AI agent operated autonomously across DIVD's network, making real-time decisions at machine speed while leaving behind extensive evidence due to poor training and configuration. The attack was described as 'loud and very messy' with the agent interfering with its own operations and over-documenting its activities. This incident represents a critical inflection point as threat actors increasingly weaponize AI for autonomous network operations, demonstrating how machine-speed attacks can overwhelm traditional detection and response capabilities while creating new categories of unpredictable adversarial behavior.