Find what you’re looking for
Browse everything
6,838 results in Threat Reports
Chinese APT Group Abuses VMware Privilege Escalation Flaw Throughout 2023
In 2023, sophisticated threat actors attributed to China exploited a previously unknown privilege-escalation vulnerability in VMware platforms for nearly a year before its discovery. Attackers leveraged this flaw, which appeared benign, to gain persistent and stealthy access to targeted virtual infrastructure. Their methods enabled lateral movement, data gathering, and privileged actions within highly segmented data center and cloud environments, affecting a broad range of organizations relying on virtualization for critical workloads. The long-term nature of the operation underscores challenges in detecting nation-state activity exploiting zero-day and privilege-related weaknesses. This incident highlights a broader escalation in advanced persistent threat (APT) campaigns targeting cloud and virtualization layers. As attackers increasingly exploit such integral software stacks with subtle techniques, organizations must reevaluate network segmentation, privilege management, and continuous monitoring to remain resilient.
Klopatra: The Stealth Android Banking Trojan Draining European Accounts Overnight
In mid-2024, the Klopatra Android banking Trojan emerged as a major threat to mobile users in Italy and Spain. Disguised as the popular but illicit Mobdro streaming app, the malware leveraged social engineering tactics to trick users into granting dangerous Accessibility permissions. Once installed, Klopatra used advanced obfuscation, anti-analysis techniques, and commercial packers to avoid detection. Attackers remotely took control of compromised devices while users slept, using stolen credentials and simulated taps to access and empty bank accounts through a series of stealthy transfers—all while remaining undetected until victims discovered their losses in the morning. The Klopatra incident underscores a rising trend in real-time, remote-controlled mobile banking fraud, combining overlays, credential theft, and session manipulation. As attackers continue targeting mobile banking, organizations and end-users must adapt defenses to evolving TTPs and maintain vigilance toward app sideloading.
China APT Launches Fileless, Precision Attack in 2024: Lateral Movement and Cloud Risk
In early 2024, an advanced persistent threat (APT) group dubbed 'Phantom Taurus,' believed to be affiliated with China, executed a sophisticated cyberattack targeting large enterprises in the finance and technology sectors. The attackers leveraged an in-memory, fileless backdoor ('IIServerCore') on Microsoft Windows servers to evade traditional detection, exploiting east-west traffic within cloud and hybrid environments. Initial access was likely gained through phishing and exploitation of public-facing applications, enabling lateral movement and persistent foothold. Impact included disruption of business operations, potential data exfiltration, and internal system compromise, with detection hampered by the backdoor's stealth techniques and encrypted command and control channels. This incident underscores an increasing trend of nation-state actors employing fileless malware and leveraging deep Windows system knowledge to bypass endpoint and network defenses. The use of advanced lateral movement tactics and persistent, in-memory attack tools highlights ongoing gaps in east-west cloud visibility and the urgency for zero trust segmentation across enterprise environments.
Windows 10 EOL: The Mass Enterprise Vulnerability Surge of 2024
In October 2024, Windows 10—widely used across enterprise networks—will reach end-of-life, ceasing to receive security patches from Microsoft. This event will instantly triple the number of unsupported operating systems found within business environments, dramatically expanding the global attack surface. Cybercriminals are expected to exploit these 'undead' or unpatched devices by leveraging known vulnerabilities, conducting packet sniffing, lateral movement, and data exfiltration attacks—especially against organizations with poor segmentation and lacking egress enforcement. This shift is particularly significant as attackers increasingly target infrastructure vulnerabilities and exploit legacy systems. The upcoming EOL is driving regulatory attention and sparking urgent reviews of segmentation, east-west security, and encrypted traffic controls in enterprise risk postures.
Breaking Confidential Computing: 2024 Hardware Attack Reveals Hidden Risks
In early 2024, cybersecurity researchers demonstrated a major hardware vulnerability impacting modern Intel and AMD processors' confidential computing features. Using a low-cost, hardware-based "battering RAM" side-channel attack, the team was able to extract sensitive data from memory that is meant to be encrypted and protected even during active use. The exploit bypasses both software and hardware encryption of data in use, undermining key assumptions of secure enclave technologies widely deployed in cloud and enterprise environments. This proof-of-concept exposes clients to risks of data theft or tampering, especially in multitenant or shared infrastructure. This incident underscores a growing trend of sophisticated hardware exploitation that threatens cloud workloads employing confidential computing for compliance and security. With confidential computing adoption rising across regulated industries, vulnerabilities at the silicon level present urgent business and regulatory risks, especially as attackers adapt to target trusted execution environments.
TOTOLINK X6000R Routers: 2025 Vulnerabilities Uncovered in Edge Devices
In June 2025, three new critical vulnerabilities (CVE-2025-52905, CVE-2025-52906, CVE-2025-52907) were discovered in TOTOLINK X6000R routers by Palo Alto Networks' Unit 42 researchers. These flaws exposed the devices to remote code execution and unauthorized access, potentially allowing attackers to gain persistent control over affected networks. The vulnerabilities stem from insecure input validation, weak authentication mechanics, and flaws in firmware that could be exploited over the internet. Immediate patching and network segmentation were recommended to prevent exploitation while vendor mitigation efforts commenced. This incident highlights ongoing risks to consumer and small business gateway devices, demonstrating how router vulnerabilities remain a rich attack surface for cyber actors. The event underscores the urgency for continuous vulnerability research, robust patch management, and defense-in-depth to counter the accelerating trend of targeting edge and IoT devices.
Phantom Taurus: China-Linked Espionage Group Infiltrates Diplomatic Targets with Undetected Malware
In early 2024, Palo Alto Networks' Unit 42 uncovered a newly confirmed China-linked espionage group, dubbed Phantom Taurus, employing advanced stealth techniques and novel malware to infiltrate nearly a dozen high-value targets in the Middle East, Africa, and Asia. The group relied on exploiting unpatched, internet-facing devices to gain initial access before deploying a custom malware suite designed for in-memory execution and deep evasion, allowing them to establish persistent access and exfiltrate sensitive diplomatic and governmental data over periods stretching up to two years. While Phantom Taurus shares some infrastructure traits with other Chinese threat actors, its custom tooling, extended operational security, and unique tactics distinguish it from other known groups, and it remains active with recent campaigns expanding to new regions. This incident highlights an escalation in the sophistication and reach of nation-state cyber espionage. The emergence of Phantom Taurus signals a growing trend of attackers prioritizing stealth and long-term intelligence gathering, making it more difficult for organizations to detect and respond to breaches within high-value sectors.
Broadcom Patches VMware NSX Flaws Flagged by NSA: What It Means for Cloud Security in 2024
In June 2024, Broadcom addressed two high-severity vulnerabilities in VMware NSX, originally discovered and reported by the U.S. National Security Agency (NSA). The flaws—tracked as CVE-2024-22246 (Local Privilege Escalation) and CVE-2024-22247 (Authentication Bypass)—could allow attackers to escalate privileges or bypass security controls on affected VMware NSX deployments. No evidence of exploitation in the wild has been reported, but these vulnerabilities could have enabled threat actors to move laterally, evade segmentation, and compromise critical virtualized environments if left unpatched. This disclosure comes amid heightened scrutiny of virtualization platforms used in cloud and hybrid infrastructures. As state actors increasingly target foundational cloud technologies and security researchers identify complex flaws, enterprises are pressed to maintain rapid patch cycles and review dependency trust, especially for technologies underpinning multi-cloud architectures.
CISA: Critical Linux Sudo Vulnerability (CVE-2025-32463) Now Under Active Attack
In September 2025, cybersecurity authorities, including CISA, issued urgent warnings regarding a critical privilege escalation vulnerability (CVE-2025-32463) in the Linux sudo package. Attackers exploited this flaw to execute arbitrary commands with root-level privileges using the -R (--chroot) option even if the user was not listed in the sudoers file. The vulnerability, present in sudo versions 1.9.14 to 1.9.17 and discovered by Rich Mirch of Stratascale, went public with a proof-of-concept exploit shortly after its disclosure, facilitating active exploitation globally. Federal agencies were given a strict deadline to apply mitigations due to confirmed in-the-wild attacks. This incident underscores the persistent threat of privilege escalation in foundational system components and the risks posed by quickly weaponized exploits. The urgency reflects both the ease of exploitation and the wide adoption of vulnerable Linux versions, making rapid patching a critical imperative for organizations.
Chinese APT UNC5174 Exploits VMware Zero-Day for Widespread Privilege Escalation
In October 2024, Chinese state-sponsored group UNC5174 began exploiting a zero-day vulnerability (CVE-2025-41244) affecting VMware Aria Operations and VMware Tools, enabling privilege escalation from unprivileged users to root on targeted virtual machines. The flaw, present in both credential-based and credential-less modes, allowed attackers to plant malicious binaries, gain root access, and ultimately compromise internal systems. This attack appears to be part of a wider campaign, with UNC5174 known for targeting critical infrastructure and selling access to compromised entities globally. Broadcom, which owns VMware, patched the vulnerability in September 2025 following an investigation by NVISO and Mandiant, but the exploit was active for nearly a year prior to disclosure. This incident underscores the increasing frequency of sophisticated supply chain and virtualization platform attacks by well-resourced APTs, especially those linked to state interests. Security teams should be alert to the persistence of zero-day exploitation and trends in privilege escalation across hybrid and cloud infrastructure.
Critical Remote Code Execution Vulnerability in WD My Cloud Devices Raises Security Stakes
In June 2024, Western Digital disclosed a critical security vulnerability in its My Cloud NAS devices, allowing unauthenticated remote attackers to execute arbitrary system commands via specially crafted HTTP requests. The exploited flaw, identified as CVE-2024-23333, affects multiple My Cloud firmware versions, exposing data and device functionality to full compromise. Western Digital released urgent firmware patches following the discovery, and no widespread exploitation was reported at the time of disclosure. However, researchers highlighted that remotely exploitable flaws in NAS devices pose significant risk for both individual and enterprise users who rely on these systems for data backup and storage. This incident underscores the growing prevalence of remote code execution vulnerabilities targeting storage infrastructure, particularly as attackers increase focus on internet-exposed edge devices. With data privacy regulations tightening and threat actors refining exploit automation, prompt patching and network segmentation are more critical than ever to prevent lateral movement and data exfiltration.
Cisco Firewall Vulnerabilities: Nearly 50,000 Devices at Immediate Risk from Active Zero-Day Attacks
In September 2025, nearly 50,000 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) firewalls exposed to the public internet were found to be vulnerable to two critical zero-day flaws: CVE-2025-20333 and CVE-2025-20362. These vulnerabilities enabled remote, unauthenticated attackers to execute arbitrary code and access restricted VPN-related endpoints. Ongoing exploitation began before patches became available, targeting government and enterprise networks worldwide. Threat actors deployed custom malware (Line Viper) and a GRUB bootkit (RayInitiator), prompting emergency directives from agencies like CISA for immediate patching and device removal, especially for unsupported hardware. The lack of effective patch management and delayed response increased risk of network breaches, lateral movement, and data exfiltration. This incident underscores the persistent threat of infrastructure vulnerabilities and rapid weaponization of zero-day flaws targeting critical networking equipment. With attackers increasingly automating reconnaissance and exploitation, organizations face mounting regulatory and business pressure to maintain timely patching, robust monitoring, and segmented security controls.