Find what you’re looking for
Browse everything
6,838 results in Threat Reports
Ransomware Surge Hits State & Local Agencies: Lessons from Nevada and St. Paul
In August 2024, both the State of Nevada and the City of St. Paul, Minnesota, experienced disruptive ransomware attacks that resulted in significant outages and data theft. Attackers exploited gaps in cybersecurity readiness and funding reductions to compromise critical municipal systems, leading to the shutdown of public services and exfiltration of sensitive information. Incident response efforts included engagement with federal agencies like the FBI and CISA, although full recovery remained ongoing for several weeks and required costly investigations, with losses projected to reach $17 million for St. Paul alone. These incidents illustrate the rising threat to smaller government entities, exacerbated by declining federal cybersecurity resources. The sophistication and operational impact of ransomware attacks continue to increase, underscoring urgent calls for improved resilience, incident response planning, and investment in cyber hygiene—especially amid tightening budgets and evolving threat tactics.
How Salt Typhoon & Volt Typhoon Forced a U.S. Critical Infrastructure Cybersecurity Rethink
Between 2021 and 2023, advanced Chinese threat actors known as Salt Typhoon and Volt Typhoon conducted highly covert cyber intrusions targeting U.S. telecommunications networks and critical infrastructure sectors. These groups utilized advanced tactics such as "living off the land," abusing legitimate administrative tools, and blending into east-west network traffic, making detection and remediation extremely challenging for defenders. Their primary objectives ranged from long-term espionage and persistent access to prepositioning for potential disruptive attacks in the event of geopolitical conflict. The hacks led federal agencies like the FBI and CISA to revise investigative methods, shifting to assume attackers may already be inside the network and forcing collaboration to uncover subtle anomalies rather than clear indicators. This incident is indicative of a broader industry trend: state-backed actors increasingly focus on stealth, cloud environments, and edge devices, targeting managed service providers and exploiting blind spots in monitoring. Their evolving tactics closely align with growing regulatory and CISO concern for stronger east-west visibility, zero trust controls, and continuous threat hunting across hybrid cloud infrastructure.
npm Supply-Chain Attack Exposes Open-Source Dependencies: 2024 Incident Analysis
In June 2024, a supply-chain attack struck the widely used npm ecosystem when a threat actor compromised developer Josh Junon's account via a phishing-enabled two-factor reset. The attacker injected malicious code into 18 high-download open-source JavaScript packages, including 'ansi-styles', 'chalk', and 'debug', targeting cryptocurrency transactions. Although the incident caused significant alarm due to the downloads’ reach (>2 billion/week), rapid detection by the open-source community and immediate takedown by npm limited the impact. The injected packages were removed within hours, and the attacker ultimately stole just over $1,000 in cryptocurrency. This incident highlights the growing sophistication of supply-chain and social engineering attacks on open-source platforms. As attackers target developer credentials and critical project maintainers, organizations face renewed urgency to reassess their software supply chain controls and dependency management.
KazMunayGas Penetration Test Mistaken for Russian Cyberattack: Lessons From a Simulated Incident
In early 2024, Kazakhstan's largest oil company, KazMunayGas, was mistakenly believed to have suffered a cyberattack attributed to a Russian Advanced Persistent Threat (APT) group using a compromised employee email account. Initial reports claimed that attackers breached internal systems, raising alarm over possible business disruption and data compromise. However, after internal review, the company clarified the activity was actually part of an authorized penetration testing exercise, not a malicious breach, and no operational impact or data loss occurred. This incident comes amid heightened concern about cyberthreats targeting energy companies, particularly in regions where geopolitical tensions and state-sponsored actors are active. It demonstrates the confusion that can arise when security drills mimic genuine adversary tactics, highlighting the necessity for robust communication around cybersecurity validation activities.
Microsoft Patch Tuesday 2025: Patch Critical Privilege Escalation Flaws Now
In September 2025, Microsoft released patches addressing 81 vulnerabilities across enterprise products and core Windows systems. No vulnerabilities were detected as actively exploited, but experts cautioned that several critical and high-severity flaws could become prime targets. Notably, CVE-2025-55232 (CVSS 9.8) enables unauthenticated code execution on Microsoft High Performance Compute Pack installations. Critical elevation of privilege issues, such as CVE-2025-54918 (Windows NTLM) and CVE-2025-55234 (Windows SMB), expose organizations to potential lateral movement, ransomware, and large-scale data exfiltration risks if not remediated. This incident underscores the growing urgency of rapid patch cycles as attacker interest in privilege escalation and lateral movement techniques surges. With threat actors leveraging unpatched vulnerabilities for ransomware and data theft, organizations must bolster detection and enforcement around privilege-oriented exploits.
How Outdated Encryption in Microsoft Defaults Enabled the 2024 Ascension Ransomware Attack
In February 2024, Ascension, one of the largest healthcare organizations in the United States, suffered a massive ransomware attack linked to longstanding encryption flaws in Microsoft’s default configurations. Attackers infiltrated Ascension’s network via a phishing email opened by a contractor on a company laptop using default Microsoft Edge and Bing settings. Exploiting weak encryption (RC4) and leveraging the Kerberoasting technique on Microsoft Active Directory, the ransomware group rapidly gained administrative privileges and deployed malware across the organization’s systems. This breach compromised sensitive data belonging to over 5.6 million patients, including personal, medical, payment, insurance, and government identification records, and severely disrupted business operations.
2025 Hacktivist-APT Clusters Target Russian and European Infrastructure Amid Geopolitical Conflict
In early 2025, a major escalation of geopolitical cyberattacks saw interconnected clusters of pro-Ukrainian hacktivists and APT (Advanced Persistent Threat) groups targeting Russian, Eastern European, and select international organizations. Leveraging shared infrastructure, signature malware suites, and coordinated TTPs, these groups executed multi-faceted campaigns resulting in widespread service disruption, data theft, and leakage of sensitive government and business information. The attackers demonstrated a blend of hacktivist objectives and financial motivation, as ransom demands and destructive attacks coincided with public data leaks and targeted espionage. This incident highlights a growing trend of collaboration between politically and financially driven cybercriminals, with evolving TTPs that cross traditional threat boundaries. Organizations in both conflict and non-conflict regions face heightened operational risk as techniques from these campaigns proliferate globally.
Global NPM Phishing Breach Exposes Billions to Supply Chain Malware
In September 2023, threat actors compromised the NPM account of Qix, a well-known developer, through a phishing attack and used the access to publish malicious updates to 18 highly popular open-source packages. These tainted packages, which collectively garnered over 2 billion weekly downloads, included 'ansi-styles', 'debug', 'chalk', and 'supports-color'. The inserted malware aimed to steal cryptocurrency by tampering with API calls and redirecting wallet transactions. The attack window was brief—about two hours—before the breach was discovered, the malicious versions withdrawn, and further spread prevented. While technical fallout was limited and the attackers profited minimally, the incident exposed significant vulnerabilities in the open-source software ecosystem and generated substantial remediation efforts globally. This episode highlights urgent risks inherent in software supply chains and the dependency of modern development on a small number of package maintainers. Public attention to supply chain defense, rapid incident response, and robust dependency vetting is rising as organizations face the reality of widespread reliance on community-maintained resources.
Microsoft September 2025 Patch Tuesday: Spotlight on Network Privilege Escalation Flaws
On September 2025, Microsoft released security patches addressing over 80 vulnerabilities across Windows products, including 13 rated as 'critical.' Notably, CVE-2025-54918, a vulnerability in Windows NTLM authentication, allows attackers with network access and credential knowledge to elevate privileges to SYSTEM level remotely. Another disclosed vulnerability, CVE-2025-55234 in the SMB client, is also remotely exploitable and could result in code execution through replay attacks. Alongside these, the update addressed an NTFS remote code execution flaw (CVE-2025-54916) that, although not network-exploitable, poses significant risk via social engineering vectors. This Patch Tuesday illustrates a continued shift in attacker focus towards privilege escalation and lateral network movement within enterprise environments. Escalating regulatory scrutiny and rising advanced persistent threats reinforce the urgency of timely patching and integrated security controls for both external and east-west traffic.
U.S. Indicts Ukrainian Ransomware Operator Behind Hundreds of Global Attacks
In June 2024, the U.S. Department of Justice indicted Volodymyr Tymoshchuk, a Ukrainian national linked to the development and deployment of the Nefilim, LockerGoga, and MegaCortex ransomware variants. Operating under aliases such as 'deadforz' and 'farnetwork,' Tymoshchuk and his co-conspirators targeted organizations—including healthcare, industrial, and blue-chip companies—across the U.S., Europe, and Australia from at least 2018 onward. Over 250 U.S. and hundreds of global victims experienced encrypted systems, data theft, and significant operational disruption, resulting in tens of millions of dollars in damages attributed to ransom payments, mitigation, and recovery costs. This indictment underscores increasing law enforcement cooperation and heightened government focus on disrupting ransomware-as-a-service ecosystems. The ongoing campaign and associated public rewards for information highlight how ransomware actors continue evolving tactics, targeting high-revenue organizations and leveraging affiliate networks to scale global extortion operations.
Meta's WhatsApp Security Lapses: Insider Risks and Lessons for Compliance in 2025
In April 2025, Meta (parent company of WhatsApp) faced legal action from a former security manager, Attaullah Baig, who alleged that systemic cybersecurity and privacy failures were ignored within WhatsApp. Baig claimed that a Red Team exercise revealed approximately 1,500 engineers had unrestricted access to sensitive user data, with no audit trails, logging, or adequate operational controls, violating regulatory requirements and a 2020 FTC consent order. Baig raised alarms about deficiencies—such as lack of data inventory, improper data access controls, and insufficient security staffing—which he asserts led to retaliatory actions and his eventual dismissal under the pretense of poor performance. This high-profile lawsuit underscores urgent concerns about insider risk, weak internal security policy enforcement, and regulatory noncompliance in large tech platforms. As regulators increase scrutiny and whistleblowers continue to come forward, enterprises must address internal blind spots and strengthen controls to prevent privilege misuse and data exposure.
Microsoft 2025 Zero-Day Patch Tuesday: SMB & SQL Server Vulnerabilities Fixed
In September 2025, Microsoft addressed 81 security flaws in its monthly Patch Tuesday, including two significant zero-day vulnerabilities—one impacting the Windows SMB Server (CVE-2025-55234) and another affecting Microsoft SQL Server through the Newtonsoft.Json library (CVE-2024-21907). The SMB Server flaw enabled attackers to perform relay attacks that could escalate user privileges, while the SQL Server vulnerability allowed unauthenticated remote attackers to trigger denial of service conditions. These flaws were publicly disclosed prior to the release and posed a heightened risk, as threat actors could exploit them before organizations applied the necessary patches. The broad spectrum of vulnerabilities underscores potential exposure across a wide range of Microsoft products and services. This incident exemplifies the urgent need for organizations to keep patch management processes rigorous and up-to-date. The increasing sophistication of attacker TTPs and the frequency of zero-day exploitation have positioned timely security updates as a frontline defense against data compromise and operational disruption.