Mandiant

A Chinese state-sponsored hacking group, identified as TA419, has been actively impersonating artificial intelligence experts to infiltrate and gather intelligence from United States policy circles. This sophisticated operation, detailed in a report by Mandiant, involved creating fake personas and leveraging…

The Russian state-sponsored hacking group identified as Star Blizzard has been observed employing a novel malware installation technique, which cybersecurity researchers have dubbed "RedFlick." This tactic is specifically used to deploy the group's signature backdoor, known as CosmicPulse.

A novel Windows malware, identified as ClosedQuorum, has emerged, employing multiple artificial intelligence models to autonomously make decisions during the post-compromise phases of cyberattacks. This sophisticated malware utilizes large language models (LLMs) to analyze the compromised environment and determine…

Google's Threat Intelligence Group successfully infiltrated the notorious supply-chain hacking gang known as TeamPCP, an operation that provided critical inside intelligence during the group's extensive malware campaign. This infiltration allowed Google to monitor the hackers' activities, warn potential targets…

Autonomous AI agents are increasingly being leveraged to close the significant gap between the rapid discovery of new vulnerabilities and the time it takes for organizations to patch them, according to a new free guide for Chief Information Security Officers…

Mandiant reported on March 13, 2024, that an attacker successfully hijacked an active AI coding assistant session at an unnamed software-as-a-service (SaaS) provider. This compromise allowed the attacker to introduce malicious code, which was subsequently spread across approximately 100 internal…

Multiple cyber-espionage groups have been observed deploying a sophisticated exploit kit identified as 'BlueMoon.' This kit is designed to leverage zero-day vulnerabilities, meaning flaws that are unknown to the software vendors and for which no patches exist.

The U.S. Justice Department issued a significant clarification on Tuesday, revising earlier public statements that had suggested Chinese state-sponsored hackers had successfully breached the U.S. Senate and the Federal Reserve.

A sophisticated data extortion group identified as UNC6671 has initiated a new campaign of cyber attacks, primarily targeting employees within the financial services, private equity, and professional services sectors. This group is notably employing voice phishing, commonly known as vishing…

Hackers are actively exploiting the critical CVE-2026-50522 vulnerability in Microsoft SharePoint to steal machine keys and maintain access even after affected servers are patched. This remote code execution (RCE) flaw allows attackers to compromise SharePoint servers and potentially gain unauthorized…

Unofficial patches have been released for a critical Windows zero-day vulnerability, dubbed LegacyHive, which permits attackers to escalate privileges on fully updated Windows systems. The vulnerability, disclosed on June 10, 2024, affects the Windows Registry, specifically the HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\...\InprocServer32 key.

SonicWall's Secure Mobile Access (SMA) 1000 series appliances were targeted by threat actors exploiting two zero-day vulnerabilities for several weeks before their public disclosure. These vulnerabilities allowed attackers to gain unauthorized access and deploy custom malware onto the affected VPN…

A China-linked threat cluster has been actively exploiting a vulnerability in Roundcube webmail servers, targeting academic institutions in the United States and Canada. The attackers are leveraging this flaw to gain unauthorized access to sensitive information, including user credentials.

A suspected China-aligned threat group has been observed exploiting critical security flaws in the open-source Roundcube webmail software, targeting physics and engineering departments at U.S. and Canadian universities. This new campaign, detailed in a report by cybersecurity firm Mandiant, leverages…

A threat actor exploited a zero-day vulnerability in Cisco Catalyst SD-WAN at least two months prior to its public disclosure, according to Mandiant. The vulnerability, identified as CVE-2026-20245 with a CVSS score of 7.8, allows an authenticated, local attacker…

The ShinyHunters extortion crew exploited an unpatched zero-day vulnerability in Oracle PeopleSoft (CVE-2026-35273) to breach university enterprise systems, steal data, and demand ransom. Google's Mandiant attributes the activity to a group it tracks as UNC6240, with the campaign occurring…