GrayBravo’s modular loader, CastleLoader, now powers four distinct threat clusters targeting logistics, travel, and enterprise users a clear sign of rapid MaaS expansion and rising risk for global organizations.
A chilling evolution: Storm-0249 has shifted from selling access to enabling full-blown ransomware campaigns. Their new combination of ClickFix social-engineering, fileless PowerShell and DLL sideloading dramatically increases stealth and persistence across enterprise environments.
A critical Ivanti Endpoint Manager code execution flaw, tracked as CVE-2025-10573, allows unauthenticated attackers to plant malicious JavaScript in the EPM dashboard and hijack admin sessions. This article explains how the bug works, which versions are affected, and how to patch and harden EPM cores.
JSSmuggler uses JavaScript-based smuggling to hide and reassemble Windows malware at runtime, bypassing security tools and enabling advanced payload delivery. This analysis explains how it works and how defenders can counter it.
A newly observed Mirai variant, “Broadside,” is exploiting weakly protected IoT systems across global maritime logistics environments. Its rapid spread and operational impact highlight growing risks as critical shipping infrastructure becomes increasingly automated and interconnected.
Apple has issued a sweeping new round of cyber-threat notifications to users across 84 countries, signaling a global escalation in targeted spyware operations. This analysis explains what triggered the alerts, how attackers operate, and what high-risk users must do immediately.
FvncBot is a new Android banking trojan capable of keylogging, screen streaming, overlays, and remote control — letting attackers steal credentials and hollow out bank accounts. This article breaks down how it works, why it matters, and how to defend against it.
Cl0p ransomware exploited a zero-day in Oracle E-Business Suite to steal years of invoice data from Barts Health NHS Trust. The leak exposed names, addresses, and payment info of patients, staff, and suppliers, now circulating on the dark web. Learn what was compromised, who’s at risk, and how to protect yourself.
The latest Cybersecurity and Infrastructure Security Agency (CISA) advisory reveals that PRC-linked hackers use a backdoor called BRICKSTORM to gain long-term access to VMware vSphere and Windows environments, affecting government and IT networks. This article unpacks the attack chain, impacted sectors and critical defensive steps organizations should take now.
JPCERT confirms that attackers now actively exploit command injection flaws in Zyxel NAS326 and NAS542 devices. These end-of-life NAS units allow threat actors to run arbitrary commands, maintain persistence, and infiltrate internal networks, prompting urgent calls for device isolation and replacement.