UAT-9244 hits South American telcos with TernDoor, PeerTime and BruteEntry
Cisco Talos links the activity cluster to China-nexus tooling, including CrowDoor variants and ORB-style proxy infrastructure
Tags /
#Network Security
30 reports
BadAudio and APT24: “good enough” OPSEC powering a multi-vector espionage chain
Reverse engineering shows pragmatic obfuscation, hardcoded crypto, and cloud-native infrastructure supporting scalable intrusion delivery.
Iran crisis cyber risk rises as defacements and disruptive activity reported
Iran • hacktivists • IRGC • MOIS • DDoS • wipers • ransomware • critical infrastructure
OpenClaw “ClawJacked” chain: malicious websites can hijack local AI agents via localhost WebSockets
Cross-origin browser-to-localhost access, missing loopback throttling, and implicit device trust combine into a silent takeover path from a single web visit.
Preventing the Access That Powers Ransomware Lateral Movement (Part 2/2)
Designing upstream controls that cut off access brokers, endpoint breakout, and perimeter device exploitation before T1021 starts
Ransomware Lateral Movement in 2026: Detection Opportunities (Part 1/2)
Ransomware lateral movement techniques in 2026 are increasingly identity-led, cloud-aware, and executed through legitimate admin channels, forcing defenders to prioritise high-fidelity telemetry,…
Cyber Threats to the UK Financial System: Banking, Capital Markets, Asset Management and Central Banking (Transatlantic & Geopolitical Drivers, 2024–2026 Incident Case Studies)
UK financial stability and customer outcomes are increasingly shaped by operational cyber risk: attacks (and disruptive technology failures) that impair critical services, amplify fraud losses,…
BLACK BASTA - Threat Actor Profile
Operational profile of the Black Basta ransomware ecosystem (2022–2026) Black Basta, BASTA, ransomware, RaaS, double extortion, UNC4393, Storm-1811, QakBot, DarkGate, Quick Assist, vishing, MITRE…
Cyber Threats Facing UK Further and Higher Education
UK further education (FE) colleges and higher education (HE) institutions face a persistently high-volume threat environment driven by phishing, account compromise, ransomware/extortion, and…
Threat Actor Profile: LAPSUS$ (a.k.a. Microsoft “DEV-0537” / “Strawberry Tempest”)
LAPSUS$ is an extortion-focused cybercriminal collective best known for high-tempo intrusions against large enterprises and service providers, frequently leveraging social engineering and identity…
Threat Actor Profile: Cl0p (CL0P) — Extortion-led Mass Compromise
Cl0p (often written “CL0P”) is a financially motivated extortion operation best known for high-scale data theft campaigns that disproportionately impact organisations running internet-facing…
Fortinet FortiWeb Under Active Exploitation: CVE-2025-64446 and CVE-2025-58034
Two Fortinet FortiWeb vulnerabilities — CVE-2025-64446 (relative path traversal enabling unauthenticated administrative command execution) and CVE-2025-58034 (OS command injection enabling…