The Latest

• 

  Majority of ransomware claims involved compromise of perimeter security devices

  A report by cyber insurance firm Coalition shows six of every 10 ransomware claims involved compromised VPN or firewall.

  Strategy

• 

  Former NSA cyber director warns drastic job cuts threaten national security

  Rob Joyce told lawmakers mass layoffs of federal workers will hurt the ability of the U.S. to combat malicious cyber activity from China and other adversaries.

  Strategy

• 

  Eleven11bot estimates revised downward as researchers point to Mirai variant

  The botnet has been involved in DDoS activity targeting telecom companies and gaming platforms.

  Vulnerability

• 

  CrowdStrike shares fall as company forecasts lower-than-expected results

  The cybersecurity vendor is ending its customer commitment package, which was launched to help maintain existing relationships.

  Strategy

• 

  More than 86K IoT devices compromised by fast-growing Eleven11 botnet

  The Iran-linked botnet has a large presence in the U.S. and is targeting telecom and other firms with DDoS attacks.

  Cyberattacks

• 

  Microsoft-signed driver used in ransomware attacks

  Threat actors are exploiting a privilege escalation flaw in Paragon Partition Manager for “bring your own vulnerable driver” (BYOVD) attacks.

  Vulnerability

• 

  Leaked ransomware chat logs reveal Black Basta’s targeted CVEs

  Cybercrime group focused on Microsoft vulnerabilities as well as flaws in network edge devices and communications software.

  Vulnerability

• 

  Nearly 3K Ivanti Connect Secure instances vulnerable to critical flaw

  U.S. has the most VPNs not yet patched for CVE-2025-22467.

  Vulnerability

• 

  DeepSeek’s AI shake-up could boost cybersecurity risks, spending: report

  The cybersecurity market could grow to $338 billion in value by 2033, driven in part by expanding AI risks, Bloomberg Intelligence analysts said.

  Strategy

• 

  Palo Alto Networks warns hackers attempting to exploit a file read flaw in firewalls

  Threat actors are chaining the CVE with at least one prior flaw to enable the hack attempts.

  Vulnerability

• 

  Microsoft Power Pages vulnerability exploited in the wild

  The high-severity privilege escalation flaw in Microsoft's website building application was disclosed and patched last week.  

  Vulnerability

• 

  Proof-of-concept exploit released for 4 Ivanti vulnerabilities

  Critical flaws in Ivanti Endpoint Manager were initially disclosed and patched last month.

  Updated Feb. 20, 2025

  Vulnerability

• 

  US authorities warn Ghost ransomware leverages older CVEs

  The China-linked threat group has targeted critical infrastructure providers in more than 70 countries.

  Vulnerability

• 

  Tech investment firm Insight Partners discloses data breach

  The company holds equity in several major technology companies, including Wiz and Kaseya.

  Breaches

• 

  Lee Enterprises says cyberattack will likely have material impact

  The newspaper chain said attackers encrypted critical applications and impacted billing, payments and print distribution.

  Cyberattacks

• 

  SonicWall authentication flaw under threat of active exploitation

  Weeks after the company released a patch, researchers warn the CVE is being targeted by threat actors.

  Vulnerability

• 

  Phishing campaign targets Microsoft device-code authentication flows

  Russian state-sponsored hackers have attacked enterprises and government agencies in North America and overseas.

  Vulnerability

• 

  Trump to nominate Sean Cairncross as national cyber director

  The president will tap the former RNC insider to lead the White House office that oversees nation’s cybersecurity strategy.

  Strategy

• 

  CISA warns of hackers targeting vulnerability in Trimble Cityworks to conduct RCE

  The software is widely used in projects by local governments, utilities, airports and other facilities.

  Vulnerability

• 

  HPE issues breach notifications for 2023 Midnight Blizzard attack

  Russian state-sponsored hackers compromised the tech giant's Office 365 email environment.

  Breaches

• 

  Private equity firm to acquire SolarWinds for $4.4B

  SolarWinds, which now will go private, was embroiled in a massive supply chain attack in 2020 linked to Russia-backed threat actors.

  Strategy

• 

  Microsoft warns 3K exposed ASP.NET machine keys at risk of weaponization

  An unknown threat actor recently used an exposed key for code injection cyberattacks. 

  Vulnerability

• 

  Suspected botnet targets edge devices using brute force attacks

  Researchers warn of a surge in attempted logins targeting devices from SonicWall, Palo Alto Networks and others.

  Cyberattacks

• 

  Hackers deployed web shells, exploited public-facing applications in Q4

  A Cisco Talos report also indicated a sharp increase in remote access tools being leveraged in ransomware. 

  Cyberattacks

• 

  State-linked hackers deploy macOS malware in fake job interview campaign

  Actors linked to North Korea bypassed Apple security using malware called FlexibleFerret.

  Vulnerability

More stories