Sign in Subscribe

Edward Crowder

Editor in Chief and founder of CyberRisks.ai, previously a threat intelligence researcher at a top global MDR, specializes in global major incident detection and response.

RansomHub Ransomware: Emerging Threat and Mitigation Strategies

RansomHub Ransomware: Emerging Threat and Mitigation Strategies

RansomHub ransomware has quickly gained notoriety since its inception in February 2024. The advisory disseminates known indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with RansomHub

Iranian State-Backed Group Deploys Custom Malware in Ongoing Intelligence Operations

Iranian State-Backed Group Deploys Custom Malware in Ongoing Intelligence Operations

The group targeted sectors including satellite, communications, oil and gas, as well as federal and state governments in the United States and the UAE between April and July 2024. This activity represents a significant evolution in Peach Sandstorm’s ongoing intelligence-gathering operations.

Former Employee Arrested for Attempted Data Extortion Targeting Industrial Company

Former Employee Arrested for Attempted Data Extortion Targeting Industrial Company

Rhyne, aged 57 and a resident of Kansas City, Missouri, is accused of attempting to extort his former employer by threatening to damage its computer network unless a ransom of 20 Bitcoin (approximately $750,000 at the time) was paid.

Operation Oxidový: Czech Military Targeted by NATO-Themed Malware Campaign

Operation Oxidový: Czech Military Targeted by NATO-Themed Malware Campaign

a sophisticated malware campaign targeting the Czech Republic's government and military officials. Known as "Operation Oxidový," the campaign leverages NATO-themed decoys to infiltrate and compromise sensitive systems.

Cryptojacking Campaign Exploits CVE-2023-22527 in Atlassian Confluence

Cryptojacking Campaign Exploits CVE-2023-22527 in Atlassian Confluence

On August 28, 2024, Trend Micro released a report detailing the exploitation of CVE-2023-22527, a critical vulnerability in Atlassian Confluence. This vulnerability, initially disclosed on January 16, 2024, affects Confluence Data Center and Confluence Server.

Iranian Counterintelligence Operation Targets Farsi Speakers with Fake Recruitment Websites

Iranian Counterintelligence Operation Targets Farsi Speakers with Fake Recruitment Websites

On August 28, 2024, Mandiant released a comprehensive report uncovering a suspected Iran-nexus counterintelligence operation. This campaign, targeting Farsi speakers within and outside Iran, leveraged fake recruitment websites to collect personal and professional data.

New Mirai Variant Exploits Zero-Day in AVTECH Cameras: CVE-2024-7029

New Mirai Variant Exploits Zero-Day in AVTECH Cameras: CVE-2024-7029

Akamai Security Intelligence and Response Team (SIRT) released a detailed report on a new botnet campaign that exploits a previously undisclosed zero-day vulnerability in AVTECH CCTV cameras. The vulnerability, CVE-2024-7029, enables remote code execution (RCE).