Sign in Subscribe

Edward Crowder

Editor in Chief and founder of CyberRisks.ai, previously a threat intelligence researcher at a top global MDR, specializes in global major incident detection and response.

UNC1860: Iran’s Stealthy Cyber Espionage Campaign Targets Middle East Networks

UNC1860: Iran’s Stealthy Cyber Espionage Campaign Targets Middle East Networks

This persistent and sophisticated group has been targeting government and telecommunications networks across the Middle East with a focus on gaining long-term access for espionage and potential cyber attacks.

Raptor Train: Chinese Nation-State Botnet Compromises Over 200,000 Devices

Raptor Train: Chinese Nation-State Botnet Compromises Over 200,000 Devices

Black Lotus Labs released a report detailing the discovery of a botnet, dubbed "Raptor Train." This multi-tiered network has compromised more than 200,000 small office/home office (SOHO) routers, Internet of Things (IoT) devices, and network infrastructure worldwide.

Kryptina RaaS: From Open-Source Tool to Enterprise-Level Ransomware

Kryptina RaaS: From Open-Source Tool to Enterprise-Level Ransomware

On September 23 2024, SentinelOne releases a report on Kryptina Ransomware as a Service covering the May 2024 leak from a Mallox ransomware affiliate’s server.

How Ransomhub Ransomware Uses EDRKillShifter to Disable EDR and Antivirus

How Ransomhub Ransomware Uses EDRKillShifter to Disable EDR and Antivirus

On September 20, 2024, Trend Micro released a comprehensive threat report detailing how the Water Bakunawa threat group has employed advanced techniques in the RansomHub ransomware campaign.

Canada Publishes First Public Intelligence Priorities: A Landmark Step in National Security Transparency

Canada Publishes First Public Intelligence Priorities: A Landmark Step in National Security Transparency

On September 19, 2024, the Government of Canada released its first-ever public Intelligence Priorities report, marking a historic move toward transparency in national security.

CVE-2024-45488: Skeleton Cookie Vulnerability Exposes Safeguard for Privileged Passwords to Full Administrative Access

CVE-2024-45488: Skeleton Cookie Vulnerability Exposes Safeguard for Privileged Passwords to Full Administrative Access

On September 17, 2024, researchers from Amber Wolf Security uncovered a significant authentication bypass vulnerability in One Identity’s Safeguard for Privileged Passwords product. Assigned CVE-2024-45488, the vulnerability, dubbed "Skeleton Cookie,"

Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and MacOS Backdoors

Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and MacOS Backdoors

On September 18, 2024, Unit 42 researchers at Palo Alto Networks released an investigation detailing an ongoing cyber campaign by the North Korean-linked threat actor group known as Gleaming Pisces (aka Citrine Sleet).