Cybersecurity

Analysis of the ToolShell vulnerabilities and exploit code

On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication,...
spot_img

Catching a phish with many faces

Here’s a brief dive into the murky waters of shape-shifting attacks that...

Finding new Partners with Solutions for Have I Been Pwned Users

For many years, people would come to Have I Been Pwned (HIBP),...

Lumma Stealer, coming and going – Sophos News

In September 2024, a threat hunt across Sophos Managed Detection and Response’s telemetry uncovered a Lumma Stealer campaign using fake CAPTCHA sites that instructed...

Qilin Leads April 2025 Ransomware Spike with 45 Breaches Using NETXLOADER Malware

î ‚May 08, 2025î „Ravie LakshmananThreat Intelligence / Ransomware Threat actors with ties to the Qilin ransomware family have leveraged malware known as SmokeLoader along with a...

Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream – Sophos News

Late in January 2025, a Managed Service Provider (MSP) administrator received a well-crafted phishing email containing what appeared to be an authentication alert for...

Outlaw botnet detected in an incident contained by Kaspersky

Introduction In a recent incident response case in Brazil, we dealt with a relatively simple, yet very effective threat focused on Linux environments. Outlaw (also...
spot_img