All news in category “Threat and Trends Reports”

🔒 Modern ransomware campaigns routinely target backup infrastructure before launching encryption, leaving organizations without viable recovery despite having backups. The article details an attack sequence — initial access, credential theft, lateral movement, backup discovery and destruction, then encryption — and identifies recurring failures like weak isolation, overprivileged credentials, lack of immutability, and untested restores. It recommends identity separation, network segmentation, immutable storage, continuous monitoring, and regular recovery testing, and highlights Acronis Cyber Platform as an integrated example that combines backup, immutability, and threat detection to reduce complexity and improve resilience.

⏱️ Unit 42 data and a conversation with Wendi Whitmore warn that attackers can exfiltrate data in as little as 39 seconds, forcing a shift from prevention to rapid detection and containment. Whitmore argues manual workflows cannot match adversary tempo and calls for AI-driven detection paired with unified visibility across endpoints, cloud and AI systems. Visibility, not complexity, enables containment before escalation.

🔒 Organizations have long focused on cyber defenses against breaches and ransomware, but new geopolitical tensions show major disruptions can originate in the physical world and target cloud and network infrastructure. As cloud systems become integral to national economies, the network itself becomes an attack surface requiring resilient-by-design architecture. Enterprises must embrace operational resilience, redundancy, and distributed controls to mitigate physical and systemic risks.

🐧 Quasar Linux (QLNX) is a newly disclosed modular Linux RAT that converts compromised hosts into a resilient peer-to-peer attack mesh. It bundles kernel-level rootkit techniques, PAM-based authentication backdoors, and fileless persistence to hide activity and survive remediation. Trend Micro’s analysis notes the binary even embeds C source for its PAM backdoor and LD_PRELOAD rootkit. The implant communicates over raw TCP, HTTP, and HTTPS (with TLS for TCP and HTTPS) and Trend Micro has published IOCs while applying protections for Trend Vision One customers.

📞 Cisco Talos analyzed phone numbers extracted from scam emails and found that API-driven VoIP provisioning enables large-scale, low-cost operations that are difficult to trace. Attackers rotate through sequential DID blocks, use cool-down windows, and frequently recycle numbers across multiple lures and attachment types. In a Feb 26–Mar 31, 2026 dataset of 1,652 numbers, the median lifespan was ~14 days; Sinch was the most abused provider. Talos recommends using phone numbers as anchors for cross-channel threat mapping.

🔔 Cybersecurity detection is improving, but response effectiveness hinges on how people perform under real stress. The article argues that scheduled, announced exercises leave teams neurologically unprepared because threat-induced arousal suppresses executive function. No-notice drills, informed by stress inoculation science, raise teams' tolerance for pressure and build practical outcomes: faster instinctive response, stronger cross-team trust and organizational honesty. Practical steps include anomaly injection, full-chain activation and rapid, blameless debriefs to close gaps.

🔒 A Cifas survey of 2,000 UK employees at firms with 1,000+ staff found 13% admitted to selling corporate logins in the past year or knew someone who had. The report highlights even higher tolerance among senior managers and executives, with justification rates rising to 32-43% and 81% for business owners. Cifas urges organisations to build fraud-aware cultures and deliver counter-fraud training to curb insider risk.

📎 Modern phishing now prioritizes speed over persuasion. By forcing immediate downloads via trusted cloud providers (for example Dropbox?s dl=1), attackers remove the preview step and exploit double extensions and hidden OS behavior to disguise executables. Cortex Email Security applies deep static analysis, behavioral signals, and LLM-based intent classification to detect forced-download parameters, identity-bound cloaking, and rotating social-engineering lures before they reach endpoints.

🔍 The EOL blind spot in CVE feeds means scanners and SBOM tools routinely miss vulnerabilities in end-of-life open source versions because upstream advisories and CVE records typically list only actively supported ranges. HeroDevs and Sonatype data show maintainers lack the capacity to test legacy releases, producing widespread false negatives — HeroDevs estimates that for roughly 80% of CVEs on supported versions, EOL lines are also affected but unreported. The article uses CVE-2026-22732 in the Spring ecosystem to illustrate the problem and highlights a 12M+ version dataset that finds millions of EOL package versions and tens of thousands of EOL components with known CVEs. Use of HeroDevs EOL dataset or similar analysis is recommended to discover hidden exposure quickly.

⚠️ The article highlights a persistent blind spot: end-of-life (EOL) open-source versions frequently fall outside CVE affected ranges and thus don’t trigger SCA scanner alerts. Research from HeroDevs and Sonatype shows millions of EOL package versions and tens of thousands with known CVEs but no official fixes. Concrete Spring Security examples from 2026 illustrate how EOL users can remain exposed without warning. The piece urges improved visibility and proactive EOL scanning.

🛡️ New ISACA research finds AI tools are widely used in organizations, but governance is lagging. Ninety percent of digital trust professionals say employees use AI, yet only 38% report a formal, comprehensive AI policy while 25% have none at all. The poll highlights rising Shadow AI risks, with 56% unsure how long it would take to halt an AI system and only 20% having shutdown procedures, increasing exposure to data breaches and privacy failures.

🔒 A persistent cybersecurity skills shortage is forcing CISOs to change hiring, training, and architecture decisions as AI amplifies attack scale and complexity. ISC2’s 2025 workforce study found 95% of organizations report at least one skills gap and nearly 60% call those gaps critical or significant. Leaders are turning to internal upskilling, automation, and role transitions, while balancing trade-offs between best-of-breed tooling, integrated platforms, and multicloud complexity.

🛡️Organizations commonly implement strong identity, authentication and access policies under a zero-trust strategy, yet enforcement at the network traffic layer is frequently inconsistent. Gaps appear across ingress paths, load balancers, CDNs, TLS termination and east–west service communication, allowing traffic to bypass identity controls. Successful programs treat the traffic plane as the primary enforcement point: standardizing ingress, enforcing strict TLS baselines and mTLS, normalizing requests and maintaining end-to-end telemetry. The core message: mindset and policy alone are insufficient without consistent traffic-layer enforcement.

🔔 Kaspersky reports an increase in phishing campaigns that abuse Amazon Simple Email Service (SES) to send authenticated-looking malicious messages that can bypass reputation-based filters. Attackers are harvesting exposed AWS access keys from public repositories and assets, automating secret discovery, permission checks, and mass email distribution. Because messages originate from a trusted service, SPF, DKIM, and DMARC checks and IP blocks are often ineffective, prompting Kaspersky to recommend stricter IAM controls, MFA, key rotation, and IP restrictions.

📧 Kaspersky reports a surge in phishing campaigns that abuse AWS Simple Email Service (SES) to bypass authentication and reputation-based defenses. Attackers are exploiting exposed AWS Identity and Access Management keys discovered in public repositories, configuration files, container images, backups, and open S3 buckets. They automate secret scanning, permission validation, and mass email distribution to send highly credible lures—custom HTML templates and fake document-signing notifications—that redirect victims to AWS-hosted phishing pages.

📈 The Milano Cortina 2026 Winter Games coincided with a dramatic rise in DDoS activity against Italian infrastructure, with attack frequency increasing 181% year-over-year from 2025. NETSCOUT ASERT recorded 12,963 attacks during the core Games window (Feb 6–23), peaking at more than 2,200 attacks on single days and shifting tactics from high-bandwidth floods to packet-rate–intensive vectors. The hacktivist group NoName057(16) dominated public claims, while ransomware groups and other actors also asserted responsibility. Adaptive defenses such as NETSCOUT ATLAS and Arbor products were highlighted as important mitigations.

🔎 Orphaned applications silently expand shadow IT by persisting beyond team ownership, continuing to authenticate, exchange data, and consume resources without oversight. They commonly appear when departments adopt tools to meet urgent needs and those workflows, accounts, or service identities are never decommissioned. NETSCOUT Smart Data leverages packet-derived observability to reveal hidden dependencies and enrich the ServiceNow CMDB, helping teams reduce operational, security, and compliance blind spots.

🚨This week’s telemetry shows attackers moving from quick breaches to persistent occupation across SaaS, CI/CD and hosting panels. CVE-2026-41940 in cPanel/WHM and the Linux Copy Fail bug (CVE-2026-31431) are being actively exploited alongside supply-chain compromises that weaponize developer pipelines. Social engineering — including vishing that bypasses MFA — and AI-assisted phishing kits are scaling attacks. Prioritize urgent CVEs, rotate pipeline credentials, and treat sessions and routine pipeline runs as potentially hostile.

🔍 Flare researchers identified organized, process-driven loan fraud methods on underground forums that use stolen identities, social engineering, and workflow knowledge to impersonate legitimate borrowers. Attackers focus on passing knowledge-based authentication (KBA) and reconstructing verification answers from public sources and leaked datasets. They preferentially target small- and mid-sized credit unions perceived to have weaker fraud detection, then rapidly move funds through intermediaries to complete cash-out before detection.

🛡️ Small and mid-size US defense contractors lack the network telemetry needed to detect nation-state reconnaissance and pre-positioning operations, Team Cymru analyst Stephen Campbell warns. He says state-backed groups are increasingly targeting edge infrastructure — routers, firewalls and VPN gateways — and using living-off-the-land techniques and legitimate cloud services to evade endpoint alerts. Campbell urges firms to deploy NetFlow pattern recognition, map infrastructure, patch and segment systems, and hunt for anomalous DNS and lateral movement to uncover stealthy access.