All news in category “Threat and Trends Reports”

🔒 Threat actors are increasingly abusing HTTP cookies as a stealthy control channel for PHP webshells on Linux hosting platforms. By gating execution on specific cookie values, attackers keep loaders dormant during normal traffic and activate functionality only when exact cookie conditions are met. Variants range from multi-stage loaders that reconstruct functions at runtime to single-file interactive shells, often using base64 reconstruction and layered obfuscation to evade detection. Review Microsoft Defender guidance to detect, hunt, and mitigate these threats.

🔍 Check Point Research reports that cyber criminals systematically prepared for Tax Season 2026, registering hundreds of tax‑related domains each month from September 2025 through February 2026. These prebuilt infrastructures fueled phishing campaigns, fraudulent tax portals and malware designed to harvest credentials and financial data. Organizations and individuals should prioritize domain monitoring, DNS filtering, email authentication and targeted employee training to reduce exposure.

🕵️ GreyNoise analyzed 4 billion malicious sessions over three months and found residential proxies accounted for roughly 39% of traffic yet evaded IP reputation feeds in 78% of cases. Researchers say the short-lived, systematically rotated, or low-activity nature of these addresses prevents timely cataloging by reputation systems. They recommend moving from IP-based blocking to behavior-focused detection, such as spotting sequential probing and tracking device fingerprints that persist through IP rotation.

🔒 Researchers at Varonis have uncovered Storm, a new infostealer that harvests browser credentials, session cookies and crypto wallets before exfiltrating encrypted data to attacker-controlled servers. Emerging on underground forums in early 2026 and detailed in an April 1 report by Daniel Kelley, Storm shifts decryption off-host to avoid detection and supports both Chromium and Gecko-based browsers. It operates in memory, automates session restoration using Google refresh tokens and SOCKS5 proxies, and is marketed to attackers for under $1,000 per month.

📬 Flare analysts examined a step‑by‑step fraud tutorial showing how attackers identify and abuse vacant residential properties to intercept mail for identity theft and financial fraud. The guide recommends using real‑estate sites (Zillow, Rightmove, Zoopla) to find “drop” addresses, enrolling in services such as Informed Delivery, and filing change‑of‑address or forwarding requests with forged or purchased identities. By combining digital discovery with physical mail forwarding, actors gain persistent access to verification letters, credit cards, and financial correspondence.

🛡️ This guide summarizes GTIG and Mandiant research on threats targeting the vCenter Server Appliance and ESXi hypervisors, where attackers establish persistence beneath guest OS defenses. It prescribes an infrastructure-centric defense across four phases—benchmarking and base controls, identity management, vSphere network hardening, and logging/forensic visibility—emphasizing Photon OS hardening, mandatory remote telemetry, and strict network segmentation to force detectable friction.

🔐 In this episode of the Talos Threat Perspective, Hazel Burton examines how identity is being used to gain, extend, and maintain access inside environments. Drawing on the 2025 Talos Year in Review, the video outlines how attackers target identity systems and MFA workflows, establish persistent high-trust access, and use internal phishing to move laterally. It also explores risks from over-permissioned AI agents and identity-linked access, and how adversaries blend into normal user behaviour, complicating detection and containment.

🔒 Halcyon warns that the Akira ransomware group can complete a full attack lifecycle in under an hour, often exploiting vulnerabilities in internet-facing VPN and backup appliances where multi-factor authentication is absent. The group supplements exploits with credential theft, spearphishing, password spraying and initial access brokers, then exfiltrates data before encryption in a double-extortion model. Akira favors stealth and living-off-the-land tools (FileZilla, WinRAR, WinSCP, RClone) to stage and encrypt data; organizations should adopt layered defenses, harden third-party access, monitor for exfiltration and deploy dedicated anti-ransomware protections.

📰 The ThreatsDay Bulletin highlights immediate, actionable risks including a pre-auth RCE chain in Progress ShareFile (CVE-2026-2699/CVE-2026-2701), unpatched ImageMagick zero-days enabling RCE, and novel CloudTrail evasion techniques that erase forensic visibility. It also details widespread mobile-rootkit campaigns, a sharp rise in open-source and supply-chain malware advisories, and phishing apps abusing distribution services to harvest credentials. Defenders should prioritize patching, sandboxing ingest pipelines, and hunting for signs of chained low-and-slow techniques and suspicious AWS API activity.

🔍 The State of Trusted Open Source report analyzes Chainguard customer usage and security data from Dec 1, 2025 through Feb 28, 2026, covering 2,200+ container image projects, 33,931 fix instances, and 377 unique CVEs. It shows AI-driven development accelerating adoption of Python and PostgreSQL, broader standardization around language ecosystems, and the rise of chainguard-base as a minimal foundation. Vulnerability discovery and remediation scaled dramatically—unique CVEs rose 145% and fixes tripled—while median remediation time remained about 2.0 days. The report highlights persistent long-tail risk and a notable increase in FIPS-driven adoption.

🔍 This Talos analysis dissects a malicious msimg32.dll used in Qilin ransomware attacks, detailing a multi-stage PE loader that evades and disables endpoint detection and response (EDR) solutions. The loader employs SEH/VEH obfuscation, syscall-stub reuse, and paging-file-backed sections to decrypt and map payloads entirely in memory without triggering hooks or ETW telemetry. The final EDR killer loads two helper drivers to perform physical memory R/W and to unprotect and terminate guarded processes, enabling it to neutralize over 300 vendor drivers.

🔒 The Cisco Talos 2025 Year in Review, discussed by Christopher Marshall and Peter Bailey, highlights accelerating attacker speed and a shift toward identity as the primary battleground. The report shows rapid weaponization of new flaws alongside persistent exploitation of legacy, end-of-life infrastructure, and a sharp rise in fraudulent device registration. Defenders are urged to prioritize identity controls, visibility, lifecycle discipline, and secure AI governance to keep pace.

🔍 In 2025 Japan reported 134 ransomware incidents—a 17.5% increase from 2024—with Qilin responsible for 22 cases (16.4%). Talos highlights Qilin’s growing automation, credential‑based access, and use of an EDR‑killer that targets 300+ drivers and employs locale-based geo‑fencing. The blog focuses on detecting activity during the pre‑ransomware phase (average six days to execution) and shares Sigma/YARA rules plus correlation guidance to reduce false positives.

🔒 A survey by e2e-assure of 250 UK critical national infrastructure (CNI) cybersecurity decision-makers found 80% of organisations expect operational technology (OT) downtime costs between £100,000 and £5m, with 23% reporting incidents exceeding £1m and 6% above £5m. Nearly two-thirds said they fear nation-state attacks, and the vendor warned attackers commonly pivot from IT into exposed OT environments. Respondents also highlighted limited OT visibility and supply-chain risks that hinder detection, response and remediation efforts.

🔒 A new malware-as-a-service called CrystalRAT (also marketed as CrystalX) has been active since January and is being promoted on Telegram and a dedicated YouTube channel, offering remote access, data theft, keylogging, clipboard hijacking and an extensive set of prankware functions. Kaspersky researchers found strong similarities to WebRAT (Salat Stealer), noting a Go-based codebase, matching panel design and a bot-driven sales system; the kit includes a builder, geoblocking, executable customization and anti-analysis protections. Payloads are zlib-compressed and ChaCha20-encrypted, connect to C2 over WebSocket, and the RAT supports CMD execution, VNC-backed remote control, audio/video capture, streaming keylogging and a clipboard clipper; the infostealer component targeting Chromium-based browsers and desktop apps is currently being upgraded. Users should avoid untrusted downloads and apply standard endpoint protections to reduce infection risk.

🔒 Backup is now the backbone of business resilience, not just an IT routine. The article presents seven priorities—data prioritization, off-site and immutable copies, automated RPO/RTO, realistic recovery testing, SOC integration, and scalable playbooks—to reduce downtime and ransomware risk. It advocates a modern 3-2-1 approach with immutable cloud copies and daily automated recovery verification. N-able’s Cove Data Protection is cited as an example of a cyber-resilient solution.

🔔 This article distills five practical steps to move SOCs from alert fatigue to measurable business resilience, based on the 2026 N-able State of the SOC Report. It explains why volume-focused metrics fail, highlights that 90% of investigations are automatable, and shows how AI-driven correlation and SOAR can reclaim analyst time. The guide emphasizes layered defenses and playbooks designed to contain incidents quickly and preserve uptime.

🔒 Business resilience begins at the endpoint. Drawing on N-able SOC data, the article highlights that over 900,000 alerts were processed between March and December 2025 and that 18% originated from network and perimeter exploits—threats many endpoint-only tools missed. It prescribes continuous asset visibility, standardized secure configurations, automated patching and remediation, EDR for behavioral detection and response, and integrated backup and recovery to minimize downtime.

⚠️Silos between endpoint, SOC, and backup teams increase incident impact and slow recovery. The article identifies six common failures—unclear roles, fragmented asset and risk views, mismatched policies, disconnected tools, absent cross-team drills, and siloed metrics—and offers concrete fixes. Build a unified RACI, consolidate inventories and logs, align retention and playbooks, integrate EDR/SOC/backup workflows, run joint simulations, and measure resilience with shared KPIs. N-able is presented as a vendor that unifies management, security operations, and data protection to enable automation, faster detection, and safer recovery.

🔒 IT leaders must track six operational metrics to sustain business resilience as threats scale and boards demand measurable outcomes. Drawing on the 2026 N-able State of the SOC Report, the piece highlights MTTD, MTTR, time to recover, endpoint patch compliance, asset and identity coverage, and downtime avoided as core indicators. It shows how automation, integrated platforms, and continuous visibility convert metrics into actionable defense, faster containment, and demonstrable business value.