All news in category “Threat and Trends Reports”

🔒 The war in the Middle East has expanded cyber risk globally, from physical strikes on AWS data centers to waves of Iran-aligned cyber activity. Within hours of kinetic operations, hacktivists and state-aligned APTs mobilized, using DDoS, defacement, wipers and supply-chain compromises. Organizations should prioritize inventorying internet-facing assets, enforcing phishing-resistant MFA, auditing MSP and cloud dependencies, and preparing offline backups. The guidance focuses on pragmatic hardening where adversaries historically find weak spots.

✈️ Flare researchers found that airline miles and hotel points are being treated as commodities in underground markets, where stolen loyalty accounts are traded, redeemed for legitimate bookings, and resold at discounts. Actors post inventory-style listings in messaging groups, often advertising full email access to reduce recovery chances. Observed pricing averaged roughly $1 per 1,000 miles, and major programs were favored for liquidity and resale value. The fraud chain typically follows a four-stage cycle from account takeover to resale.

🔐 Modern phishing increasingly hides behind legitimate infrastructure and encrypted HTTPS, making static checks insufficient. The piece recommends a three-part investigation model — safe interaction, automation, and in-sandbox SSL decryption — so SOCs can observe full attack flows, extract actionable IOCs, and reach evidence-based verdicts quickly. This approach reduces analyst load and helps detect identity-driven compromise earlier.

🔒 Multiple vendors and researchers this week disclosed a broad set of active threats spanning cloud environments, endpoints, and messaging platforms. OAuth consent abuse campaigns impersonated trusted apps to harvest tokens and access mail and files without passwords, while the BlackSanta campaign used resume-themed ISOs to chain DLL side‑loading and disable AV/EDR via vulnerable drivers. Other notable items include microcontroller debug bypasses, ZIP header evasion that defeats some AV/EDR tools, an AI-agent compromise of an internal platform, and targeted phishing against Signal and WhatsApp users.

🔍 GitLab research outlines a North Korean campaign that impersonated recruiters in the 'Contagious Interview' scheme and resulted in the banning of 131 attributed accounts. Many GitLab projects served as obfuscated loaders for malware such as BeaverTail and Ottercookie, with payloads hosted outside repositories. Operators used consumer VPNs, VPSs and laptop farms and shifted to invite-only projects, NPM dependency abuse, sandbox detection and AI-generated personas to scale fake IT worker and freelance scams.

🔒 Microsoft Defender Experts describe the Contagious Interview campaign, a long-running social engineering operation that delivers malware through staged developer recruitment processes. Threat actors pose as recruiters and persuade victims to clone and execute NPM packages or to trust repository tasks in Visual Studio Code that then fetch backdoors such as Invisible Ferret and FlexibleFerret. The operation targets developer endpoints, source-control credentials, and CI/CD access by weaponizing trusted hiring workflows. Microsoft recommends isolating coding tests, pre-reviewing recruiter repositories, restricting runtimes, protecting secrets, and hunting for editor-to-shell execution chains.

🔒 The French cybersecurity agency ANSSI reported a decrease in known ransomware incidents in 2025, recording 128 attacks versus 141 in 2024. The agency attributed the decline partly to large-scale law enforcement actions and preventive interventions by cyber defenders, including Operation Endgame. Small and medium businesses remained the most targeted, while healthcare and education saw the sharpest increases. Prominent strains included Qilin, Akira and LockBit 3.0/LockBit Black.

🚨 BeatBanker is a sophisticated Android trojan targeting Brazilian users through counterfeit pages that mimic Google Play and legitimate services such as INSS Reembolso or Starlink. The malware installs in staged downloads, injects encrypted modules into RAM after device and country checks, and avoids analysis by detecting emulators. It deploys a Monero miner that evades power optimizers by playing near‑inaudible audio and uses Accessibility abuse to overlay screens and divert crypto transfers. Users should stick to official stores, scrutinize permissions, and run up‑to‑date anti‑malware.

⚠️ Zero trust principles deliver measurable gains in enterprise IT, but they often miss dominant failure modes in IoT and OT. The author argues that zero trust assumes explicit, identity-centric and continuously enforceable trust, while IoT/OT systems rely on implicit, durable trust relationships and centralized control paths. Adopt the unified linkage model (ULM) to map adjacency, inheritance and trust propagation, and prioritize protection of management planes, firmware update paths and vendor integrations.

📈 The February 2026 Check Point Global Threat Intelligence report found UK organisations saw fewer weekly attacks per organisation (1,504) than the global average (2,086), but a 36% year‑on‑year increase — nearly four times the global 9.8% rise. Education, energy & utilities, government, healthcare and financial services were among the most frequently targeted UK sectors. Ransomware remained acute, with 49 active groups and a plurality of victims attributed to Qilin, Clop and The Gentlemen. The report also warned that widespread, unmanaged GenAI use is elevating inadvertent data‑exposure risk, with one in 31 prompts judged high risk.

🔐 Attackers increasingly leverage trusted cloud platforms and SaaS APIs to blend malicious activity into routine enterprise traffic. Campaigns such as Gridtide and SesameOp demonstrate adversaries using Google Sheets, OpenAI APIs and cloud storage as covert command-and-control and staging vectors. By operating through legitimate identity systems, management consoles, and ephemeral serverless functions, attackers evade network defenses and static blocklists. The result is harder detection, easier credential harvesting, and persistent access across hybrid environments.

🔐 A global survey by Quest Software of 650 IT and security practitioners found that only 24% of organisations test identity disaster recovery every six months, while 24% never test recovery plans. The report warns many firms focus on preventative controls and detection rather than response and recovery, increasing risk when identity protections fail. Respondents identified gaps in non-human and third-party identities, legacy on-premises systems and privileged accounts. Adoption of ITDR programmes is rising (57%), and 79% believe AI can improve recovery by reducing alert fatigue and correlating signals.

⚠️ The Cloud Threat Horizons report from Google Cloud's Office of the CISO warns that AI-assisted exploitation has compressed the window from vulnerability disclosure to active attacks from weeks to days. In H2 2025, third-party software flaws became the leading initial access vector, surpassing weak credentials. The report urges automated defenses, identity-based controls, and tamper-resistant logging to improve forensic readiness.

🛡️ X told British MPs it suspended 800 million accounts in 2024 for breaching rules on platform manipulation and spam. Company government affairs executive Wifredo Fernández said Russia was the most active state-backed manipulator, followed by Iran and China, and that efforts to influence elections and 'flood the zone' persist. Despite Elon Musk's prior pledge to purge bots, X acknowledges hundreds of millions of inauthentic accounts are removed annually, raising concerns about uncaught actors and moderation practices.

🧠 In February 2026, cybersecurity firm Oversecured audited 10 popular Android mental‑health apps and found 1,575 vulnerabilities — 54 rated critical — across apps with a combined 14.7M+ installs. Findings include insecure local storage, hardcoded API endpoints, weak token generation using java.util.Random, and no root detection, contradicting many apps’ claims of full encryption. The report highlights the real risk of exposure of therapy transcripts, mood logs, and medication data and urges users to review permissions, update apps, and avoid third‑party sign‑ins.

🔐 Google Cloud's H1 2026 Threat Horizons Report finds that in the second half of 2025 threat actors shifted from credential-based access to exploiting unpatched third-party software. Third-party software entry rose to 44.5% of primary vectors (up from 2.9%), while credential abuse declined to 27.2%. Google highlights React2Shell (CVE-2025-55182) as a heavily exploited RCE and recommends automated defenses, stronger identity controls and WAF protections to mitigate rapid post-disclosure attacks.

🛡️ Modern malware increasingly uses mathematical and timing checks to avoid analysis. The Picus Red Report™ 2026 found Virtualization/Sandbox Evasion (T1497) surged to the #4 technique in 2025, appearing in 20% of samples. Threats like Blitz and LummaC2 use system profiling, trigonometry-based mouse analysis, and CPU timing comparisons to detect sandboxes and abort execution. Organizations should shift from file analysis to continuous behavioral validation using AEV and BAS.

⚠️ Check Point Research reports that global cyber attack volumes remained near record highs in February 2026, with an average of 2,086 weekly attacks per organization—a 9.6% year‑over‑year increase and effectively flat month‑to‑month (-0.2%). While ransomware activity eased versus the same period last year, overall attack volumes grew due to automation, expanding digital footprints, and persistent exposure risks tied to enterprise GenAI use. The findings point to a sustained, high‑pressure threat environment that demands continuous risk management.

🛡️ The window to respond to critical vulnerabilities is collapsing: disclosure-to-exploit can be as short as 24–48 hours today and is projected to shrink to minutes by 2028. Many organizations unknowingly expose unnecessary internet-facing services, turning unpatched systems into immediate attack opportunities. Intruder’s Head of Security recommends deliberate attack surface reduction through robust asset discovery, treating exposure as its own risk category, and continuous monitoring to prevent frantic, last-minute remediation.

⚠️ Legacy operational technology in critical plants — often running unsupported systems like Windows XP and using insecure protocols — represents a persistent and escalating cyber risk. The author, an experienced OT security practitioner, identifies three main blockers: the taboo of planned downtime, cultural and language gaps between IT and OT teams, and diffused budget and accountability. He documents a typical attack chain that begins in IT, moves laterally through poorly segmented networks, and exploits unmonitored legacy controllers, and recommends a pragmatic, phased response: risk-based inventory, IEC 62443-aligned segmentation, OT-aware monitoring, compensating controls and stepwise modernization to reduce exposure without halting production.