All news in category “Threat and Trends Reports”

📧 Business email compromise (BEC) is a targeted fraud where attackers impersonate executives, vendors, or partners to trick employees into wiring funds or revealing sensitive data. Last year BEC caused $2.7 billion in losses and increasingly uses techniques like AI-based voice/text cloning, QR-code scams, and conversation hijacking. These attacks often require no malware, relying instead on reconnaissance and trust. Defenses include multi-factor verification, approval tiers, employee training, and advanced email authentication and detection.

🔒 This article profiles major ransomware varieties — including crypto, double extortion, encryptionless, locker, scareware and Ransomware-as-a-Service — and explains how they operate. It outlines common detection approaches such as behavioral, signature, heuristic, and deception techniques. The piece also situates ransomware within the broader malware landscape and describes how Huntress’ 24/7 human-led monitoring and containment reduce risk.

🔒 Attackers frequently exploit common endpoint weaknesses—exposed Remote Desktop Protocol (RDP), sophisticated phishing, abused Remote Monitoring and Management (RMM) tools, and unpatched software—to gain access and persist. The article shows how brute-force RDP, AI-enhanced phishing, and misconfigured RMMs enable lateral movement and stealthy persistence. Implement MFA, regular patching, EDR, RMM audits, and user training to reduce risk.

🛡️ 1Campaign is a cloaking service that helps threat actors run malicious Google Ads by passing automated screening and serving benign pages to security researchers while exposing real users to phishing and crypto-drainer content. According to Varonis, the platform offers a dashboard for targeting by geography, ISP, and device, and assigns fraud risk scores to filter out cloud-based and researcher traffic. It also includes a Google Ads launcher that aids operators in bypassing policy checks and impersonating brands, allowing malicious ads to remain online until manually reported.

🔒Business email compromise (BEC) is a high-impact social engineering threat that targets organizations' financial and identity workflows. The article outlines pragmatic defenses: enforce MFA, validate DMARC/DKIM/SPF, deploy advanced phishing and spoofing filters, and maintain continuous security awareness training with simulated attacks. It also recommends dual-approval for large transfers, stricter help-desk verification, and monitoring for anomalies such as mailbox forwarding rules, impossible-travel logins, and last-minute bank-detail changes to accelerate detection and response.

🔎 Business Email Compromise (BEC) exploits social engineering and subtle technical deception to manipulate employees and bypass controls. Attackers use domain tweaks, display-name spoofing, urgent off-hours requests, and impersonation to pressure finance, HR, or operations into transfers or data disclosure. Inspect headers and SPF/DKIM/DMARC, enforce MFA, run phishing simulations, and maintain a strict verification culture.

🔍 DTEX's Cost of Insider Risks 2026 report, produced with the Ponemon Institute, finds employee negligence — driven in part by shadow AI — caused 53% of the average $19.5m loss per organization. Malicious incidents accounted for $4.7m and phishing-related 'outsmarted' employees $4.5m. The study warns undocumented AI, personal webmail and file sharing create exposure and urges behavioral intelligence, identity-centric controls and AI governance to reduce incidents.

🔍 Recent joint research from Palo Alto Networks, Siemens and the Idaho National Laboratory shows that most OT-impacting attacks originate in IT and manifest at the IT–OT edge. Analysts found attackers dwell an average of 185 days in precursor phases, producing detectable signals like credential abuse, reconnaissance and protocol misuse. The paper recommends edge-focused telemetry and an OT SOC-driven active defense to detect and disrupt threats before operational impact.

🔍 ReliaQuest's Annual Cyber‑Threat Report 2026 found attackers are using AI and automation to reduce average breakout time to 34 minutes (29% faster than 2024), with the fastest lateral movement recorded at four minutes and the quickest exfiltration at six minutes. The firm says 80% of ransomware groups used automation or AI last year. Defenders can respond faster using agentic AI, achieving average containment in four minutes versus 16 hours without automation, and should prioritise visibility, inventory management and stronger identity controls.

🔐 Most identity programs still triage work like IT ticket queues—by volume, noise, or failed control checks—an approach that breaks when environments are increasingly non-human and partially onboarded. Identity risk is a function of controls posture, hygiene, business context, and intent; missing controls matter differently depending on what an identity can access. Hygiene failures such as orphan, local, or dormant accounts create low-effort paths for attackers and autonomous agents. Orchid builds an identity graph from telemetry, scores contextual risk, ranks toxic combinations, and sequences remediation to reduce real exposure rather than just shrink a findings list.

⚠️ CrowdStrike's Global Threat Report 2026 warns that AI-enabled cyber-attacks rose 89% in 2025 as adversaries used machine learning and LLMs to scale and refine phishing, disinformation and malware operations. Researchers observed LLMs producing multilingual, convincing phishing lures and automating campaign creation, while some actors embedded prompting into malware (eg, LameHug) for reconnaissance. CrowdStrike recommends strong identity controls, AI-focused awareness training and threat-intel monitoring to mitigate the accelerating threat.

🔍 Security leaders remain largely removed from top executive decision-making despite growing prominence. IANS Research and Artico Search’s 2026 State of the CISO Benchmark Report finds 64% of CISOs still report into IT while only 11% report to the CEO. Experts argue that such arrangements can create conflicts of interest as CIO incentives favor efficiency and delivery over enterprise risk reduction. Many urge giving CISOs independence, a clear seat at the table, and reporting aligned to enterprise risk owners.

🛡️ CrowdStrike reports that adversaries shifted in 2025 from expanding toolsets to prioritizing evasion, using AI to refine phishing, malware scripts, and reconnaissance while favoring malware-free techniques that blend with legitimate user activity. AI-enabled attacks rose 89% year over year and malware-free methods accounted for 82% of detections. Supply chain compromises, rapid zero-day weaponization, and cloud-focused intrusions amplified stealth, with big-game ransomware groups moving to remote encryption and credential abuse to minimize detection.

🔍 The CrowdStrike 2026 Global Threat Report reviews 2025 as the year of the evasive adversary, detailing how attackers shifted to subtle, trust-based techniques across endpoint, identity, SaaS, and cloud environments. Adversaries accelerated operations using AI and exploited AI systems themselves, while supply chain compromises and zero-day usage rose markedly. The report highlights rapid breakout times, a high rate of malware-free intrusions, and significant increases in state-nexus activity, offering prioritized insights for defenders.

🛡️ This weekly recap highlights high‑impact incidents and emerging trends across devices, cloud services, and supply chains. Key items include a Dell RecoverPoint zero‑day (CVE‑2026‑22769) actively exploited to install web shells and backdoors and PromptSpy, an Android malware that leverages Google Gemini and accessibility services for persistence. The report also calls out a near‑30 Tbps DDoS surge, malicious Docker Hub images, and deceptive "double‑tap" skimmers targeting e‑commerce. Review the prioritized CVEs and advisories and map mitigations to your environment.

🔍 Kaspersky researchers uncovered a new infostealer named Arkanix that blends rapid, probable LLM-assisted development with a dual-language architecture. The malware is offered as a MaaS, giving customers a control panel to configure Python or C++ payloads and retrieve statistics. The Python variant prioritizes broad, fast data harvesting while the native C++ build focuses on stealth, performance, and persistence. Observed deployment mechanisms include configurable loaders, C2 domains and even Discord-based tests.

🔍Typosquatting remains a highly effective deception tactic where attackers register look-alike domains to phish, harvest credentials, and deliver malware. CrowdStrike describes how adversaries exploit weak registrar verification and craft convincing WHOIS records while using techniques such as strategic HTTP redirects, geo-targeted content and fake sale pages to evade detection. Organizations should monitor registrations, protect brands, and use Falcon Adversary Intelligence to detect and disrupt campaigns.

🔍 Kaspersky researchers analyzed a short-lived information stealer called Arkanix, promoted on dark web forums in late 2025 and likely developed with LLM assistance. The project included a control panel, a Discord community, and two tiers: a Python-based basic build and a VMProtect-wrapped C++ premium variant with enhanced AV evasion and wallet injection. Arkanix features modular data theft from browsers, wallets, Telegram and Discord, plus optional post-exploitation modules; the author removed infrastructure within two months, complicating detection and tracking.

🔍 Researchers report that Intellexa's Predator commercial spyware can suppress iOS camera and microphone recording indicators by hooking a single SpringBoard method. The malware intercepts sensor updates using a function named HiddenDot::setupHook() and nullifies the SBSensorActivityDataProvider object so the green or orange status dots never reach the UI. The technique requires prior kernel-level access and is combined with ARM64 instruction pattern matching and Pointer Authentication Code (PAC) redirection to bypass camera permission checks, while VoIP recordings also rely on the same upstream interception for stealth.

🔐 Starkiller is a phishing-as-a-service that dynamically loads live login pages and proxies user interactions through attacker-controlled infrastructure. It generates deceptive URLs that visually mimic legitimate domains (for example using an @-based URL trick), spins up containerized headless browsers, and records every keystroke, session token, and MFA code. The platform streams sessions in real time, harvests cookies and MFA codes, and delivers campaign analytics and Telegram alerts to customers.