All news with #threat report tag

📚 Check Point Research reports a sharp rise in cyber attacks against the education sector between January and July 2025. Across that period the sector averaged 4,356 attacks per organization each week, representing a 41% year‑over‑year increase. The trend is global, affecting both developed and developing regions and coincides with the back‑to‑school season. Schools and institutions are urged to strengthen defenses and incident preparedness.

🔍 A joint advisory from the UK, US and allied partners attributes widespread cyber-espionage operations to the Chinese APT group Salt Typhoon and alleges assistance from commercial vendors that supplied "cyber-related products and services." The report names Sichuan Juxinhe Network Technology, Beijing Huanyu Tianqiong Information Technology and Sichuan Zhixin Ruijie Network Technology. It warns attackers exploited known vulnerabilities in edge devices to access routers and trusted provider connections, and urges immediate patching, proactive hunting using supplied IoCs, and regular review of device logs.

🔒 In the August 2025 edition, ESET Chief Security Evangelist Tony Anscombe highlights major global developments that affect defenders and users alike. Key items include WhatsApp's takedown of 6.8 million scam-linked accounts in H1 2025, the UK government's reversal on an Apple cloud decryption demand, attacks on water facilities in Norway and Poland, and Nigeria's deportation of over 100 foreign nationals tied to a large cybercrime syndicate. He also notes auctions of active police and government email credentials on criminal forums and underscores lessons for resilience, encryption policy, and international cooperation.

🛡️ The U.S. Treasury's Office of Foreign Assets Control (OFAC) announced sanctions on two individuals and two entities tied to a DPRK remote IT-worker revenue scheme that funneled illicit funds to weapons programs. Targets include Vitaliy Andreyev, Kim Ung Sun, Shenyang Geumpungri Network Technology Co., Ltd, and Korea Sinjin Trading Corporation. Treasury says nearly $600,000 in crypto-derived transfers were converted to U.S. dollars and that front companies generated over $1 million in profits. Officials also highlighted the group's use of AI tools to fabricate résumés, secure employment, exfiltrate data, and enable extortion.

🛡️ The FBI says the Chinese-linked hacker group Salt Typhoon has been observed operating in at least 80 countries, with activity reported across regions including the UK, Canada, Australia and New Zealand. U.S. authorities disclosed that the actors compromised U.S. telecommunications firms, exfiltrating more than one million connection records and targeting calls and SMS for over 100 Americans. A detailed technical analysis was published with international partners, including Germany's BSI, to help network defenders detect and remediate the intrusion, and U.S. officials now say the activity appears to have been contained.

🔒 A recent Accenture report warns that only 34% of companies have a mature cyber strategy and just 13% possess advanced capabilities to defend against AI-driven threats, leaving many organizations exposed. Industry leaders identify a persistent shortage of specialized cybersecurity talent as the central obstacle: 83% of IT leaders say the lack of cyber talent is a major barrier. Experts cite systemic causes beyond pay, including burnout and unsustainable workplace culture, and point to gender imbalance and gaps in vocational training as missed opportunities. Some analysts expect AI to help by automating repetitive tasks and easing staff burnout, but training and structural reforms are still urgently needed.

🔹 CrowdStrike was named a Leader in the IDC MarketScape: Worldwide Incident Response Services 2025 assessment, recognized for its AI-native Falcon platform and a global 24/7 incident response model. The company combines over 100,000 hours of annual IR casework with frontline breach expertise to speed detection, investigation and containment. Its follow-the-sun delivery and AI-augmented tooling reduce time-to-recovery, while proactive offerings like CrowdStrike Pulse Services help customers build long-term resilience.

🔒 Google has been named a Leader in the IDC MarketScape: Worldwide Incident Response 2025, recognizing Mandiant—now integrated into Google Cloud Security—for its decades of incident response expertise. The report praises Mandiant’s "team of teams" model, rapid crisis communications capability, and integration with Google's SecOps platform. Proprietary tools like FACT and Monocle and combined threat intelligence with VirusTotal enhance enterprise-scale investigations.

🔒 Palo Alto Networks' Unit 42 has been named a Leader in the 2025 IDC MarketScape for Worldwide Incident Response Services. Published 2025-08-26 by Sam Rubin, the announcement highlights Unit 42's threat-informed, tech-driven methodology combining telemetry from over 70,000 customers, tracking of more than 200 threat groups, and 150+ intel partnerships. Deep integration with Palo Alto Networks platforms, notably Cortex, plus AI and automation, is credited with faster detection, containment, and reduced dwell time. Unit 42 emphasizes post-incident transformation mapped to MITRE ATT&CK and NIST to help organizations not only recover but emerge more resilient.

🔒 Cisco Talos identified a roughly 1.4× rise in ransomware incidents in Japan during H1 2025, with 68 confirmed cases versus 48 in the same period last year. Attacks continued to focus on small and medium-sized enterprises, with manufacturing the most affected sector. The report highlights active groups such as Qilin, RansomHub and Hunters International and spotlights the emerging Kawa4096/KaWaLocker family. Talos recommends layered defenses including Cisco Secure Endpoint, Secure Email and Secure Malware Analytics, and publishes IOCs for responders.

🔍 Cisco Talos describes UAT-7237, a Chinese‑speaking APT active since 2022 that compromised a Taiwanese web hosting provider to establish long‑term persistence. The actor relies largely on open‑source tooling, customized utilities and a tailored shellcode loader tracked as SoundBill, which can decode and execute Cobalt Strike beacons. UAT-7237 favors SoftEther VPN and RDP for access rather than mass web‑shell deployment. Talos provides IOCs and mitigation guidance for detection and blocking.

🔍 Cisco Talos describes a widespread malvertising campaign delivering a modular malware framework called PS1Bot. The multi-stage operation uses in-memory PowerShell and C# components to steal browser credentials, target cryptocurrency wallets, capture screenshots and keylogs, and maintain persistent access through modular updates. Active and evolving through 2025, PS1Bot minimizes its footprint to evade detection. Talos urges caution when downloading files, keeping security software current, and using dedicated password managers instead of browser-stored credentials.

🔍 ESET's H1 2025 Threat Report highlights a sharp rise in manipulative social-engineering techniques, coordinated infostealer takedowns, and aggressive infighting among ransomware groups. Hosts Aryeh Goretsky and Ondrej Kubovič analyze the rapid emergence of ClickFix, including the FakeCaptcha variant that coaxes victims into executing commands. They also summarize law enforcement disruptions of RedLine/Meta Stealer and other services, and recount a brazen “deathmatch” in which the small actor Dragonforce defaced and dismantled rival data leak sites.

🔔 Unit 42 reports active exploitation of multiple on‑premises SharePoint vulnerabilities collectively dubbed ToolShell, enabling unauthenticated remote code execution, authentication bypass, and path traversal. Activity observed from mid‑July 2025 includes web shell deployment, theft of ASP.NET MachineKeys and ViewState material, and delivery of the 4L4MD4R ransomware in at least one chain. Organizations with internet‑exposed SharePoint servers should assume potential compromise and follow containment, patching, cryptographic rotation, and incident response guidance immediately.

🛡️ In July 2025, ESET Chief Security Evangelist Tony Anscombe highlighted major cybersecurity incidents, including exploitation of ToolShell zero‑day vulnerabilities in on‑premises Microsoft SharePoint and the confirmed return of Lumma Stealer. Other critical stories included a ransomware attack that closed UK transport firm KNP, a massive data exposure in McDonald's hiring chatbot McHire, and the discovery of PerfektBlue Bluetooth flaws affecting vehicles. The UK also proposed banning ransom payments by public bodies.

🛡️ The ESET research team has released the H1 2025 Threat Report, summarizing cyberthreat activity from December 2024 through May 2025. The report highlights a rapid rise in a new social engineering technique, ClickFix, with detections increasing more than fivefold, and a 160% surge in Android adware linked to evil twin fraud and PUAs. It also notes growing numbers of ransomware attacks and gangs even as overall payment values trended downward. Watch ESET Chief Security Evangelist Tony Anscombe's video overview and consult the full report for details and mitigation guidance.

🔍 The latest ESET APT Activity report and podcast episode summarize intrusion activity observed across Q4 2024–Q1 2025, highlighting persistent and evolving adversary techniques. ESET researchers spotlight China-aligned actors such as UnsolicitedBooker, which repeatedly targeted the same organization with the MarsSnake backdoor, and tool-sharing trends centered on groups like Worok. The report also covers Russia-aligned operations — Sednit’s expanded Operation RoundPress against webmail platforms, ongoing Gamaredon obfuscation in Ukraine, and Sandworm’s use of the ZEROLOT wiper — plus activity from other regional actors that complicate attribution and detection.