The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO). The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail, involved the use ofRead More »Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader

ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup. The company said it has completed the following actionsRead More »ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident

An attacker used a contributor’s GitHub account to replace the download archives on five existing releases of OVHcloud’s command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it,Read More »Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware

Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of maliciousRead More »ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

A U.S. court on Monday granted the U.S. government’s request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company’s San Francisco office to allegedly steal sensitive secrets. In a new court filing Sunday, prosecutors revealed that Abdulrahman Alfozan, aRead More »Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge

Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that’s being used to distribute malware such as Legion Loader. According to Forescout Research – Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users intoRead More »Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware

A report by Fingerprint analyzed the state of artificial intelligence (AI) traffic within financial services organizations.