Beat
Intrusions
Breaches, ransomware, APT campaigns and the malware behind them.
- 50
- stories
- OCT 18
- latest
Ongoing Microsoft 365 Campaign Abuses ConnectWise App
Threat actors have compromised a credential within the vendor’s infrastructure, allowing them to abuse a client assertion that bypasses traditional user authentication.
DENNIS FISHER · OCT 18 · 3 min
All Intrusions
FBI Warns of FortiBleed Attacks Leading to Lockouts, Ransomware
FortiBleed attacks are continuing, with the FBI and Secret Service warning of compromised Fortinet firewalls, account lockouts and potential ransomware activity.
Lindsey O'Donnell-Welch · 2 min
Inside the Citrix NetScaler Zero Day Saga
This case is yet another reminder just how important vendor communication is in such incidents and how much uncertainty can hamper security.
Dennis Fisher · 1 min
Fake LastPass Authenticator Pages Deliver Rapuncel Infostealer
Attackers impersonated LastPass Authenticator on fake GitHub pages to deliver the Rapuncel infostealer in a campaign involving 40 fake brands.
Lindsey O'Donnell-Welch · 2 min
New Campaign Weaponizes Microsoft Teams for Remote Access
Unlike standard commodity malware that aims for quick credential theft, this campaign features a manual, hands-on-keyboard scheme designed to escalate rapidly from a single compromised workstation to broad, network-wide access.
Dennis Fisher · 2 min
The Joy and Pain of OT Cybersecurity: A Conversation With Lesley Carhart
Lesley Carhart has been cleaning up malware, intrusions, ransomware, and other messes in OT networks for the better part of two decades and recently joined Dennis Fisher on the Decipher podcast to talk about the special challenges OT networks present
Dennis Fisher · 4 min
Chinese APT UAT-7810 Expands Malware Arsenal
The investigation into UAT-7810 shows significant evolution in their toolkit, specifically the development of a successor to their previously documented SHORTLEASH backdoor.
Dennis Fisher · 2 min
Evil Is as Evil Does: New EvilTokens Affiliate Panel Uncovered
This new ARToken operator panel has a clear lineage going back to the EvilTokens framework, which emerged in early 2026.
Dennis Fisher · 2 min
New Turla Stockstay Backdoor Emerges
Known historically for its tight ties to Russia’s FSB and its development of the Snake implant, Turla has leveraged STOCKSTAY to target sensitive government and military organizations.
Dennis Fisher · 2 min
FortiBleed Credential Theft Campaign Marches On
The campaign is not the result of a compromise of Fortinet itself, but rather involves the attackers testing a custom list of known passwords for Fortinet devices.
Dennis Fisher · 2 min
Check Point VPN Flaw Targeted by Ransomware Actors
The vulnerability is a critical one and Check Point Research said that it’s likely that the actor targeting the bug is a financially motivated group.
Dennis Fisher · 2 minGitHub Confirms Internal Breach
The company said it is still working through the intrusion but does not believe any customer repositories or data was affected at this point.
Dennis Fisher · 3 min
Data Shows Thousands of Automatic Tank Gauges Exposed Across the US
As of May 2026, over 6,502 ATG services running on 6,057 unique hosts were found to be reachable on the public internet across more than 65 countries.
Dennis Fisher · 2 min
Ongoing Supply Chain Attack Expands to PyPi
Researchers have linked the compromise to the “Mini Shai-Hulud” campaign, which has been ongoing for several weeks and is associated with TeamPCP.
Dennis Fisher · 3 min
Cisco CVE-2026-20133 Targeted in Active Attacks
The three newly added bugs are CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133, the last of which had not been identified in active attacks before.
Dennis Fisher · 2 min
The $285M Drift Protocol Heist Was ‘6 Months in the Making’
During the largest DeFi hack of 2026, it only took attackers 12 minutes to drain millions in user assets – but the build up to the attack took six months of meticulously planned social engineering.
Lindsey O'Donnell-Welch · 5 min
Supply Chain Attack Hits Axios NPM Packages
Axios is a dependency in nearly 80% of all cloud and code environments and sees approximately 100 million downloads per week.
Dennis Fisher · 4 min
Microsoft Uncovers New Malicious Campaign Targeting Developers
This campaign is an offshoot of the more familiar and pervasive fake job interview and phony tech worker scams that have been coming from North Korea for several years.
Dennis Fisher · 3 min
