Beat
Intrusions
Breaches, ransomware, APT campaigns and the malware behind them.
- 50
- stories
- OCT 18
- latest
All Intrusions · page 2
Google Disrupts ‘Prolific, Elusive’ China-Linked Actor
Google said it has found 53 victims that have been impacted by the group, which it has tracked since 2017.
Decipher · 2 min
New SystemBC Botnet Activity Targets Systems Worldwide
The SystemBC botnet malware has become a critical component in the modern threat landscape, often preceding a full-scale ransomware deployment.
Dennis Fisher · 2 min
Google Mandiant: ShinyHunters Attacks Target SaaS Platforms Via SSO, MFA Abuse
The series of incidents detailed by Mandiant researchers started in early to mid-January, and included a previously disclosed campaign involving Okta customers.
Decipher · 2 min
Google Disrupts IPIDEA Residential Proxy Network
Google researchers observed more than 550 individual threat groups using IPIDEA exit nodes during a one-week period earlier this month.
Dennis Fisher · 3 minCybercrime and APT Groups Exploiting WinRAR Bug
Exploitation of CVE-2025-8088 in the wild began before disclosure, with attacks confirmed as early as July 18, 2025.
Dennis Fisher · 4 minFortinet FortiGate Devices Targeted in New Campaign
This activity shares some similarities with a campaign that researchers at Arctic Wolf identified in December. That campaign started soon after Fortinet disclosed two authentication bypass flaws (CVE-2025-59718 and CVE-2025-59719).
Dennis Fisher · 3 min
A New Chinese APT Takes the Stage
Active since at least 2022, UAT-7290 demonstrates a significant capacity for conducting deep-seated espionage while simultaneously functioning as an initial access group.
Dennis Fisher · 2 min
Russian Hackers Target Misconfigured Edge Devices in ‘Concerning Evolution’ For Critical Infrastructure Attacks
Amazon researchers highlighted a “tactical pivot” by Russian GRU hackers who have been moving away from zero-day and N-day exploitation.
Lindsey O'Donnell-Welch · 2 min
Broad Exploit Activity Targets React2Shell Flaw
The vulnerability was disclosed publicly on Dec. 3 and researchers and threat intelligence teams immediately began seeing opportunistic and targeted exploitation attempts.
Dennis Fisher · 3 min
New Shai Hulud NPM Worm Emerges
Researchers from Wiz are currently tracking more than 25,000 affected repositories across approximately 350 unique users.
Dennis Fisher · 2 min
Marks and Spencer’s Profit Drop: The Financial Toll of Cyberattacks
The financial impacts of cyberattacks are hard to measure – but they lend critical context to conversations around security risk at the boardroom level.
Lindsey O'Donnell-Welch · 5 min
APT Targets Cisco and Citrix Zero Days
The chain of discovery began with Amazon’s security honeypot service, MadPot, which detected exploitation attempts for the Citrix Bleed Two vulnerability (CVE-2025-5777) before its public disclosure
Dennis Fisher · 2 min
New Lazarus Group Campaign Targets EU Defense Companies
The suspected objective of the Lazarus group was the exfiltration of proprietary information and manufacturing expertise, particularly pertaining to UAV technology.
Dennis Fisher · 3 min
F5: Attacker Accessed BIG-IP Source Code, Bug Data
The company discovered the intrusion in August but did not say when the attackers first gained access to F5’s systems or how long they had access.
Dennis Fisher · 2 min
Oracle Clop Data Theft Campaign Started Months Ago
The Clop extortion campaign on Oracle customers last week stemmed from months of intrusion activity tracking back to July 10.
Lindsey O'Donnell-Welch · 2 minAkira Ransomware Actors Target SonicWall SSLVPN
This aggressive approach aligns with Akira’s historical tactics of exploiting VPN infrastructure as an initial access vector.
Dennis Fisher · 2 min
Cisco Warns of Attacks on Two ASA Flaws
Cisco’s Talos threat intelligence team said this campaign is the work of an actor it tracks as UAT4356, an APT team that has previously targeted ASA devices.
Dennis Fisher · 3 min
Three Takeaways From the EU Airport Outages
The incident is a pointed example of how an intrusion at a key point in the software supply chain can have a wide range of downstream effects.
Dennis Fisher · 2 min
Russian APT Groups Turla, Gamaredon Collaborate to Target High-Profile Ukrainian Entities
In a new report, ESET researchers have detailed several instances when the two groups’ tools have been found on the same compromised machines in Ukraine.
Dennis Fisher · 3 min
Microsoft, Cloudflare Disrupt RaccoonO365 Phishing Kit Service
Microsoft and Cloudflare this week announced that they paired up to disrupt RaccoonO365, a phishing-as-a-service cybercriminal enterprise.
Lindsey O'Donnell-Welch · 3 min
