Beat
Intrusions
Breaches, ransomware, APT campaigns and the malware behind them.
- 50
- stories
- OCT 18
- latest
All Intrusions · page 3
Senator Flags Microsoft’s Role in the Ascension Ransomware Hack
Sen. Ron Wyden (D-Ore.) wants the U.S. government to hold Microsoft responsible “for contributing to ransomware attacks against critical U.S. infrastructure” like Ascension.
Lindsey O'Donnell-Welch · 2 min
Attack Compromises Popular NPM Packages
The affected packages include Chalk and Debug, and one of the contributors to those packages said the compromise was the result of him clicking on a phishing email related to setting up 2FA on his account.
Dennis Fisher · 4 min
Wyden Slams Federal Judiciary After Court Hack
In a scathing letter, Sen. Ron Wyden (D-Ore.) blasted the federal judiciary for its handling of a (second) hack of the federal courts’ case management system earlier this year.
Lindsey O'Donnell-Welch · 3 min
Cloudflare Details Salesloft Drift Breach
This incident is the latest to stem from an intrusion at Salesloft in which attackers used OAuth tokens to target Salesloft customers’ Salesforce integrations.
Dennis Fisher · 3 min
UNC6395 Expands Data Theft Campaign to Email OAuth Tokens
Google researchers discovered the new attacks and are advising all customers to treat any authentication tokens for those integrations as compromised.
Dennis Fisher · 2 min
US Gov Links Private Chinese Firms to Salt Typhoon Hacks
Salt Typhoon has not been observed exploiting zero-day flaws, but instead targeting known bugs in exposed network edge devices – some of which are years old.
Lindsey O'Donnell-Welch · 3 min
Attacks Hit Possible SonicWall Zero Day
Attackers are exploiting a likely zero day vulnerability in some versions of SonicWall Firewall devices with the SSL VPN functionality enabled, and in some cases are able to bypass MFA protections. The intrusions have been ongoing since at least the end of last week, and researchers have observed some attackers deploying the Akira ransomware after…
Dennis Fisher · 2 min
New PXA Stealer Campaign Hits Victims Worldwide
A group of attackers with ties to the Vietnamese cybercrime underground ecosystem are running a significant campaign across many different countries that is delivering the PXA Stealer malware and uses novel sideloading and anti-analysis techniques to slip past defensive measures. The campaign has targeted victims in more than 60 countries and the attackers have harvested…
Dennis Fisher · 2 min
Microsoft Finds Secret Blizzard Targeting Foreign Diplomats
Microsoft has uncovered a long-running campaign by a threat group affiliated with Russian intelligence that has targeted diplomats working in Russia with a custom tool called ApolloShadow that enables the group to maintain persistence on victims’ devices as part of a cyberespionage operation. The group is known as Secret Blizzard and Microsoft’s researchers found that…
Dennis Fisher · 2 min
Chinese Attackers Target SharePoint CVE-2025-53770
Three separate Chinese threat groups are exploiting a set of recently disclosed vulnerabilities in on-premises Microsoft SharePoint installations, and Microsoft and CISA are urging companies that haven’t yet updated their installations to do so as quickly as possible. Microsoft first published information about the two flaws (CVE-2025-53770 and CVE-2025-53771) on July 19 after seeing active…
Dennis Fisher · 1 min