Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Obrela's 2025 Digital Universe Report highlights shift to stealthy, identity-driven cyberattacks

Obrela's 2025 Digital Universe Report highlights shift to stealthy, identity-driven cyberattacks

Apr 21, 2026 By Obrela In Obrela
London, 21st April - Obrela has released its Digital Universe Report 2025, revealing a significant shift in the global cyber threat landscape as attackers move away from high-volume attacks toward more targeted, stealth-driven techniques focused on identity, access and persistence.
Read Post

Ep 39: This is your first ransomware attack, not ours

Apr 21, 2026 By Sumo Logic, Inc. In Sumo Logic
On this episode of Masters of Data, we sat down with Steven Manley, CTO of Druva, to get the unfiltered truth about ransomware: it's not a matter of if you'll be breached, but when, and bad actors are now launching hundreds of attacks at a surprisingly low cost. We dig into why attackers lurk undetected for 200-plus days, how AI is being weaponized for everything from eerily convincing voice phishing to secretly training your own AI systems against you, and why your most protected assets are rarely what gets hit first.
View Video
bluevoyant

The OtterCookie Matryoshka

Apr 21, 2026 By Curt Buchanan In BlueVoyant
Over the past month, the cybersecurity community has published isolated reports detailing disparate attacks by the North Korean state-aligned threat group Shifty Corsair (also known as FAMOUS CHOLLIMA). While individual vendors have documented specific supply chain poisons or targeted spear-phishing campaigns, the Threat Fusion Cell (TFCTI) at BlueVoyant has synthesized these findings to reveal a much larger, coordinated offensive.
Read Post
foresiet

The April 2026 AI Security Report: 6 Incidents and Detailed Attack Paths

Apr 21, 2026 By foresiet In Foresiet
From AI agents leaking internal data to coordinated global malware campaigns — here is everything that happened in AI cybersecurity between April 7 and April 21, 2026, with detailed attack paths for each incident. The fifteen days following April 7, 2026 produced six distinct AI-related security incidents spanning internal data exposure, supply chain exploitation, autonomous malware generation, coordinated multi-vector attacks, model leak fallout, and documented AI agent control failures.
Read Post

China-linked group targets cloud, Russian cyber espionage, agentic AI systems flaw & Nginx [313]

Apr 20, 2026 By LimaCharlie In LimaCharlie
In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community. Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform. This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows.
View Video
wallarm

Attacking the MCP Trust Boundary

Apr 20, 2026 By Wallarm In Wallarm
Every secure API draws a line between code and data. HTTP separates headers from bodies. SQL has prepared statements. Even email distinguishes the envelope from the message. The Model Context Protocol (MCP), the fast-growing standard for connecting AI agents to external services, inherits that gap from the models it sits on top of.
Read Post
Penetration Testing as a Tool That Reveals the Real State of Cybersecurity

Penetration Testing as a Tool That Reveals the Real State of Cybersecurity

Apr 20, 2026 By SecuritySenses In SecuritySenses
Most security measures are built on the assumption that if something is configured correctly, it is secure. But there is a big difference between "configured" and "able to withstand an attack" - a gap that cannot be seen without practical testing. Penetration testing is not just another item on a compliance checklist; it is a way to get an honest and realistic answer to the question that truly matters to a business: can an attacker reach what is most important to us?
Read Post
memcyco

How to Detect Man-in-the-Middle Attacks: Indicators, Methods, and Detection Gaps

Apr 17, 2026 By Ezra M. In Memcyco
Most MITM attacks don’t announce themselves. No alerts fire, no certificates visibly break, and no users report anything unusual. By the time the interception is discovered, credentials or session tokens are already in attacker hands. Knowing how to detect man-in-the-middle attacks requires looking across multiple layers: network traffic, DNS resolution, TLS certificate integrity, and session behavior.
Read Post
sophos

QEMU abused to evade detection and enable ransomware delivery

Apr 16, 2026 By Morgan Demboski In Sophos
Sophos analysts are investigating the active abuse of QEMU, an “open-source machine emulator and virtualizer,” by threat actors seeking to hide malicious activity within virtualized environments. Attackers are drawn to QEMU and more common hypervisor-based virtualization tools like Hyper-V, VirtualBox, and VMware because malicious activity within a virtual machine (VM) is essentially invisible to endpoint security controls and leaves little forensic evidence on the host itself.
Read Post
bitsight

Analyzing the RondoDox Botnet: A DDoS and Mining Threat

Apr 16, 2026 By João Godinho In BitSight
A few weeks ago we published the first part of this series where we described the infrastructure used by the RondoDox threat actors to scan and exploit vulnerable systems. In this second post we’ll take a deep dive into the malware that is deployed into vulnerable systems. Specifically, we’ll look at the initial implant used to fetch the RondoDox binary and the binary itself, detailing its behaviour, how it communicates with the Command and Control (C2), and its malicious capabilities.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.