Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

cato networks

Cato CTRL Threat Research: Vishing and Microsoft Teams Used to Deliver PhantomBackdoor

Mar 18, 2026 By Dr. Guy Waizel In Cato Networks
Cato CTRL has discovered a q-based delivery technique used against an Italy-based consumer services company associated with PhantomBackdoor, a multi-stage WebSocket-based backdoor previously reported in a Ukraine-focused spear phishing operation by SentinelOne. In SentinelOne’s earlier reporting, initial access relied on phishing lures and a ClickFix-style flow that triggered a staged PowerShell and ended with a WebSocket backdoor.
Read Post
aikido

Glassworm Strikes Popular React Native Phone Number Packages

Mar 16, 2026 By Raphael Silva In Aikido
On March 16, 2026, two React Native npm packages from the AstrOOnauta were backdoored in a coordinated supply chain attack. Both releases added an identical install-time loader that fetches and executes a multi-stage Windows credential and crypto stealer, triggered by nothing more than a routine npm install. The affected packages are react-native-country-select@0.3.91 and react-native-international-phone-number@0.11.8.
Read Post

What Healthcare Leaders Face After a Cyberattack

Mar 12, 2026 By Rubrik In Rubrik
In this episode of Building Cyber Resilience: A Healthcare Leader’s Guide, host Josh Howell speaks with Errol Weiss, Chief Security Officer at Health-ISAC. Drawing on decades of experience across government, finance, and healthcare, Errol walks through what leaders actually face in the hours and weeks following a cyberattack. The conversation explores why healthcare remains a top ransomware target, how uncertainty shapes recovery decisions, and why trusted, anonymous information sharing has become one of the sector’s strongest defenses.
View Video

What is Agentic AI vs GenAI?

Mar 11, 2026 By Rubrik In Rubrik
Everyone knows ChatGPT, but Agentic AI is where the real work happens. In this Agentic AI vs GenAI breakdown, we explain why Agentic AI is the next major leap, and what it means for your business and career. Here’s the difference: Generative AI (GenAI): Creates content. You ask, it writes, summarizes, or creates. Agentic AI: Does work. It is built on three core components: a brain (reasons), memory (context), and tools (the key that lets agents touch real systems like APIs and databases).
View Video
knowbe4

Ransomware Attacks Surge by 50% Even as Payments Drop

Mar 11, 2026 By KnowBe4 Team In KnowBe4
The number of ransomware attacks increased by 50% in 2025, even though the number of victims who decided to pay the ransom fell to an all-time low, according to a new report from Chainalysis. The size of the ransom for victims who did pay increased significantly, growing 368% year-over-year to nearly $60,000. The total ransom payments observed by Chainalysis last year amounted to $820 million.
Read Post
safeaeon

Polymorphic Viruses and Their Impact on Cybersecurity

Mar 9, 2026 By SafeAeon Inc. In SafeAeon
A polymorphic virus is one of the hardest types of malware to detect because it can change into different forms. Because these advanced threats can modify their code in specific ways, they are very hard for standard signature-based antivirus systems to detect. Polymorphic viruses, on the other hand, use dynamic code encryption and mutation engines to alter their code structure, making them even harder to detect. The need for strong defenses has never been greater as hackers continue to use these methods.
Read Post

Daniel dos Santos on defending against opportunistic cyberattacks

Mar 6, 2026 By Rubrik In Rubrik
Complicated, targeted attacks aren’t the only methods you should be on the lookout for. Security fundamentals are important for defending against opportunistic that can cause chaos! On this episode of Data Security Decoded, Daniel dos Santos (VP of Research, Forescout Technologies) and host Caleb Tolin explore attacker motivations, common entry points, and what defenders must prioritize now. Listen to the full episode on our YouTube channel, or wherever you get your podcasts.
View Video
bluevoyant

New A0Backdoor Linked to Teams Impersonation and Quick Assist Social Engineering

Mar 6, 2026 By Thomas Elkins and Joshua Green In BlueVoyant
BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) continue to track an activity cluster that uses email bombing and IT-support impersonation over Microsoft Teams to obtain Quick Assist access, then pivot to a deeper attack. This research shows that once on the victim’s host, the actors sideload a malicious DLL to deliver a new backdoor BlueVoyant has dubbed the A0Backdoor.
Read Post
securonix

VOID#GEIST: Stealthy MultiStage Python Loader with Embedded Runtime Deployment, Startup Persistence, and Fileless Early Bird APC Injection into explorer.exe

Mar 5, 2026 By tldr: In Securonix
Securonix Threat Research analyzed a stealthy, multi-stage malware intrusion chain utilizing an obfuscated batch script (non.bat) to deliver multiple encrypted RAT shellcode payloads corresponding to XWorm, XenoRAT, and AsyncRAT.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.