Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

aikido

Graphalgo campaign spreads to Terraform providers and Go Modules

Sep 22, 2026 By Oliver Smith In Aikido
We’ve identified Go malware distributed via at least two Terraform providers and at least two Go Modules. This is the first time we’ve observed malware distributed via Terraform providers. The following packages contain the malware: The malware overlaps with the Graphalgo NPM malware campaign, first reported by ReversingLabs in February 2026, and also reported on in the last week by Safedep, CheckMarx, and JFrog.
Read Post
trilio

How to Protect Backups from Ransomware

Sep 22, 2026 By Rodolfo Casas In Trilio
Ransomware crews go after backups first. Before any production file gets encrypted, they hunt down your backup catalog, snapshots, and repository credentials. The real question is whether your backups can survive an attacker who is actively trying to destroy them. This guide covers how to protect backups from ransomware with specifics: immutable and WORM storage, the 3-2-1-1-0 rule, air-gapping, network segmentation, encryption, and access controls that hold up under pressure.
Read Post
foresiet

CISA: Ransomware Gangs Now Exploit Critical VMware vCenter Flaw

Sep 17, 2026 By Foresiet In Foresiet
The U.S. Cybersecurity and Infrastructure Security Agency has warned that ransomware groups are now exploiting a critical VMware vCenter Server bug that Broadcom patched on 29 July 2026. The issue is CVE-2026-59310. It is a directory traversal flaw in the vCenter Syslog server. An attacker who can reach the server on the network does not need a password. Successful use can lead to remote code execution. The published severity score is 9.8.
Read Post
jumpsec

PAPERMILL: Tracking an Emerging China-Nexus Malware Factory

Sep 15, 2026 By [email protected] In JUMPSEC
JUMPSEC’s DART (Detection & Response Team) raised an alert to the Threat Research team regarding a specific ticket that arrived in a clients’ inbox, passing SPF, DKIM, and DMARC. The email contained an attachment and a subject which spoke about Tax Audits, that attachment, named “Tax_Notice_45594.exe” is not actually an exe but instead an.ISO. On the surface this looks like a fairly typical phishing lure, but the delivery mechanism underneath is anything but.
Read Post
jfrog

ParaShells: Parallels Desktop Turns Appliance Install Into a Root Shell

Sep 15, 2026 By Yuval Moravchick In JFrog
Your Mac runs a vulnerable version of Parallels Desktop. A malicious package, compromised CI job, or other unprivileged process is already running on it. No admin access. No Parallels-signed client. One appliance-install request later, attacker-controlled code runs as root. While testing Desktop 26.4.0 (build 57513) on Apple silicon, we found that an unprivileged local user could execute code as root through prl_disp_service.
Read Post
cyberint

Noodle RAT: A Recipe for Cross Platform Espionage

Sep 14, 2026 By Adi Bleih In Cyberint
Noodle RAT—also known as ANGRYREBEL or Nood RAT—is a modular remote access trojan (RAT) with dual versions for Windows and Linux, actively used by Chinese-speaking threat actors since at least mid-2016. It was previously misclassified as variants of Gh0st RAT or Rekoobe but is now recognized as a unique backdoor family.
Read Post
Featured Post
Why Data Governance Has Become a Critical Defence Against Ransomware in Healthcare

Why Data Governance Has Become a Critical Defence Against Ransomware in Healthcare

Sep 13, 2026 By Lorri Janssen-Anessi, VP of Global Risk Operations In BlueVoyant
Ransomware and ransomware-style attacks can have a catastrophic impact within healthcare, where disruption directly impacts safety and continuity. Today's ransomware groups increasingly operate as sophisticated criminal enterprises, sharing tools, infrastructure, and expertise through ransomware-as-a-service (RaaS) models. This lowers the barrier to entry for cybercriminals while allowing experienced threat actors to focus their efforts on identifying and exploiting high-value targets.
Read Post
armo

WebInject: The Web Agent Prompt Injection With No Payload

Sep 10, 2026 By Yossi Ben Naim In ARMO
A browser agent in your cluster opens a supplier portal, screenshots it, and clicks somewhere the task never called for. The page looks exactly like the page the supplier serves, and to the person who checks it later, it still does. The classifier in front of the agent returned nothing, because the instruction that produced the click does not exist.
Read Post
cato networks

Ransomware's AI Adoption Curve: From Marketing Claim to Operating Model

Sep 10, 2026 By Etay Maor In Cato Networks
Somewhere in the first nine months of 2026, AI stopped being a talking point in ransomware and became part of how the work actually gets done. Tracking new ransomware-as-a-service (RaaS) launches, darknet recruitment ads and public incident reporting through this period shows a three-step progression: AI as advertising, AI as an assistant, and AI built directly into ransomware.
Read Post

Ep. 79 - BeaverTail and InvisibleFerret: The Malware That Rewrites Itself for Every Target

Sep 9, 2026 By SafeBreach In SafeBreach
North Korea has stopped writing bad phishing emails. In Part 2 of our DPRK deep dive, Tova Dvorin and Adrian Culley break down how the Reconnaissance General Bureau and Bureau 121 weaponized AI in 2026: Blue Noroff cloning a CFO's voice to authorize emergency liquidity transfers, real-time face swaps passing DevOps job interviews, and Lazarus using LLMs to polymorph BeaverTail and InvisibleFerret for every single target.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.