Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

bluevoyant

Operation Repo Ruse

Jan 15, 2026 By Thomas Elkins and Joshua Green In BlueVoyant
BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) researchers identified an active campaign by the prolific threat actor Rift Brigantine (a.k.a. TA505, FIN11, and Graceful Spider). In this iteration, the actor is leveraging fraudulent GitHub repositories to distribute malicious batch script installers masquerading as legitimate IT and security software, including Microsoft Remote Desktop Connection Manager (RDCMan) and Palo Alto Networks GlobalProtect.
Read Post
cyberark

UNO reverse card: stealing cookies from cookie stealers

Jan 15, 2026 By Ari Novick In CyberArk
Criminal infrastructure often fails for the same reasons it succeeds: it is rushed, reused, and poorly secured. In the case of StealC, the thin line between attacker and victim turned out to be highly exploitable. StealC is an infostealer malware that has been circulating since early 2023, sold under a Malware-as-a-Service (MaaS) model and marketed to threat actors seeking to steal cookies, passwords, and other sensitive data from infected computers.
Read Post

Start Where You Are: Resilience in Healthcare Begins With Action

Jan 14, 2026 By Rubrik In Rubrik
In this episode of Building Cyber Resilience: A Healthcare Leader’s Guide, Josh Howell, Healthcare CTO at Rubrik, sits down with Heather Costa, Director of Technology Resilience at Mayo Clinic and Vice President at WiCyS Healthcare. Heather breaks down what it takes to build real resilience inside complex healthcare systems where downtime carries human consequences. She shares practical frameworks for prioritization, overcoming analysis paralysis, and aligning leadership around what matters when every minute counts.
View Video
securonix

SHADOW#REACTOR - Text-Only Staging, .NET Reactor, and In-Memory Remcos RAT Deployment

Jan 12, 2026 By Akshay Gaikwad, Shikha Sangwan, Aaron Beardslee In Securonix
The Securonix Threat Research team has analyzed a multi-stage Windows malware campaign tracked as SHADOW#REACTOR. The infection chain follows a tightly orchestrated execution path: an obfuscated VBS launcher executed via wscript.exe invokes a PowerShell downloader, which retrieves fragmented, text-based payloads from a remote host. These fragments are reconstructed into encoded loaders, decoded in memory by a .NET Reactor–protected assembly, and used to fetch and apply a remote Remcos configuration.
Read Post
Snyk

Beyond Detection: Building a Resilient Software Supply Chain (Lessons from the Shai-Hulud Post-Mortem)

Jan 8, 2026 By Liran Tal In Snyk
The Shai-Hulud npm supply chain incident was a wake-up call for the industry. The attack involved malicious packages containing hidden exfiltration scripts that targeted developers’ machines and CI environments. At Snyk, we watched this incident unfold in real-time, observing how quickly attackers can pivot from one compromised credential to a full-scale ecosystem infection.
Read Post
apono

What Is the Shai Hulud npm Worm and How to Protect Against It

Jan 6, 2026 By The Apono Team In Apono
Shai Hulud didn’t invent a new supply chain weakness. It took advantage of something most teams already struggle with: long-lived credentials sitting on developer laptops and CI runners. Once it landed in a workstation or pipeline, it went hunting for secrets, then moved into GitHub, npm, and cloud environments. The damage is huge.
Read Post
CrowdStrike

How CrowdStrike's Malware Analysis Agent Detects Malware at Machine Speed

Jan 6, 2026 By Rob Horrigan - Thuy Nguyen In CrowdStrike
At Fal.Con 2025, CrowdStrike introduced Threat AI, an agentic threat intelligence system of autonomous agents that reason across data, hunt for threats, and take action. As part of our vision for the agentic SOC, these AI-powered agents automate complex intelligence workflows so defenders can keep up with AI-powered adversaries while staying in control of every decision.
Read Post
Digital Security Risks During Separation or Divorce: Protecting Your Privacy When Relationships Break Down

Digital Security Risks During Separation or Divorce: Protecting Your Privacy When Relationships Break Down

Dec 31, 2025 By SecuritySenses In SecuritySenses
During separation or divorce, the breakdown of a relationship often brings unexpected digital risks alongside emotional and financial challenges. Many couples spend years sharing passwords, devices, and online accounts without a second thought. However, when trust erodes, this shared digital access can quickly turn into a serious cybersecurity and privacy concern. Understanding how digital exposure happens and how to manage it responsibly is becoming an essential part of modern family disputes.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.