Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Unleash Agents. Not Risk.

Dec 12, 2025 By Rubrik In Rubrik
AI agents can increase productivity, but without proper governance and centralized oversight, they can cause destruction. Now more than ever, organizations urgently need a control layer for AI agents as a part of their rollout strategy. Rubrik Agent Cloud is designed to monitor and audit agent actions, enforce real-time policies and guardrails, and undo agent mistakes. Built on the Rubrik Platform that uniquely combines data, identity, and application contexts, Rubrik Agent Cloud will deliver security, accuracy, and efficiency as they transform with AI.
View Video

All things AI and malware with Randy Pargman

Dec 11, 2025 By LimaCharlie In LimaCharlie
Join us for this week's Defender Fridays as we explore the reality of AI-powered malware threats with Randy Pargman, Senior Director of Threat Detection at Proofpoint. At Defender Fridays, we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.
View Video
foresiet

Stealc Infostealer: A Deep Dive into Its Evolution, Operations, and Threat Landscape

Dec 10, 2025 By Foresiet In Foresiet
Stealc, an information-stealing malware operating as Malware-as-a-Service (MaaS), has emerged as a potent tool in the cybercriminal arsenal since its debut in early 2023. Advertised on Russian-speaking underground forums. Established stealers such as Vidar, Raccoon, Mars, and RedLine, offering customizable data exfiltration for browsers, cryptocurrency wallets, and applications. Its non-resident design minimizes footprints, enabling stealthy theft of credentials, cookies, autofill data, and files.
Read Post
foresiet

The Resurgence of Mirai: Jackskid Botnet and Escalating IoT Threats in November 2025

Dec 9, 2025 By Foresiet In Foresiet
The Mirai botnet, first unleashed in 2016, continues to evolve into increasingly sophisticated variants, posing severe risks to the Internet of Things(IoT) ecosystem. This report examines the Jackskid Botnet—a newly identified Mirai derivative—characterized by its aggressive propagation via zero-day exploits and brute-force attacks, resulting in daily active bot IPs surpassing 40,000 as of late November 2025.
Read Post
bytesafe

Shai-Hulud v2: The "Second Coming" of the npm Worm

Dec 9, 2025 By Daniel Parmenvik In Bytesafe
In September, we covered the Shai-Hulud worm, a self-replicating attack that exposed just how fragile the npm supply chain can be. But as we know, successful malware rarely stays static. Late November marked the arrival of Shai-Hulud v2, or as its authors rather dramatically titled it, “The Second Coming”. This isn’t just a rerun; it’s a remaster. The new iteration is stealthier, more aggressive, and significantly more dangerous. While v1 was a wake-up call, v2 is a fire drill.
Read Post
acronis

Dharma (CrySiS) Ransomware: Technical Analysis, Context and Mitigation

Dec 5, 2025 By Acronis In Acronis
Dharma, also known as CrySiS, is a long running ransomware family first observed in 2016. It operates as ransomware as a service, where developers lease the malware to affiliates who deploy it. A variant discovered in March 2021 appends the ".biden" extension to encrypted files. This article provides a technical analysis of Dharma, outlines its infection vector, describes its encryption workflow, and offers guidance for mitigation.
Read Post
knowbe4

Malicious AI Tools Assist in Phishing and Ransomware Attacks

Dec 5, 2025 By KnowBe4 Team In KnowBe4
Researchers at Palo Alto Networks’ Unit 42 are tracking two new malicious AI tools, WormGPT 4 and KawaiiGPT, that allow threat actors to craft phishing lures and generate ransomware code. These tools are criminal alternatives to mainstream AI tools like ChatGPT, with no safety guardrails to prevent users from using them for malicious activities. The latest version of WormGPT offers lifetime access for $220, or a monthly fee of $50.
Read Post
bluevoyant

Fake SAP Concur Extensions Deliver New FireClient Malware Variant

Dec 4, 2025 By Joshua Green and Thomas Elkins In BlueVoyant
The BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) team are tracking an adversary luring users into downloading fake Concur browser extensions. The fake browser extension installer contains a FireClient Loader designed to gather host information and send to its command and control (C2) server. If execution succeeds with successful communication to the C2, the loader drops a backdoor BlueVoyant is naming FireClient Backdoor.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.