%term

Fake SAP Concur Extensions Deliver New FireClient Malware Variant

Dec 4, 2025 By Joshua Green and Thomas Elkins In BlueVoyant

The BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) team are tracking an adversary luring users into downloading fake Concur browser extensions. The fake browser extension installer contains a FireClient Loader designed to gather host information and send to its command and control (C2) server. If execution succeeds with successful communication to the C2, the loader drops a backdoor BlueVoyant is naming FireClient Backdoor.

Read Post

BlueVoyant

Read more about Fake SAP Concur Extensions Deliver New FireClient Malware Variant

Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary

Dec 4, 2025 By Counter Adversary Operations In CrowdStrike

Throughout 2025, CrowdStrike has identified multiple intrusions targeting VMware vCenter environments at U.S.-based entities, in which newly identified China-nexus adversary WARP PANDA deployed BRICKSTORM malware. WARP PANDA exhibits a high level of technical sophistication, advanced operations security (OPSEC) skills, and extensive knowledge of cloud and virtual machine (VM) environments.

Read Post

CrowdStrike

Read more about Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary

Paying the Ransom: A Short-Term Fix or Long-Term Risks?

Dec 3, 2025 By Emma Stevens In BitSight

According to our 2025 State of the Underground report, ransomware attacks rose by nearly 25% in 2024, and the number of ransomware group leak sites jumped 53%. This surge sets the stage for a critical question: if compromised, should you pay ransomware demands or not? The stakes are enormous, including downtime, data loss, brand damage, and legal risk all hang in the balance.

Read Post

BitSight

Read more about Paying the Ransom: A Short-Term Fix or Long-Term Risks?

Shai-Hulud 2.0: What did the hackers learn from the previous attack?

Dec 3, 2025 By GitGuardian In GitGuardian

Watch our security researcher Guillaume Valadon break down the sophisticated ShaiHulud 2.0 attack where malware exfiltrates secrets directly to GitHub using stolen developer credentials.

View Video

GitGuardian

Read more about Shai-Hulud 2.0: What did the hackers learn from the previous attack?

The Hacker Was Testing Shai-Hulud 2.0 Attack - 3 Days Before It Hit

Dec 3, 2025 By GitGuardian In GitGuardian

We discovered hackers were testing Shai-Hulud 2.0 three days before the attack. Our researcher Guillaume Valadon explains how GitGuardian's data helped us warn hundreds of companies who didn't even know they were compromised.

View Video

GitGuardian

Read more about The Hacker Was Testing Shai-Hulud 2.0 Attack - 3 Days Before It Hit

New Criminal Toolkit Abuses Browser Push Notifications

Dec 3, 2025 By KnowBe4 Team In KnowBe4

A new criminal platform called “Matrix Push C2” is using browser notifications to launch social engineering attacks, according to researchers at BlackFog. “This browser-native, fileless framework leverages push notifications, fake alerts, and link redirects to target victims across operating systems,” the researchers write.

Read Post

KnowBe4

Read more about New Criminal Toolkit Abuses Browser Push Notifications

SpiderLabs Ransomware Tracker Update November 2025: Qlin, Cl0p, and Akira Vie for Top Attacker

Dec 3, 2025 By LevelBlue In LevelBlue

LevelBlue SpiderLabs ransomware tracker noted a slight dip in the overall number of attacks that took place in November 2025, but the research team saw the threat group Cl0p surge, conducting 98 attacks during the month, up from just 13 in October. LevelBlue SpiderLabs derived the information from its ransomware-tracking tool, which gathers data from a variety of open intelligence sources and our own proprietary research.

Read Post

LevelBlue

Read more about SpiderLabs Ransomware Tracker Update November 2025: Qlin, Cl0p, and Akira Vie for Top Attacker

WatchGuard Threat Lab's top six cybersecurity predictions for 2026

Dec 2, 2025 By WatchGuard In WatchGuard

WatchGuard has revealed its top six cybersecurity predictions for 2026, forecasting a year where AI-driven threats, regulatory pressures, and the decline of legacy tools will reshape the security landscape. Corey Nachreiner, chief security officer at WatchGuard Technologies, emphasises that organisations must prepare for rapid evolution in both attack methods and defensive strategies.

Read Post

WatchGuard

Read more about WatchGuard Threat Lab's top six cybersecurity predictions for 2026

Cato CTRL Threat Research: From Productivity Boost to Ransomware Nightmare - Weaponizing Claude Skills with MedusaLocker

Dec 2, 2025 By Inga Cherny In Cato Networks

Claude Skills is a new feature from Anthropic that has gained rapid adoption, with more than 17,000+ GitHub stars already since its launch in October 2025, allowing users to create and share custom code modules that expand Claude’s capabilities and streamline workflows. But as this ecosystem grows, Cato CTRL uncovered a serious oversight into how Skills are executed.

Read Post

Cato Networks

Read more about Cato CTRL Threat Research: From Productivity Boost to Ransomware Nightmare - Weaponizing Claude Skills with MedusaLocker

Top CISO Priorities and Global Digital Trust with Morgan Adamski

Dec 2, 2025 By Rubrik In Rubrik

Welcome to Data Security Decoded. Join host Caleb Tolin in conversation with Morgan Adamski who leads Cyber, Data, and Tech Risk at PwC and is a former US national security leader who spent 16 years tracking nation-state threats inside the US government. Coming out of a career spent inside secure facilities without windows or phones and working to address China’s prepositioning in US critical infrastructure, Morgan shares a direct view of how geopolitics is now shaping cyber risk decisions in boardrooms.

View Video