XWorm Attacks Demo
This demo video showcases Xworm attacks and Splunk detections finding the different ways it executes on an OS.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Inside the Kimsuky APT Leak: Stolen GPKI Certificates, Rootkits, and a Personalized Cobalt Strike from North Korea's Cyber Unit
In a rare and unprecedented incident, a massive operational dump belonging to the North Korean Kimsuky APT group was leaked on a dark web forum. The leak containing virtual machine images, VPS dumps, phishing kits, rootkits, and thousands of credentials offers an unparalleled look into the inner workings of one of Pyongyang’s most prolific cyber espionage groups.
How To Detect Spyware on an Android Phone
Is your Android phone acting strangely? It could be spyware! Learn how to detect the warning signs and remove spyware from your device. Follow these simple steps to protect your personal data and keep your phone secure.
MURKY PANDA: A Trusted-Relationship Threat in the Cloud
Since 2023, CrowdStrike Services and CrowdStrike Counter Adversary Operations have investigated multiple intrusions conducted by MURKY PANDA, a sophisticated adversary leveraging advanced tradecraft to compromise high-profile targets. MURKY PANDA, active since at least 2023, is a cloud-conscious adversary with a broad targeting scope; the adversary’s operations have particularly focused on government, technology, academia, legal, and professional services entities in North America.
Can threat actors make ChatGPT malware? #ai #cybersecurity #gpt5
GPT-5 was jailbroken in under 24 hours using simple "storytelling" techniques that bypass safety guardrails. The key insight from our podcast? Individual AI requests appear legitimate but become dangerous when combined. Bad actors can request network code in one session, convincing emails in another, and credential collection forms in a third. Each task seems normal individually, but together they form a complete phishing toolkit.
CTI Roundup: EDR Killer, PS1Bot, Charon Ransomware
Ransomware groups adopt shared EDR-killing tool, PS1Bot spreads via malvertising, and Charon ransomware uses APT-style tactics to target critical sectors.
Falcon Platform Prevents COOKIE SPIDER's SHAMOS Delivery on macOS
Between June and August 2025, the CrowdStrike Falcon platform successfully blocked a sophisticated malware campaign that attempted to compromise over 300 customer environments. The campaign deployed SHAMOS, a variant of Atomic macOS Stealer (AMOS) developed by the cybercriminal group COOKIE SPIDER. Operating as malware-as-a-service, COOKIE SPIDER rents this information stealer to cybercriminals who deploy it to harvest sensitive information and cryptocurrency assets from victims.
XWORM Returns to Haunt Systems with Ghost Crypt
Starting in July 2025, Kroll has observed a new delivery method coming from the XWORM malware family. Previously known to leverage a self-contained executable in order to drop the final payload, XWORM now uses Ghost Crypt which is a service publicized on HackForums and used to exploit DLL side-loading vulnerabilities in known applications. The service includes support for a range of malware families, including LUMMASTEALER, BLUELOADER, RHADAMANTHYS, XWORM, DCRAT, PURELOADER, STEALC and others.
How Weak Passwords Lead to Ransomware Attacks
Weak passwords are a major security risk, leaving your organization vulnerable to ransomware attacks, account takeovers and data breaches. In this video, we break down how weak passwords lead to ransomware, the additional risks they pose and how organizations can protect themselves.
Why CTI Must Recommend, Not Just Report
In traditional intel roles, analysts avoid making direct recommendations. But Scott Scher explains why that doesn’t work in the business world. CTI teams can’t just present options, they need to say what should happen next. Scott breaks down why effective CTI must go beyond context and offer clear, actionable guidance for defenders. Hidden Truths: Traditional intel avoids giving direct recommendations Business leaders and defenders want clear next steps CTI teams must say.