Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

securonix

Veil#Drop: Blogspot-Hosted PowerShell Loader

Jul 1, 2026 By Akshay Gaikwad, Shikha Sangwan, Aaron Beardslee In Securonix
Veil#Drop is a sophisticated multi-stage malware delivery framework that combines social engineering, compromised websites, malicious JavaScript launchers, PowerShell download cradles, and trusted cloud-hosted infrastructure to deploy PureLog Stealer entirely in memory. The infection chain begins with a deceptively named JavaScript file masquerading as a document (e.g., transcript.pdf.js), which executes through Windows Script Host and launches PowerShell with execution policy bypasses enabled.
Read Post
mend

RubyGems supply chain attack: malware used as a credential exfiltration dead drop

Jul 1, 2026 By Maciej Mensfeld In Mend
Package registries have a well-known abuse pattern: attackers upload malicious packages, and unsuspecting developers install them. Our researchers just found the pattern working in reverse, in a RubyGems supply chain attack that turns the registry into a place to stash stolen data rather than deliver it.
Read Post
Arctic Wolf

From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks

Jun 30, 2026 By Arctic Wolf Labs In Arctic Wolf
Throughout 2026, Arctic Wolf has investigated multiple Anubis ransomware intrusions. Although threat actor tradecraft differs between intrusions, key themes have emerged: abuse of VPN infrastructure, blending in with legitimate activity through the use of Remote Monitoring and Management (RMM) solutions, and using other legitimate binaries on victim devices.
Read Post

Ep. 4: The Sony Playbook

Jun 30, 2026 By Rubrik In Rubrik
It’s been nearly 12 years since North Korea launched its crippling attack on Sony Pictures Entertainment over a Seth Rogen film. Most Americans remember the celebrity leaks, the embarrassing emails, the Hollywood spectacle of it all. What they missed was the playbook: Why simply hack an organization when you can bleed reputations dry? Turn stolen data into psychological warfare. It was a model that would soon echo everywhere from Russian intelligence operations to modern ransomware gangs.
View Video

Defending the Authentication Flow: Device Code Phishing with Selena Larson

Jun 30, 2026 By Rubrik In Rubrik
Selena Larson, Staff Threat Researcher and Lead, Intelligence Analysis and Strategy at Proofpoint and Host of the DISCARDED podcast, joins host Caleb Tolin to detail the specific mechanics of device code phishing campaigns, revealing how adversaries exploit legitimate communication structures to capture administrative and enterprise access. The discussion centers on the rapid commercialization of cybercrime, highlighting the leak of specialized kits in late 2025 that catalyzed the democratization of sophisticated technical exploits.
View Video
cyberint

What Is BlackSuit Ransomware & How Could It Impact Your Organization?

Jun 28, 2026 By Adi Bleih In Cyberint
The BlackSuit ransomware operation surfaced in early April/May 2023. This group engages in multi-faceted extortion, encrypting and exfiltrating data from victims while hosting public data leak sites for those who do not comply with their demands. BlackSuit has notably targeted entities in the healthcare and education sectors, as well as other critical industries. It operates privately, with no public affiliates.
Read Post

Ransomware vs Backup:Can You Recover Your Clients After an Attack?

Jun 26, 2026 By Vembu Technologies In BDRSuite
Modern ransomware doesn't just encrypt systems—it targets backups too. In this webinar, learn why recovery often fails even when backups exist, how attackers compromise backup environments, and what it takes to build a ransomware-resilient backup strategy. Ideal for MSPs and IT professionals looking to strengthen cyber resilience and recovery readiness.
View Video
The "Macs Don't Get Viruses" Myth Is Officially Dead in 2026

The "Macs Don't Get Viruses" Myth Is Officially Dead in 2026

Jun 26, 2026 By SecuritySenses In SecuritySenses
For many years, Apple users have believed that Mac computers are naturally protected from cyber threats. This perception was shaped by the relatively low number of attacks targeting macOS in the past. However, the cybersecurity environment in 2026 presents a very different reality. As Apple's global market share has expanded and Mac users have become increasingly valuable targets, cybercriminals have shifted their focus toward developing attacks specifically designed for macOS.
Read Post
bitsight

Amadey and StealC: Malware-as-a-Service Unavailable

Jun 24, 2026 By Bitsight TRACE In BitSight
On June 24, 2026, demonstrating the power of public-private collaboration, Europol and the Microsoft Digital Crimes Unit, alongside our team and other global partners, executed a coordinated disruption as part of Operation Endgame, impacting two of the most prolific commodity malware families on Windows: the Amadey loader/botnet and the StealC information stealer.
Read Post
cyberint

The Growing Threat of ShadowPad Malware and Its Business Impact

Jun 24, 2026 By Adi Bleih In Cyberint
ShadowPad, a sophisticated modular malware, has emerged as a significant cybersecurity threat. Attributed initially to Chinese state-sponsored threat actors (APT41), this malware has evolved into a shared tool among various APTs. Its highly customizable nature allows attackers to adapt ShadowPad to specific targets, making it a versatile and persistent threat.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.