Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

tripwire

3AM Ransomware Attackers Pose as IT Support to Compromise Networks

May 23, 2025 By Graham Cluley In Tripwire
Cybercriminals are getting smarter. Not by developing new types of malware or exploiting zero-day vulnerabilities, but by simply pretending to be helpful IT support desk workers. Attackers affiliated with the 3AM ransomware group have combined a variety of different techniques to trick targeted employees into helping them break into networks. It works like this.
Read Post
CrowdStrike

CrowdStrike Collaborates with U.S. Department of Justice on DanaBot Takedown

May 22, 2025 By Counter Adversary Operations In CrowdStrike
Effective collaboration is essential when confronting today's sophisticated cyber adversaries, particularly those operating with state tolerance or direction. At CrowdStrike, we routinely work alongside law enforcement agencies and industry partners to identify, monitor, and mitigate cyber threats. Recently, we provided technical assistance to the U.S.
Read Post
safebreach

SafeBreach Coverage for US CERT AA25-141B (Sticky Werewolf)

May 22, 2025 By Tova Dvorin In SafeBreach
On May 21, 2025, the FBI and CISA released a joint Cybersecurity Advisory (CSA), designated AA25-141B, warning about the rise in attacks leveraging LummaC2, attributed to a threat group referred to internally as Sticky Werewolf, this cyber espionage campaign has used LummaC2 malware since at least April 2023 to target Russian and Belarusian government agencies, science centers, and aviation manufacturers.
Read Post
knowbe4

The Ransomware Threat: Still Alive and Kicking

May 22, 2025 By Javvad Malik In KnowBe4
Many organizations, after a period of relative quiet, might believe the ransomware bubble has burst. The headlines may have shifted, and other emerging cyber threats might seem to dominate the news cycle, but recent data from Marsh's 2024 UK cyber insurance claims report suggests otherwise. It paints a stark picture of an ongoing and evolving threat landscape. While claims decreased by 20% compared to 2023, they remained significantly higher than in previous years.
Read Post
tripwire

Health-ISAC 2025 Report: Ransomware Still Reigns as #1 Threat to Healthcare

May 22, 2025 By Katrina Thompson In Tripwire
Health-ISAC recently released their 2025 Health Sector Cyber Threat Landscape Report, a comprehensive outline of the malicious activity aimed at healthcare in the previous year. Not surprisingly, ransomware was cited by security professionals in the industry as the number one threat of 2024 and the top area of concern coming into 2025 (followed by third-party breaches, supply chain attacks, and zero-day exploits). Some things never change. However, when it comes to ransomware, they do evolve.
Read Post
cyberint

The Lumma Stealer InfoStealer: The Details

May 22, 2025 By Coral Tayar In Cyberint
Original Article published Decmber 2023. Update May 22nd 2025: The FBI has seized user panels and other Lumma C2 infrastructure. As of now, we don’t see the Lumma info-stealer disappearing from the arena. Our team is on guard to check and analyze the changes. This case shares similarities with the so called seizure of infrastructure of RedLine and Metta info stealers in October 2024 by the FBI, DOJ, Dutch authorities, etc.
Read Post
Reviewing Penetration Test Pricing In 2025: A Practical Guide for UK and EU Buyers

Reviewing Penetration Test Pricing In 2025: A Practical Guide for UK and EU Buyers

May 22, 2025 By SecuritySenses In SecuritySenses
Penetration testing costs in the UK and EU can range from a few thousand pounds to well over £20,000. At a glance, many of these tests look the same. So why the price gap? In 2025, pricing models haven't changed much. Most tests are still priced per day, but the complexity of what's being tested has changed. The rise of custom internal tools (many "vibe coded" by non-IT or security teams), shadow IT, SaaS stacks, and cloud sprawl means that scoping a pen test properly takes more time and care.
Read Post
cato networks

Cato CTRL Threat Research: Suspected Russian Threat Actors Leverage Tigris, Oracle Cloud Infrastructure, and Scaleway to Target Privileged Users with Lumma Stealer

May 21, 2025 By Guile Domingo In Cato Networks
Imagine walking into a trusted bank, only to be handed counterfeit money by employees who don’t realize it’s fake. This is similar to a growing trend that’s emerging in the threat landscape. Threat actors are leveraging trusted cloud infrastructure platforms to host fake reCAPTCHA pages designed to deceive unsuspecting victims into executing malicious commands through the Windows Run dialog—specifically targeting high-access users within organizations to escalate privileges.
Read Post
bitsight

Lumma Stealer is Out... of business!

May 21, 2025 By Bitsight TRACE In BitSight
Since mid-2024, Bitsight has been collaborating with Microsoft’s Digital Crimes Unit and other partners to dismantle the operational capabilities of Lumma Stealer (LummaC2) — currently the most widely distributed information stealer. Early this week, a coordinated action was carried out to disrupt its operations and take down the supporting malware infrastructure.
Read Post
Trustwave

Trustwave SpiderLabs Report Highlights Ransomware and Dark Web Dangers for the Hospitality Sector

May 21, 2025 By Trustwave In Trustwave
The summer travel season is almost here, and travelers worldwide are in the process of booking their holidays, thus placing some of their most vital personal and financial information into the hands of the hospitality industry. A fact not lost to threat actors who thrive on gaining access and stealing this data.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.