Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Arctic Wolf

Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or Less

Sep 26, 2025 By Arctic Wolf Labs In Arctic Wolf
In late July 2025, Arctic Wolf Labs began observing a surge of intrusions involving suspicious SonicWall SSL VPN activity. Malicious logins were followed within minutes by port scanning, Impacket SMB activity, and rapid deployment of Akira ransomware. Victims spanned across multiple sectors and organization sizes, suggesting opportunistic mass exploitation. This campaign has recently escalated, with new infrastructure linked to it observed as late as September 20, 2025.
Read Post
Arctic Wolf

Cisco Patches ASA, FTD, and IOS Vulnerabilities, Including Critical and Exploited Flaws

Sep 26, 2025 By Andres Ramos In Arctic Wolf
On September 25, 2025, Cisco released fixes for two vulnerabilities in Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) that are currently being actively exploited by a sophisticated threat actor. The US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 25-03 requiring Federal Civilian Executive Branch (FCEB) agencies to patch these vulnerabilities by 12 PM EDT on September 26.
Read Post
outpost 24

Carding ecosystem: The fall of traditional financial cybercrime

Sep 26, 2025 By Marcelo Ruano In Outpost 24
Carding is a type of cybercrime where attackers steal or illegally buy credit card information and use it to make unauthorized transactions. It often involves testing stolen card numbers with small purchases before making larger fraudulent charges. Criminals typically exchange or sell these stolen details on underground forums or dark web marketplaces. Outpost24’s Threat Intelligence team, KrakenLabs, carried out a previous public analysis of the underground card fraud ecosystem in 2022.
Read Post
Snyk

Malicious MCP Server on npm postmark-mcp Harvests Emails

Sep 25, 2025 By Liran Tal In Snyk
On September 25, 2025, the npm package postmark-mcp, an MCP (Model Context Protocol) server intended to let AI assistants send emails via Postmark, was reportedly modified to secretly exfiltrate email contents by adding a blind-copy (BCC) to an external domain. Current analysis suggests the behavior began around 1.0.16 and persisted in later versions.
Read Post
outpost 24

Olymp Loader: A new Malware-as-a-Service written in Assembly

Sep 25, 2025 By Lidia López Sanz In Outpost 24
Olymp Loader is a Malware-as-a-Service (MaaS) advertised on underground forums and Telegram since June 5, 2025. The seller, “OLYMPO”, presents Olymp Loader as fully written in assembly language and frequently markets it as FUD (Fully UnDetectable). Despite its recent appearance, many underground forum users have already posted positive reviews.
Read Post

When Attackers Weaponize AI and Defenders Fight Back with Smarter Remediation

Sep 24, 2025 By Nucleus Security In Nucleus
Artificial intelligence is transforming cybersecurity, and not always for the better. Attackers are now weaponizing AI to speed up reconnaissance, create exploit code, and bypass traditional defenses. Security teams can’t afford to rely on outdated vulnerability management practices. In this webinar, Scott Kuffer (COO, Nucleus Security) and Corey Brunkow (Director of Federal Operations, Horizon3.ai) break down how AI is changing the threat landscape and what defenders can do to stay ahead.
View Video
nucleus

Exploitability as the Countdown Clock: Prioritizing Vulnerabilities Before Time Runs Out

Sep 23, 2025 By Corey Tomlinson In Nucleus
In vulnerability management, every scan tells a story. The truth is that only some of those stories matter right now and that the challenge isn’t finding vulnerabilities. It’s knowing which ones are about to cost you. If you’re dealing with hundreds of vulnerabilities per asset, especially if you’ve adopted cloud solutions, you’re not alone. That’s become the norm. But you can’t patch everything, and you shouldn’t even try.
Read Post
lookout

Zero-Day Mobile Vulnerabilities: Why Speed is the Key to Cyber Defense

Sep 23, 2025 By Lookout In Lookout
Every year, mobile devices become more powerful, more innovative, and more complex. That’s good news for diligent workers who want to stay connected and productive. Unfortunately, it’s also good news for threat actors who want to steal sensitive data. Zero-day vulnerabilities in mobile applications and operating systems (OSs) are becoming more common over time.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.