Meridiano
A major African cybercrime syndicate was dismantled through an international law enforcement operation called Sentinel, led by Interpol. The operation resulted in 574 arrests, the recovery of over $3 million, and the decryption of six malware variants. The private cybersecurity firm Team Cymru played a key supporting role, using its unique data and expertise to help track the criminals. The article highlights the collaboration between private sector threat hunters and global law enforcement to combat cybercrime.
Articles infosec
Showing articles 16 - 30 of 158 total (matching filters).
-
infosec 5 -
infosec 5Google has identified a sophisticated iOS exploit kit named Coruna, targeting iPhones on older iOS versions (13.0 to 17.2.1) with multiple exploit chains. The kit has evolved, circulating from a commercial surveillance vendor to a nation-state actor and finally to a financially motivated Chinese threat actor by December 2025. Its deployment marks a shift from targeted spyware to broader exploitation, with instances observed on compromised Ukrainian websites linked to Russian espionage and on fake Chinese financial sites. The findings highlight an active market for second-hand zero-day exploits and significant proliferation of advanced spyware capabilities. The main topics covered are the discovery and technical details of the Coruna exploit kit, its evolution and transfer between different threat actors, and its observed deployments in espionage and criminal campaigns.
-
infosec 3Enterprises now have budget for AI security but lack clear requirements for AI Governance, creating a procurement crisis. A new RFP Guide has been released to help organizations evaluate AI Usage Control solutions by shifting focus from securing individual applications to governing user interactions with AI. The guide provides a structured framework across eight domains to combat vendor "feature-wash" and ensure solutions can inspect activities at the point of interaction, even in complex environments like incognito mode or AI-native browsers. The main topics covered are the challenge of defining AI Governance, the need for interaction-level security controls, the shortcomings of legacy security tools against AI risks, and the introduction of a standardized RFP guide to address these issues.
-
infosec 5A Chinese cyberespionage group tracked as "Silver Dragon," linked to the APT41 nexus, is targeting government entities in Southeast Asia and Europe. The group gains initial access through phishing emails with malicious attachments or by exploiting public-facing servers. It maintains persistence by hijacking legitimate Windows services and uses custom tools, including the GearDoor backdoor, to conduct covert operations and evade detection.
-
infosec 5Malicious PHP packages on the Packagist registry are distributing a cross-platform remote access trojan (RAT) that targets Laravel applications. The packages, including "nhattuanbl/lara-helper" and "nhattuanbl/simple-queue," use obfuscation to hide a payload that connects to a command-and-control server, providing attackers with full remote shell access, file manipulation, and system reconnaissance. The RAT is persistent and runs with the web application's permissions, exposing sensitive data like credentials. Users are advised to remove the packages, rotate all secrets, and audit network traffic.
-
infosec 6A new APT group called Silver Dragon, operating under the Chinese-linked APT41 umbrella, is targeting government entities in Europe and Southeast Asia. It uses three primary infection methods: exploiting public servers, hijacking legitimate Windows services, and phishing emails with malicious attachments. The attacks deploy tools like Cobalt Strike for persistence, along with custom backdoors and utilities for surveillance and data theft. The group employs advanced techniques like DNS tunneling and DLL side-loading to evade detection.
-
infosec 6A U.S. cybersecurity agency has added a high-severity VMware vulnerability to its catalog due to active exploitation. The flaw allows unauthenticated attackers to execute arbitrary commands for potential remote code execution. Patches and a temporary workaround are available for affected products. Federal agencies are mandated to apply fixes by a specific deadline. The article covers the vulnerability's details, the response from authorities and the vendor, and the current lack of information on the exploitation campaigns.
-
infosec 5The U.S. cybersecurity agency CISA has added a VMware Aria Operations vulnerability (CVE-2026-22719) to its catalog of known exploited flaws, requiring federal agencies to patch it. Broadcom, VMware's parent company, acknowledges reports of active exploitation but cannot independently confirm them. The critical command injection flaw, patched in February 2026, allows unauthenticated attackers to execute arbitrary commands. Organizations are urged to apply the provided patches or a temporary script-based workaround immediately. The main topics covered are the critical vulnerability's active exploitation status, the mandated patching timeline, and the technical details of the flaw and its mitigation.
-
infosec 4AkzoNobel confirmed a contained security breach at a U.S. site by the Anubis ransomware gang, which claims to have stolen 170GB of data. The leaked files include confidential client agreements, personal employee information, and internal technical documents. The company states the impact is limited and it is notifying affected parties while cooperating with authorities. The article also notes that Anubis is a relatively new ransomware service that has expanded its capabilities to include data wiping.
-
infosec 3Facebook experienced a worldwide outage, preventing users from accessing their accounts and displaying a temporary error message. The outage began in the afternoon ET and was reported to impact accounts globally, though Meta's status page noted disruptions primarily to business tools. The service was resolved a few hours later, but the cause of the outage was not disclosed by Facebook. The main topics are the Facebook service outage, its global impact, and its resolution without a stated cause.
-
infosec 6The India-linked APT group "Sloppy Lemming" has increased its activity and sophistication, targeting defense, nuclear-regulatory, and critical infrastructure sectors in South and Southeast Asia. It has evolved to use custom malware written in Rust and a cloud-based command-and-control infrastructure. The group's operations are part of a broader increase in regional cyber-espionage campaigns, which often employ phishing and credential theft. Cybersecurity firms note potential coordination and shared resources among several India-aligned threat clusters.
-
infosec 5Hackers are exploiting the OAuth authorization mechanism to bypass security protections and launch phishing attacks against government and public-sector organizations. They create malicious OAuth applications that force error redirects, sending victims to phishing pages or delivering malware. These attacks can intercept session cookies to bypass multi-factor authentication and ultimately deploy malware through techniques like HTML smuggling and DLL side-loading. The main topics covered are the exploitation of OAuth redirection, the phishing and malware delivery methods, and recommended security mitigations.
-
infosec 4Researchers have demonstrated that tire pressure monitoring systems (TPMS) in modern vehicles can be exploited for low-cost, silent tracking. Using receivers costing around $100, they intercepted unencrypted TPMS signals containing unique, unchanging tire identifiers from passing cars. This allows third parties to capture these signals from up to 50 meters away and track specific vehicle movements over time. The main topics covered are a vehicle security vulnerability, the method of data interception, and the privacy implications of unencrypted automotive sensor data.
-
infosec 6A high-severity Qualcomm graphics flaw (CVE-2026-21385) is being exploited in limited, targeted attacks against Android devices, with evidence suggesting possible nation-state or commercial spyware involvement. A second critical Android vulnerability (CVE-2026-0047) enables local privilege escalation but has not yet been seen exploited. Patches for both vulnerabilities are available, but their deployment to end-users depends on device manufacturers, creating a lag in consumer protection. The main topics covered are the active exploitation of a Qualcomm zero-day, the disclosure of a critical Android flaw, and the challenges of patching the Android ecosystem.
-
infosec 7A highly sophisticated iPhone hacking toolkit, dubbed "Coruna," has been used in multiple campaigns, exploiting numerous iOS vulnerabilities to infect devices via websites. The toolkit appears to have proliferated from a state-sponsored espionage operation—first used by suspected Russian spies against Ukrainians—to a cybercriminal operation targeting Chinese-speaking cryptocurrency users. Evidence suggests the toolkit may have originally been developed by or for the U.S. government before leaking. This uncontrolled spread of advanced hacking techniques highlights the dangerous proliferation of powerful cyber weapons into the hands of various threat actors.