Meridiano
Mexican Army Special Forces killed Nemesio "El Mencho" Oseguera Cervantes, leader of the Jalisco New Generation Cartel (CJNG). His death is expected to cause a major reconfiguration in global drug trafficking and potentially increase violence. The article details the CJNG's origins as a splinter group from the Sinaloa Cartel and its rapid expansion into a global criminal enterprise involved in drug trafficking, extortion, and migrant smuggling. It also highlights the cartel's sophisticated use of technology, including social media for recruitment and AI for financial scams, to build its operational capacity.
Articles infosec
Showing articles 121 - 135 of 170 total (matching filters).
-
infosec 3 -
infosec 5An Australian national and former U.S. defense contractor employee, Peter Williams, was sentenced to over seven years in prison for selling eight zero-day cyber exploits to the Russian broker Operation Zero for millions in cryptocurrency. The stolen tools, intended for U.S. government use, could have enabled global cybercrime and espionage, causing significant financial loss to his employer. In response, the U.S. government sanctioned Operation Zero, its director Sergey Zelenyuk, and related entities for acquiring and distributing these tools, which they marketed to non-NATO countries and intelligence agencies. The main topics covered are the criminal conviction and sentencing for trade secret theft, the details of the cyber exploit sale to a Russian entity, and the subsequent U.S. sanctions against the foreign brokers.
-
infosec 5A major international law enforcement operation called Red Card 2.0 resulted in 651 arrests and the recovery of over $4.3 million from cybercriminal groups across Africa. The operation, involving Interpol, 16 African countries, and private cybersecurity firms, targeted various fraud schemes including investment scams and a syndicate that infiltrated a telecom provider. The article highlights that cybercrime in Africa is increasingly organized and transnational, with criminals using AI to enhance attacks like phishing. It also emphasizes the growing importance of public-private partnerships and regional cooperation to combat these threats despite resource challenges for some local agencies. The main topics covered are the results of Operation Red Card 2.0, the nature of cybercrime in Africa, and the collaborative efforts to fight it.
-
infosec 4SolarWinds has released patches for four critical vulnerabilities in its Serv-U file transfer software, which could allow remote code execution. The flaws, all rated 9.1 in severity, affect Serv-U version 15.5 and have been fixed in version 15.5.4. While exploitation requires administrative privileges, the company notes a medium risk on Windows systems. There is no mention of current active exploitation, though similar past vulnerabilities have been weaponized by threat actors.
-
infosec 5CISA has added a critical OS command injection vulnerability (CVE-2026-25108) in Soliton Systems' FileZen software to its Known Exploited Vulnerabilities catalog due to active exploitation. The flaw allows authenticated users to execute arbitrary commands and affects specific versions of the file transfer product when its Antivirus Check Option is enabled. The vendor advises updating to version 5.0.11 or later and changing all user passwords, while U.S. federal agencies have a remediation deadline of March 17, 2026. The main topics covered are the vulnerability's technical details, affected versions, exploitation conditions, and recommended mitigation steps.
-
infosec 4The release of Jeffrey Epstein case documents reveals how federal investigations obtain user data from tech companies like Google. The documents show grand jury subpoenas requesting user information and the legal correspondence where Google sometimes pushes back against overbroad requests. They detail the types of data Google can be compelled to provide, from basic subscriber information with a subpoena to more sensitive data, and highlight prosecutors' frequent requests for secrecy, prohibiting Google from notifying users. The main topics covered are the government's data request processes, Google's compliance and pushback, and the legal frameworks like the Stored Communications Act governing these exchanges.
-
infosec 5The average time for attackers to move laterally within a breached network has accelerated to just 29 minutes, a 65% increase in speed from the previous year. This rapid "breakout" is fueled by the misuse of legitimate credentials, which allows attackers to blend in, and by targeting unmanaged devices that lack security controls. A significant majority (82%) of detected intrusions in 2025 were malware-free, relying on authorized pathways. These factors have drastically reduced the time defenders have to detect and respond to cyber intrusions.
-
infosec 5The North Korean Lazarus Group has adopted Medusa ransomware in a recent attack on a Middle East organization and attempted another on a US healthcare entity, demonstrating its continued focus on financially motivated cybercrime against critical infrastructure. The attacks also involved other malware like the Comebacker backdoor, Blindingcan RAT, and Infohook stealer. Researchers identified the activity as Lazarus's work but could not definitively pinpoint which specific sub-group within the threat actor was responsible. The main topics covered are Lazarus Group's new use of Medusa ransomware, its financially motivated attacks on critical infrastructure, and the associated malware and tactics.
-
infosec 4A vulnerability in GitHub Codespaces, named RoguePilot, allowed attackers to take control of repositories by embedding malicious instructions in a GitHub issue. These hidden prompts would be automatically processed by GitHub Copilot when a user launched a Codespace from that issue, potentially leading to data exfiltration like the theft of privileged tokens. The issue has been patched by Microsoft following responsible disclosure. The article also covers broader AI security risks, including methods to remove LLM safety features and side-channel attacks that can infer user query topics.
-
infosec 5A Russia-aligned threat group, UAC-0050 (Mercenary Akula), targeted a European financial institution involved in regional development and reconstruction, marking a potential expansion beyond Ukraine. The attack used a spear-phishing email spoofing a Ukrainian judicial domain to deliver a multi-layered payload, ultimately deploying Russian remote access software (RMS) for persistent, stealthy access. The main topics covered are the cyberattack's method, the threat actor's identity and tactics, and the strategic shift in targeting towards entities supporting Ukraine.
-
infosec 2The cybersecurity venture capital market saw unprecedented growth in 2025, with total investment activity nearly tripling the previous year's levels. This surge was driven by a massive focus on AI-native security solutions and a record number of mergers and acquisitions. Venture capital firms invested $119 billion, with AI security product firms closing the most financing deals. The investment momentum is fueled by the need for both AI-powered security tools and solutions to protect against threats from the expanding use of AI agents. The trend continued into early 2026, with M&A activity remaining high.
-
infosec 2The article argues that traditional identity management, which prioritizes issues by volume or failed controls, is inadequate for modern enterprises. It proposes a contextual framework for prioritizing identity risk based on three compound factors: controls posture (evaluating security measures in context), identity hygiene (addressing structural weaknesses like orphaned accounts), and business context (assessing the potential impact of a compromise). The main topics are a critique of current identity programs and a detailed explanation of this three-part risk prioritization model.
-
infosec 6The North Korea-linked Lazarus Group has used Medusa ransomware in an attack on a Middle Eastern entity and attempted an attack on a U.S. healthcare organization. This reflects a tactical shift by North Korean hacking groups toward using established ransomware-as-a-service offerings like Medusa and Qilin, rather than developing their own tools, for pragmatic reasons. The groups have targeted various sectors, including healthcare and non-profits, with recent U.S. ransom demands averaging $260,000. The main topics covered are cyberattacks by state-sponsored North Korean actors, the use of specific ransomware and tools, and the evolution of their tactics.
-
infosec 5The China-aligned threat actor UnsolicitedBooker has shifted to targeting telecommunications companies in Kyrgyzstan and Tajikistan using phishing emails that deploy the LuciDoor and MarsSnake backdoors. The group, active since at least 2023, uses rare tools of Chinese origin and has shown tactical overlaps with other clusters. Researchers note the group has alternated between using the LuciDoor and MarsSnake backdoors and has employed hacked routers as command-and-control servers.
-
infosec 5Anthropic has accused three Chinese AI companies—DeepSeek, Moonshot AI, and MiniMax—of conducting large-scale, illicit "distillation" campaigns to extract Claude's advanced capabilities. The attacks used over 24,000 fraudulent accounts and proxy networks to generate millions of exchanges, violating terms of service and regional bans. The targeted capabilities included Claude's reasoning, coding, and agentic functions. Anthropic warns that such illicitly distilled models bypass crucial safety safeguards, creating potential national security risks. The company has responded by developing detection systems to identify and counter these extraction patterns.