Threat Intelligence | Breaking Cybersecurity News | The Hacker News

Cybersecurity teams have no shortage of threat data: New vulnerabilities are disclosed, malware is discovered, attack campaigns are analyzed, and manufacturers, CERTs, and security agencies continuously publish indicators of compromise (IoCs), security advisories, and other technical information. For operators of critical infrastructure, however, collecting this information is not even the most challenging part. Security teams still need to determine whether a threat is relevant to their environment, which assets may be affected, and what the observed activity actually means in the context of an operational network. In the energy sector, that requires knowledge extending beyond enterprise security and into the protocols, equipment, and processes that keep power systems operating. A suspicious packet in an office network is one thing. Understanding whether communication between an engineering workstation and a protection device using IEC 61850 represents expected maintenance activi...

When it comes to email security software, the cybersecurity industry has become very good at one thing: scoring the message that's already in the inbox. We've gone from blocklists to signature matching to behavioral ML, and each generation of email security innovation was a genuine improvement over the last.  But the losses keep climbing anyway. The median time it takes someone to click a phishing link is just 21 seconds after opening the email, and another 28 seconds to hand over credentials or payment data. That's under a minute start to finish. That number hasn't moved much in years despite everything we've thrown at the problem. It's time for a different approach. But first, we need to understand modern challenges. We're filtering messages, but attackers are running campaigns

For a long time, the cybersecurity industry has framed social engineering as a psychological problem. We treat it as a battle of wits between a charismatic con artist and an unsuspecting employee. The prevailing wisdom says that if we just train our people to better identify scams or tear down malicious infrastructure slightly faster, we can stay ahead of scammers. But looking at the threat landscape from a purely threat-intelligence perspective tells us something entirely different: Modern social engineering is more than a psychological game. It's a highly optimized, industrialized deception economy. Attackers run campaigns like hyper-efficient businesses. They have Customer Acquisition Costs, operational budgets, and strict Return on Investment (ROI) targets. This is the part the industry doesn't like to sit with: If we want to truly break the social engineering attack chain , we have to stop focusing exclusively on building higher walls or executing reactive takedowns...

For years, our industry has treated "blocking" as the gold standard. If the email didn't land, if the malware didn't execute, if the alert fired in the SIEM, we called it a win. That mindset made sense in a world where most attacks came through a handful of familiar doors. But AI has changed the game. We're not dealing with hobbyists sending out clumsy phishing attacks anymore. Modern adversaries are running multi‑channel, AI‑assisted businesses at machine speed. And if all you're doing is blocking at the edge, you're not really defending. You're just delaying. Generative AI has made it trivial to spin up highly personalized, multi‑step social engineering campaigns that operate simultaneously across email, collaboration apps, mobile, social media, and paid media. The result is a social engineering attack chain : a sequence of stages designed to manufacture trust, erode judgment, and bypass brittle controls. You don't beat that by tuning another filter. You have to disrupt the at...

Phishing and insider threats continue to pose significant, often overlapping risks in modern threat landscapes. Compromised credentials obtained through phishing campaigns or social engineering attacks can grant adversaries legitimate access, effectively converting external threats into insider risks. This convergence complicates detection, as malicious activity may closely mimic authorized user behavior. To address this challenge, security teams require a platform that can correlate events from multiple sources, including endpoints, users, and network activity. Security teams, therefore, need a Security Information and Event Management (SIEM) platform that can collect and correlate activity across endpoints, users, and network sources. A SIEM platform enables the aggregation and correlation of data from multiple sources, helping analysts uncover suspicious patterns that would otherwise go unnoticed. Phishing attacks Phishing attacks remain among the most effective techniques us...

Attackers embraced AI in 2024. They are running attacks at agentic speed now. Security operations mostly aren't moving at the same pace. The mismatch between attack speed and response speed is now the most exploitable condition in most environments.  We recently ran an analysis on healthcare organizations using Check Point Exposure Management . One tertiary hospital had reduced its mean time to remediate (MTTR) to 0.87 hours. Zero IPS bypass events. 100% hardening effectiveness. Sub-one-hour MTTR, at scale, in a regulated healthcare environment where change control alone used to take days. We did not get there from patching faster. It came from changing the model entirely. The Asymmetry Nobody Talks About The security industry spent years optimizing detection. Feed more signals into SIEM, add more correlation rules, build bigger dashboards. Detection got faster. But remediation stayed manual, sequential, and slow. Meanwhile, attackers didn't wait. They adopted agentic to...

Government impersonation scams have evolved into a large, highly coordinated fraud ecosystem targeting citizens across the globe. CTM360 's latest threat intelligence research analyzes a widespread campaign, referred to as GovTrap, that demonstrates how attackers systematically exploit public trust in government institutions through thousands of fraudulent digital platforms. Unlike traditional phishing attacks that rely on simple deceptions, GovTrap campaigns replicate entire government service environments. These fraudulent platforms mimic official portals with high accuracy, including branding, language, workflows, and service structures. From tax portals and licensing systems to fine payment services, each fake site is designed to appear legitimate while functioning as part of a broader, scalable fraud operation. Read the full report here:  https://www.ctm360.com/reports/government-impersonation-phishing-govtrap-scams Scale and Targeting Patterns CTM360 identified mo...

Continuous Threat Exposure Management (CTEM) has moved well past buzzword status. We've talked about this before . It's true that in the past years, Gartner has been making these grand predictions about its benefits: organizations prioritizing CTEM investments will suffer two-thirds fewer breaches by 2026 … Well, we're now in 2026 and, in reality, SOC teams are still facing the same dilemma: more exposure data than they can act on, and no reliable way to decide what actually matters. 96% of security teams face challenges trying to validate whether their security risks are exploitable, while 2 in 3 state that they don't have a consolidated view of their cyber risk exposure. - Filigran-comissioned third-party market survey on exposure validation  It's pretty clear now that to actually benefit from CTEM, organizations needs to first utilize their cyber threat intelligence better. It is not just about better asset, vulnerability management or dealing with a single CTI provider, b...

While working on the Transparent Tribe's vibeware research, we have encountered two distinct camps, the optimists and the skeptics. What makes the current dialogue unique is that both sides can be right at the same time. There is, however, a clear operational reason why we encounter "AI attacks" primarily on professional social media feeds rather than within our own telemetry logs. In this article, we analyze the factors explaining why Skynet is not here yet, and how, much like a shark, AI does not need to be innovative to be dangerous. LLM Architecture Bias LLMs are mathematically optimized to predict the most likely outcome, while hacking is the art of identifying the statistical anomaly. LLMs are designed to predict the most statistically probable next token. They are excellent at the average, but poor at the exceptional. A hacker, by contrast, is a practitioner of statistical anomaly, actively seeking the low-pro...

Vulnerability management is the continuous process of identifying, assessing, prioritizing, and addressing security weaknesses across systems, applications, and infrastructure. It extends beyond periodic scanning; it includes validating findings, understanding exposure in real-world environments, and tracking remediation over time. Effective vulnerability management combines asset visibility, vulnerability intelligence, and operational context to determine which flaws present actual risk rather than theoretical exposure. Modern IT environments further complicate the process of vulnerability management. Hybrid IT infrastructure, third-party dependencies, and internet-facing services increase the attack surface while generating large volumes of vulnerability data. Security teams must balance operational constraints, such as out-of-support legacy systems and uptime requirements, with the need to quickly reduce exposure. As a result, vulnerability management is no longer limited to coun...

Telegram entered 2025 under unprecedented pressure. Public scrutiny, regulatory attention, and leadership turmoil forced the platform to do something it had long resisted, enforce at scale. Moderation volumes surged, automation expanded, and millions of channels and groups were removed in a single year. On paper, this looks like a turning point.  In practice, it wasn't the collapse of cyber criminal activity on Telegram; it was an evolution, for sure, but not a collapse.  What we are seeing in 2026 is not a mass exodus from the platform, nor a meaningful decline in threat actor coordination. Instead, Telegram's crackdown has triggered a familiar pattern. Criminal ecosystems adapt faster than platforms can reform. Read the just released Telegram report, by Tal Samra and Or Shichrur for evasion methods, statistics and monitoring recommendations: https://checkpoint.cyberint.com/telegrams-crackdown-criminal-resilience Over 43 Million & Channels Blocked  Tele...

When Shai-Hulud 2.0 hit in late 2025, it was a brutal, expensive wake-up call for DevSecOps teams. It showed that the industry's direction of shifting left, where teams pass security onto developers, wasn't the silver bullet everyone hoped for. Pushing that responsibility was fine in theory, but it crumbled quickly because the foundation it was built on was inherently flimsy. As we move further into 2026, we need a more definitive fix to the structural weakness in the pipelines in light of a potential Shai-Hulud 3.0. A major lesson from 2.0 was that internal CI/CD runners were easily hijacked and turned into attack botnets. Teams need to take that finding and come back with a truly proactive defense. A curated catalog is a way for security teams to control exactly what code and components enter their environment, while still giving engineering teams a fast, secure way to build - it is the key to creating a sustainable solution. More on a curated catalog later. The Anatomy o...