Threat Intelligence | Breaking Cybersecurity News | The Hacker News

CTM360 has recently observed a sophisticated global scam campaign where victims are lured through fraudulent Google Play Store download pages. CTM360, a leading cybersecurity company for Digital Risk Protection, has identified over 6,000 instances of these fake pages, tricking users into downloading malicious apps. Once installed, the apps disguise themselves as legitimate software to deploy PlayPraetor (a malware named after the authoritative Roman praetor). It seizes control of infected devices to steal banking credentials, log keystrokes, and monitor clipboard activity. The operation's global reach and complexity highlight a highly coordinated effort to compromise users' data for malicious purposes. How the Scam Works Threat actors behind PlayPraetor execute a well-crafted deception strategy: Fake Play Store Pages – Cybercriminals create highly realistic clones of Google Play Store and other trusted sources to distribute Trojanized APKs. Malicious APKs Disguised as L...

What is Threat-Led Vulnerability Management? Threat-Led Vulnerability Management (TLVM) is a security approach that focuses on prioritizing and managing vulnerabilities based on the current threat landscape and the specific risks posed to an organization. Rather than treating all vulnerabilities equally, TLVM emphasizes understanding which vulnerabilities are most likely to be exploited by malicious actors, correlated with the configuration state and security posture of the organization's unique infrastructure and business processes. Why Now? The notion of adopting a Threat-Led Vulnerability Management (TLVM) approach has grown in popularity, particularly in the face of the escalating volume and sophistication of cyber threats, which are increasingly frequent and offer a lower cost attack alternative when supported by AI tools. The dynamic nature of the threat landscape requires organizations to stay agile in their vulnerability management processes, prioritizing efforts based on ...

Shadow AI is presenting new challenges for security leaders. While AI tools have already revolutionized how we work, they've also created unprecedented security challenges that our traditional strategies or tools simply weren't designed to handle. I've spent the last decade working with organizations grappling with emerging tech risks, and I can tell you that this is different. In this post, we'll talk about why, and more importantly, what you can do about it. The Hidden Risks of AI Adoption: Shadow AI The Wiz research team recently uncovered a publicly exposed DeepSeek production ClickHouse database , leaking chat history, API secrets, and other sensitive data—raising serious concerns for any organization using DeepSeek's models. Truth is that many teams rushed to try out DeepSeek given the hype around its truly advanced technologies. While the DeepSeek situation has been surrounded by FUD, drama, and misinformation, it has also set important precedents for privacy ...

Hackers are constantly scanning your network, often spotting vulnerabilities before you do. They're looking for misconfigurations, exposed assets, and weak points that could lead to a breach—are you seeing what they see? Every activity or interaction that your organization does online – website, social media accounts, cloud services, third-party integrations, and more – contributes to its digital footprint. This digital footprint is information attackers use to find your weaknesses and attempt to exploit them.  What if you could anticipate how hackers plan to exploit your vulnerabilities before they strike? Imagine identifying the weaknesses most enticing to an attacker—before they become exploited. Attack Surface Management (ASM) solutions help organizations continuously identify, monitor and manage aspects of public-facing IT assets, including those that may be forgotten. ASM is the tool in the battle of visibility – either you see your weaknesses first, or attackers will show ...

Since Russia's latest escalation in 2022 with its invasion of Ukraine, hacktivism has surged, impacting both private and public sectors through DDoS attacks, defacements, and disinformation campaigns. These cyberattacks align with geopolitical events. As 2024 saw over 50 countries holding elections, this creates particularly ripe conditions for influence operations such as misinformation and propaganda campaigns. DDoS attacks have also intensified, with one pro-Russian hacktivist group alone claiming over 6,000 attacks since March 2022. Driven by political tensions and geopolitical conflicts, we saw a significant increase in both volume and intensity. Hacktivists are now more experienced, leveraging DDoS-for-hire services and sophisticated tools. To better understand the complex threat landscape, we aim to explore current hacktivism more deeply, examining its various facets and connections to geopolitical tensions, building on our previous findings. This article doesn't cover ...

As I usually say: 'attackers are lazy'. In other words, they always follow the path of least resistance. As defenders catch up with their tactics, techniques, and procedures, the asymmetric gap between offensive and defensive capability shrinks, pushing attackers to shift their battlefield strategy, perpetuating a game that repeats over and over again. Take, for example, endpoint protection. For the last few years, endpoint protection, detection, and response have been the centerpiece of security strategies. As modern endpoint security products get better at anticipating threats based on AI-based engines, providing richer visibility and more contextual detection capabilities, attackers are pivoting away from them, looking for 'blind spots' in your architecture, leveraging vulnerabilities and misconfigurations in network devices, supply chains, and even firmware embedded deep within devices, areas where security visibility is limited. This trend is particularly significant due to the ...

In just a few clicks, any SaaS app can turn into a company's go-to system for collaboration, record keeping, CRM, workflow organization, marketing, human resource management, and more. These apps can also act as footholds from which threat actors can pivot into corporate environments and steal critical data.  The rapid adoption of SaaS apps is outpacing the implementation of necessary security measures. The rise in attacks—such as account takeovers and credential leaks—highlights this gap. On the users' end, the responsibilities include taking a security-first approach to account configuration i.e., continuously monitoring for access risks and emerging threats to their data. But with so many users, so many apps and so much data, it's easier said than done.  What leaves companies exposed to data breaches and leaks is the lack of clarity, context, and prompt action. Security teams must make a massive effort to research threats, filter the relevant ones, assess the impact of p...

From the moment it hits the wire—be it MISP or Mandiant—the value and efficacy of cyber threat intelligence (CTI) begins to decay for the organizations that intend to consume it. The data that was once essential for evaluating and reducing risk becomes dated and less helpful as adversaries constantly adapt their tactics, techniques, and procedures (TTPs).  We refer to this as ' threat intelligence decay .' Meanwhile, the NCSC have reported that threat actors have begun leveraging artificial intelligence, with an expectation that they will soon be using AI to evolve and enhance existing TTPs. This advent of AI is exacerbating the challenge of threat intelligence decay. Information that was once a golden nugget of defense can quickly turn into fool's gold, leaving organizations exposed to new threats. When we look at one of the most practical applications that threat intelligence has in an organization—the threat management process—it's frightening how much these problems are co...