Turla has been using the backdoor against government and military organizations in Ukraine for espionage.

The post Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets appeared first on SecurityWeek.

Hundreds of C&C servers were disrupted in an operation involving law enforcement and several cybersecurity companies.

The post Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware appeared first on SecurityWeek.

Mistic is used by Woodgnat, an initial access broker working with Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta.

The post New ‘Mistic’ RAT Opens Door to Several Ransomware Families appeared first on SecurityWeek.

Other noteworthy stories that might have slipped under the radar: Android TV botnet Popa linked to Israeli firm, Velvet Ant maintained decade-long stealth, unpatched GCP Config Connector flaw enables takeover.

The post In Other News: Apple Patches Beats Eavesdropping Flaw, DOT Closes Delta CrowdStrike Probe, AWS Continuum appeared first on SecurityWeek.

CryptoBandits uses a local SOCKS5 proxy for traffic routing, blending data theft with remote code execution.

The post CryptoBandits Malware Doubles as a Backdoor, Abuses Tor appeared first on SecurityWeek.

The large-scale credential theft campaign hit roughly half of the internet-accessible Fortinet firewalls and VPNs.

The post FortiBleed: 86,000 Fortinet Device Credentials Compromised appeared first on SecurityWeek.

Law enforcement and private partners took down 106 SocGholish C&C servers and domains as part of Operation Endgame.

The post 15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown  appeared first on SecurityWeek.

The Android malware allows its operators to take control of infected devices and harvest sensitive information.

The post Rokarolla Banking Trojan Targets 200 Applications appeared first on SecurityWeek.

The attackers deployed a new Go-based backdoor that uses Microsoft Teams servers for command-and-control.

The post Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack appeared first on SecurityWeek.

Researchers say the OnyxC2 malware targets more than 200 applications and extensions while evading detection through encrypted payloads, DLL sideloading, and in-memory execution techniques.

The post OnyxC2 Stealer Offers Cybercriminals Enterprise-Grade Theft for $250 a Month appeared first on SecurityWeek.

As attackers increasingly favor stolen credentials over exploits, infostealers have become a primary source of access for ransomware and other cybercrime operations.

The post Infostealers Turn Millions of Devices Into Credential Theft Machines appeared first on SecurityWeek.

The most recent variants of the self-propagating attacks are named Miasma and Hades.

The post Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks appeared first on SecurityWeek.

Relying on social engineering, the hacking group engages in credential phishing, malware distribution, and fraud activities.

The post Chinese Cybercrime Group in Spotlight for Record Campaign Pace appeared first on SecurityWeek.

The attackers had access to a senior executive’s email account for 150 days and exfiltrated data for months.

The post Hackers Target Global Stock Exchange in Espionage Operation appeared first on SecurityWeek.

Noteworthy stories that might have slipped under the radar: Trump Mobile exposes customer data, phishers target the 2026 FIFA World Cup, CISA responds to recent supply chain attacks.

The post In Other News: Trump Mobile Data Breach, FIFA World Cup Phishing, CISA Responds to Supply Chain Attacks appeared first on SecurityWeek.

Researchers warn GreyVibe’s extensive use of ChatGPT, Gemini, and other AI tools offers a glimpse into how future cybercriminal and state-aligned groups will operate.

The post Russia-Linked ‘GreyVibe’ Attackers Use AI to Supercharge Cyberattacks appeared first on SecurityWeek.

Delivered via phishing lures, the malware combines financial theft with data exfiltration and remote access.

The post New BTMOB Android Malware Enables Full Device Takeover appeared first on SecurityWeek.

Security firms took down all four command-and-control (C&C) channels used by the GlassWorm malware.

The post GlassWorm Botnet Disrupted appeared first on SecurityWeek.

Nimbus Manticore has continued its operations during and after the US military campaign against Iran.

The post Iranian APT Targets Aviation, Software Companies With Updated Tools appeared first on SecurityWeek.

Register to enjoy free access and explore the tools, strategies, and frameworks needed to build a resilient security program for a world where every minute counts.

The post Watch on Demand: Threat Detection & Incident Response Summit – All Sessions Available appeared first on SecurityWeek.