Microsoft Traces Four Ransomware Brands to One Repeating Playbook
The payload name changed across Qilin, DragonForce, Anubis and BERT deployments, but the operator kept returning to the same remote-access and exfiltration tools.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
Your Salesforce Agent Could Have Sent the Phish in Slack
A malicious CRM lead could cross into Agentforce and emerge as a trusted Slack reply without showing who triggered it. Salesforce has changed the defaults.
How a Public iCloud Calendar Became a macOS Malware Loader
A MacSync downloader feeds a public iCloud calendar into zsh until it reaches commands hidden in the event description.
An Open Docker Port Gave Attackers Their Own AI Operator
The AI agent is not the entry point. An unauthenticated Docker API is, and Carbonato turns it into privileged host access and automated post-compromise work.
SolarWinds Patches Two Routes Into Its Monitoring Servers
SolarWinds patched two remote-code paths in its monitoring platform, but each depends on a specific non-default or communication configuration.
A Leaked GitLab Email Address Can Become a Code-Push Credential
An incoming GitLab email address carries account authority. Research shows why a leaked address needs the same response as a leaked access token.
Miljödata Reported 2.2 Million People Affected. Sweden Fined It SEK 1.8 Million
The enforcement decision is smaller than the breach headline, but its reasoning reaches every supplier handling concentrated public-sector data.
Attackers Need No Login to Exploit This Roundcube Plugin
A pre-authentication SQL injection in Roundcube's virtuser_query plugin is now being exploited, four months after fixed versions shipped.
This Rogue MFA Provider Can Steal the Password You Just Reset
A password change can feed the new secret straight back to the attacker if the malicious authentication provider remains registered.
Bitget’s $388 Million Breach Now Points to a Third-Party Security Product
Bitget says its $388 million breach may have begun in a third-party security product, exposing credentials used to send fraudulent withdrawal commands.