Archives: Threats

Attached is the TI Advisory on Bomgar exploitation for ransomware. Review the details and implement the recommended remediation on Windows systems immediately.

Risk Associates MSSP-SOC Alert: RondoDox botnet targets Linux/IoT via weak SSH/Telnet for DDoS C2 networks. Secure internet-facing edge systems and update creds.

MSSP-SOC Alert: Three Microsoft Defender zero-days (BlueHammer, RedSun, UnDefend) allow SYSTEM access & evasion. Patch BlueHammer now; monitor for unpatched threats.

Risk Associates Alert: Nexcorium Mirai botnet exploits CVE-2024-3721 on TBK DVRs for DDoS. It uses multi-arch payloads and Telnet brute-force. Secure IoT devices now.

Risk Associates Alert: 5-stage malware chain uses GitHub & DLL sideloading to deploy CGrabber Stealer. It bypasses security to steal creds & crypto. Monitor & block

Risk Associates Alert: Critical SharePoint zero-day (CVE-2026-32201) exploited. Affects 2016, 2019 & Subscription Edition. Apply emergency patches immediately.

INC Ransomware alert: Systems breached via phishing, CVE-2023-3519 (Citrix), and CVE-2023-27997 (FortiGate). Tools deployed for lateral movement. Secure your network.

Black Basta Alert: Access via phishing, ZeroLogon, & CVE-2024-1709 (ConnectWise). Valid credentials (T1078) abused for lateral moves. Escalating in 2025. Secure now.

Play ransomware has rapidly grown since mid-2022, becoming a major RaaS threat, with nearly 900 victims reported by the FBI by May 2025 globally.

These threats use advanced evasion techniques, including RC4/RC5 encryption, multi-threading, UDP beaconing, and WSL abuse for covert command execution.

These threats employ advanced evasion techniques, including custom encryption (RC4/RC5), multi-threaded execution, UDP beaconing, and WSL abuse for covert command execution.

Recent Iran-US tensions have raised cyber risks, with hacktivists and state actors targeting aligned organizations, ranging from disruption to espionage.