Executive Summary UK financial stability and customer outcomes are increasingly shaped by operational cyber risk: attacks (and disruptive technology failures) that impair critical services, amplify fraud losses, and propagate quickly…
Short title: Deep dive on Explorer-native WebDAV abuse for malware deliveryWebDAV, Windows File Explorer, WebClient, TryCloudflare, Cloudflare Tunnel, phishing, .URL, .LNK, search-ms, Mark-of-the-Web, SmartScreen, RAT delivery, detection engineering Executive Summary…
DPRK fake interview lures and recruitment-driven malware deliverydprk, contagious interview, deceptiveDevelopment, beavertail, invisibleferret, fake recruiters, coding challenges, it worker scheme, wagemole, famous chollima, laptop farms, software supply chain 1. Executive…
We originally wanted to cover this locker in 2023 but were unable to acquire samples from the community. This profile reflects the currently available information as a resource as an…
Short title: SANDWORM_MODE npm worm (CI secret theft + MCP poisoning)npm supply chain attack, SANDWORM_MODE, typosquatting, GitHub Actions compromise, CI secret exfiltration, MCP server injection, AI coding assistant poisoning, Shai-Hulud,…
Summary: Symantec links Lazarus tooling to Medusa RaaS extortion activity observed in the Middle East and against a U.S. healthcare target. 1. Executive Summary Broadcom/Symantec’s Threat Hunter Team reported North…
1. Executive Summary UK further education (FE) colleges and higher education (HE) institutions face a persistently high-volume threat environment driven by phishing, account compromise, ransomware/extortion, and periodic surges in denial-of-service…
Tags: Payload ransomware, data broker extortion, double extortion, Tor leak site, ESXi ransomware, RECOVERY-xx0001.txt, IOCs, incident response Published: 21 February 2026 (Europe/London) 1. Executive Summary Payload is an emerging ransomware…
Publish date: 21 February 2026Category: Threat Intelligence / Defense Evasion / Endpoint SecurityTags: EDR, XDR, ransomware, defense evasion, BYOVD, Windows drivers, tamper protection, detection engineering Executive summary “EDR killers” are…
Last updated: 21 February 2026 (Europe/London) 1. Executive Summary Bring Your Own Vulnerable Driver (BYOVD) is a post-compromise technique where attackers load a legitimately signed (but vulnerable) kernel driver and…