ICBC hit by ransomware attack
The Industrial and Commercial Bank of China (ICBC), the world’s largest commercial bank, experienced a ransomware attack on its U.S. arm, ICBC Financial Services (FS). This incident, occurring on…
Incident Reports
In-depth write-ups of high-impact intrusions, breaches and malware campaigns — how they happened, and what defenders can learn.
111 reports
APT35 Expands Its Horizon - Password Spray Attacks Across Global Sectors
Since February 2023, APT35, a notorious Iranian-backed threat actor, has been intensifying its cyber operations with a series of global password spray attacks. These attacks represent a strategic…
BellaCiao Malware - APT35's New Chapter in Cyber Espionage
In May 2023, the cybersecurity world turned its attention to a significant development involving APT35, an Iranian-backed cyber threat actor. Researchers uncovered advancements in BellaCiao, a…
US Navy Personnel Arrested for Espionage Activities Linked to China
In a significant security breach, two US Navy personnel, Jinchao Wei and Wenheng Zhao , were arrested for transmitting sensitive military information to the People’s Republic of China (PRC). The…
PhishForce - Salesforce Zero-Day Exploitation
A recent zero-day vulnerability in Salesforce's software was exploited by threat actors to phish Facebook credentials. This incident was first reported by Guardio Labs, who detected a…
Deceptive Python Package 'VMConnect' Targets VMware vSphere Users
A recent cybersecurity incident has brought to light a malicious Python package on the Python Package Index (PyPI), posing as the VMware vSphere connector module 'vConnector'. This package, named…
MikroTik RouterOS Vulnerability: CVE-2023-30799
In a recent blog post by VulnCheck, a vulnerability in MikroTik RouterOS was discussed in detail. The vulnerability, identified as CVE-2023-30799, affects MikroTik RouterOS up until version 6.49.8…
OSS Supply Chain Attacks Targeting the Banking Sector: A Detailed Analysis
In a significant development in the cybersecurity landscape, the banking sector has recently been the target of two distinct open-source software (OSS) supply chain attacks. These attacks,…
Ivanti Endpoint Manager Mobile (EPMM) CVE-2023-35078
Ivanti, a leading provider of IT software solutions, has recently addressed a critical zero-day authentication bypass vulnerability in its Endpoint Manager Mobile (EPMM), formerly known as…
Nokia 2023 Threat Intelligence Report
In the recently released "Threat Intelligence Report 2023" by Nokia, the company provides an in-depth analysis of the current cybersecurity landscape, particularly focusing on telecom networks and…
Understanding and Mitigating Insider Threats: A Comprehensive Approach
Insider threats are a significant cybersecurity risk that originates from within an organisation. These threats can come from current or former employees, contractors, or anyone else with intimate…