Preventing the Access That Powers Ransomware Lateral Movement (Part 2/2)
Designing upstream controls that cut off access brokers, endpoint breakout, and perimeter device exploitation before T1021 starts
Tags /
#Incident Response
173 reports
Ransomware Lateral Movement in 2026: Detection Opportunities (Part 1/2)
Ransomware lateral movement techniques in 2026 are increasingly identity-led, cloud-aware, and executed through legitimate admin channels, forcing defenders to prioritise high-fidelity telemetry,…
Scattered Spider threat actor profile
Scattered Spider is a financially motivated eCrime collective best known for high-success social engineering against enterprise IT help desks, often enabling account takeover in SSO and hybrid…
APT37 “Ruby Jumper” campaign bridges air-gapped networks using USB and a portable Ruby runtime
Zscaler ThreatLabz reports a December 2025 campaign it tracks as Ruby Jumper , attributed with high confidence to APT37 (aka ScarCruft, Ruby Sleet, Velvet Chollima). The infection chain begins…
Cyber Threats to the UK Financial System: Banking, Capital Markets, Asset Management and Central Banking (Transatlantic & Geopolitical Drivers, 2024–2026 Incident Case Studies)
UK financial stability and customer outcomes are increasingly shaped by operational cyber risk: attacks (and disruptive technology failures) that impair critical services, amplify fraud losses,…
WebDAV Delivery via Windows File Explorer: How .URL and .LNK Shortcuts Stage Malware Outside the Browser
Short title: Deep dive on Explorer-native WebDAV abuse for malware delivery WebDAV, Windows File Explorer, WebClient, TryCloudflare, Cloudflare Tunnel, phishing, .URL, .LNK, search-ms,…
Active exploitation of Cisco Catalyst SD-WAN via UAT-8616 (CVE-2026-20127)
Active exploitation of Cisco Catalyst SD-WAN authentication bypass (CVE-2026-20127) cisco catalyst sd-wan, vsmart, vmanage, CVE-2026-20127, UAT-8616, authentication bypass, rogue peer, NETCONF,…
SANDWORM_MODE: npm supply-chain worm poisons CI workflows and AI coding assistants
Short title: SANDWORM_MODE npm worm (CI secret theft + MCP poisoning) npm supply chain attack, SANDWORM_MODE, typosquatting, GitHub Actions compromise, CI secret exfiltration, MCP server…
Lazarus-linked activity using Medusa ransomware
Summary: Symantec links Lazarus tooling to Medusa RaaS extortion activity observed in the Middle East and against a U.S. healthcare target.
BLACK BASTA - Threat Actor Profile
Operational profile of the Black Basta ransomware ecosystem (2022–2026) Black Basta, BASTA, ransomware, RaaS, double extortion, UNC4393, Storm-1811, QakBot, DarkGate, Quick Assist, vishing, MITRE…
FICOBA breach exposes data linked to 1.2 million French bank accounts
France’s Ministry of the Economy and Finance disclosed unauthorised access to FICOBA, the national registry of bank accounts, affecting data associated with approximately 1.2 million accounts .…
Cyber Threats Facing UK Further and Higher Education
UK further education (FE) colleges and higher education (HE) institutions face a persistently high-volume threat environment driven by phishing, account compromise, ransomware/extortion, and…