NDSS 2026 research shows practical injection and machine-in-the-middle paths across WPA2/WPA3, guest SSIDs, and enterprise multi-AP deployments Network security | Wi-Fi | WPA2 | WPA3 | Passpoint | MitM |…
Censys has reported on Vshell (often stylised “VShell”), a Go-based command-and-control (C2) platform used for post-compromise host management, pivoting, and proxying, and increasingly visible on internet-facing infrastructure, sometimes alongside Cobalt…
Designing upstream controls that cut off access brokers, endpoint breakout, and perimeter device exploitation before T1021 starts Download MITRE ATT&CK Navigator TTPs as as JSON Layer / Excel Executive Summary…
TLP:CLEAR | 27 February 2026 Ransomware lateral movement techniques in 2026 are increasingly identity-led, cloud-aware, and executed through legitimate admin channels, forcing defenders to prioritise high-fidelity telemetry, behavioural analytics, and…
Scattered Spider is a financially motivated eCrime collective best known for high-success social engineering against enterprise IT help desks, often enabling account takeover in SSO and hybrid environments and progressing…
Zscaler ThreatLabz reports a December 2025 campaign it tracks as Ruby Jumper, attributed with high confidence to APT37 (aka ScarCruft, Ruby Sleet, Velvet Chollima). The infection chain begins with a…
Executive Summary UK financial stability and customer outcomes are increasingly shaped by operational cyber risk: attacks (and disruptive technology failures) that impair critical services, amplify fraud losses, and propagate quickly…
Short title: Deep dive on Explorer-native WebDAV abuse for malware deliveryWebDAV, Windows File Explorer, WebClient, TryCloudflare, Cloudflare Tunnel, phishing, .URL, .LNK, search-ms, Mark-of-the-Web, SmartScreen, RAT delivery, detection engineering Executive Summary…
Active exploitation of Cisco Catalyst SD-WAN authentication bypass (CVE-2026-20127)cisco catalyst sd-wan, vsmart, vmanage, CVE-2026-20127, UAT-8616, authentication bypass, rogue peer, NETCONF, VPN512, SD-WAN threat hunting 1. Executive Summary Cisco Talos reports…
Short title: SANDWORM_MODE npm worm (CI secret theft + MCP poisoning)npm supply chain attack, SANDWORM_MODE, typosquatting, GitHub Actions compromise, CI secret exfiltration, MCP server injection, AI coding assistant poisoning, Shai-Hulud,…