On August 7, external counsel for Connex Credit Union (“Connex”) in Connecticut notified the Maine Attorney General’s Office of a recent hacking incident. According to their notification, unusual activity was discovered on their system on June 3, 2025. An investigation that was promptly launched determined that files may have been accessed or downloaded without authorization…
The threat actor known as TA558 has been attributed to a fresh set of attacks delivering various remote access trojans (RATs) like Venom RAT to breach hotels in Brazil and Spanish-speaking markets. Russian cybersecurity vendor Kaspersky is tracking the activity, observed in summer 2025, to a cluster it tracks as RevengeHotels. “The threat actors continue…
Great investigative journalism by Zack Whittaker on TechCrunch. First, he reports: A new app offering to record your phone calls and pay you for the audio so it can sell the data to AI companies is, unbelievably, the No. 2 app in Apple’s U.S. App Store’s Social Networking section. The app, Neon Mobile, pitches itself as……
Cisco has confirmed that a Chinese threat actor known as Salt Typhoon gained access by likely abusing a known security flaw tracked as CVE-2018-0171, and by obtaining legitimate victim login credentials as part of a targeted campaign aimed at major U.S. telecommunications companies. “The threat actor then demonstrated their ability to persist in target environments…
Securing your firewall is much easier with the new Health Check feature.
Charles Carmakal posted the following alert on LinkedIn: ALERT: Scattered Spider has added North American airline and transportation organizations to their target list. 🚨 Mandiant (part of Google Cloud) is aware of multiple incidents in the airline and transportation sector which resemble the operations of UNC3944 or Scattered Spider. We recommend that the industry immediately…
Universities and government organizations in North America and Asia have been targeted by a previously undocumented Linux malware called Auto-Color between November and December 2024, according to new findings from Palo Alto Networks Unit 42. “Once installed, Auto-color allows threat actors full remote access to compromised machines, making it very difficult to remove without specialized
