Velociraptor incident response tool abused for remote access
This approach represents an evolution from threat actors abusing remote monitoring and management tools
Similar Posts
HHS OCR Settles HIPAA Ransomware Cybersecurity Investigation with Comprehensive Neurology, PC
Bys sToday, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with Comprehensive Neurology, PC (Comprehensive), a small New York neurology practice, concerning a potential violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule. The settlement resolves an OCR investigation of a ransomware…
A big finish to 2025 in December’s Patch Tuesday
Bys sA month with no Critical-severity Windows bugs is overshadowed by a mass of Mariner mop-up Categories: X-ops Tags: threat research, featured, Microsoft, Patch Tuesday, zero days
INTERPOL Arrests 1,209 Cybercriminals Across 18 African Nations in Global Crackdown
Bys sINTERPOL on Friday announced that authorities from 18 countries across Africa have arrested 1,209 cybercriminals who targeted 88,000 victims. “The crackdown recovered $97.4 million and dismantled 11,432 malicious infrastructures, underscoring the global reach of cybercrime and the urgent need for cross-border cooperation,” the agency said. The effort is the second phase of an ongoing law
Uncovering Qilin attack methods exposed through multiple cases
Bys sTakahiro Takeda, Jordyn Dunk, James Nutland, Michael Szeliga of Talos write: In the second half of 2025, the ransomware group Qilin has continued to publish victim information on its leak site at a pace of more than 40 cases per month, making it one of the most impactful ransomware groups worldwide. The manufacturing sector has……
First Malicious MCP Server Found Stealing Emails in Rogue Postmark-MCP Package
Bys sCybersecurity researchers have discovered what has been described as the first-ever instance of a Model Context Protocol (MCP) server spotted in the wild, raising software supply chain risks. According to Koi Security, a legitimate-looking developer managed to slip in rogue code within an npm package called “postmark-mcp” that copied an official Postmark Labs library of…
BatShadow Group Uses New Go-Based ‘Vampire Bot’ Malware to Hunt Job Seekers
Bys sA Vietnamese threat actor named BatShadow has been attributed to a new campaign that leverages social engineering tactics to deceive job seekers and digital marketing professionals to deliver a previously undocumented malware called Vampire Bot. “The attackers pose as recruiters, distributing malicious files disguised as job descriptions and corporate documents,” Aryaka Threat Research Labs