X-Industry

FortiGuard Labs has been tracking a previously undocumented Linux botnet family, which we have named Evooo1Bot.  The name derives from the hardcoded string “evooo1” found in every binary.  While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple

AI is absorbing the volume of work that makes up the fundamental architecture of the Security Operations Center (SOC) tier system.  While the tiers and the work aren’t going away, a junior and senior analyst’s day-to-day is changing fast.  At some point in the last week, every analyst on your team made the same call.  Close an uninvestigated alert, because the queue was too long and triage ate the time real investigation and deep analysis were needed.  Most of those calls were right, but odds ar

FortiGuard Labs recently captured several malicious samples that were sending malformed DNS queries.  After conducting an in-depth analysis, researchers determined that these samples are TrickBot variants that use DNS tunneling to communicate with their command-and-control (C2) servers.

TrickBot is a modular malware family that FortiGuard Labs has repeatedly captured over the past decade.  Its modular architecture enables it to extend its capabilities by downloading and executing additional modu

Cybersecurity researchers have unmasked a novel ad fraud scheme that has been found to leverage search engine poisoning (SEO) techniques and artificial intelligence (AI)-generated content to push deceptive news stories into Google's Discover feed and trick users into enabling persistent browser notifications that lead to scareware and financial scams.[1]

The campaign, which has been found to target the personalized content feeds of Android and Chrome users, has been codenamed Pushpaganda by HUMA

A new malware campaign built around the HanGhost loader is actively targeting corporate environments, focusing on employees involved in payments, logistics, and contract operations.  The attack is designed to operate without leaving clear artifacts, enabling it to reach systems linked to revenue and operations before they are fully analyzed.  The campaign has already shown multiple waves of activity with different malware families, indicating active development and scaling rather than a one-off

A cyber-criminal is attempting to sell a zero-day exploit targeting a Windows Remote Desktop Services (RDS) privilege escalation vulnerability for US$220,000 on a cybercrime forum.  The listing, identified by threat intelligence analysts, highlights the rapid commercialization of critical vulnerabilities within the criminal underground.  The sale was posted by a user registered under the name 'Kamirmassabi' in the "Malware, Exploits, Bundles, AZ, Crypt" section of a prominent dark web forum.  Th

Throughout early 2026, SentinelOne’s® Digital Forensics & Incident Response (DFIR) team has responded to several incidents in which FortiGate Next-Generation Firewalls (NGFW) have been compromised to establish a foothold in the targeted environment.  Each incident was detected and stopped during the lateral movement phase of the attack.  Fortinet disclosed and issued patches for several high-severity vulnerabilities, allowing unauthorized access during our investigation period.  Successful explo

Security researchers have uncovered a new supply chain attack targeting the NPM registry with malicious code that exhibits worm-like propagation capabilities.  Named Sandworm_Mode, the attack was deployed through 19 packages published under two aliases, which relied on typo squatting to trick developers into executing the malicious code.  According to cybersecurity firm Socket, the attack bears the hallmarks of the Shai-Hulud campaign that hit roughly 800 NPM packages in September and November 2

FortiGuard Labs recently observed several targeted phishing campaigns in Taiwan that use themes designed to exploit local business processes.  These campaigns disseminate Winos 4.0 (ValleyRat) and subsequent malicious plugins through weaponized attachments or embedded links.  The lures mimic official communications, such as tax audit notifications, tax filing software installers, and cloud-based e-invoice downloads.

In a recent law enforcement operation, the Federal Bureau of Investigation (FBI) dismantled the notorious cyber-criminal forum known as the Russian Anonymous Marketplace (RAMP), a platform favored by ransomware actors and initial access brokers. This takedown represents a significant disruption in the cybercrime landscape, particularly for Russian-speaking cybercriminals.  The news of RAMP's disarray emerged in late January 2026, when several cyber threat intelligence (CTI) analysts observed tha

In a recent law enforcement operation, the Federal Bureau of Investigation (FBI) dismantled the notorious cyber-criminal forum known as the Russian Anonymous Marketplace (RAMP), a platform favored by ransomware actors and initial access brokers. This takedown represents a significant disruption in the cybercrime landscape, particularly for Russian-speaking cybercriminals.  The news of RAMP's disarray emerged in late January 2026, when several cyber threat intelligence (CTI) analysts observed tha

In a recent law enforcement operation, the Federal Bureau of Investigation (FBI) dismantled the notorious cyber-criminal forum known as the Russian Anonymous Marketplace (RAMP), a platform favored by ransomware actors and initial access brokers. This takedown represents a significant disruption in the cybercrime landscape, particularly for Russian-speaking cybercriminals.  The news of RAMP's disarray emerged in late January 2026, when several cyber threat intelligence (CTI) analysts observed tha

In a recent law enforcement operation, the Federal Bureau of Investigation (FBI) dismantled the notorious cyber-criminal forum known as the Russian Anonymous Marketplace (RAMP), a platform favored by ransomware actors and initial access brokers. This takedown represents a significant disruption in the cybercrime landscape, particularly for Russian-speaking cybercriminals.  The news of RAMP's disarray emerged in late January 2026, when several cyber threat intelligence (CTI) analysts observed tha

In a recent law enforcement operation, the Federal Bureau of Investigation (FBI) dismantled the notorious cyber-criminal forum known as the Russian Anonymous Marketplace (RAMP), a platform favored by ransomware actors and initial access brokers. This takedown represents a significant disruption in the cybercrime landscape, particularly for Russian-speaking cybercriminals.  The news of RAMP's disarray emerged in late January 2026, when several cyber threat intelligence (CTI) analysts observed tha

A new analysis by researchers at CyberArk has detailed a significant research effort revealing operational details of a StealC malware operator by exploiting a vulnerability in the malware's leaked web panel.  The recent findings demonstrate how poor security practices within criminal infrastructure can be turned against threat actors.  StealC is information-stealing malware operating under a Malware-as-a-Service (MaaS) model since early 2023.  It enables customers to steal passwords, session co

Cybercriminals are increasingly proving they do not need software vulnerabilities to compromise organizations; they need convincing deception.  Researchers at Securonix are warning of a sophisticated phishing campaign targeting the hospitality sector that uses fake Booking.com reservation cancellations, deceptive CAPTCHA pages, and a panic-inducing fake Windows Blue Screen of Death (BSOD) to deploy a remote access trojan (RAT).  The campaign, named PHALT#BLYX, highlights how attackers are blendi

Every time a computer performs a task, an invisible conversation unfolds inside it. Numbers move between memory and processor, circuits signal one another, and layers of software exchange instructions.  These interactions feel instantaneous and effortless, yet behind the scenes, they carry a real energetic price.  For decades, scientists believed that communication inside a machine could, at least in principle, be made thermodynamically free of cost.  A new study overturns that assumption and sh

CyberVolk is a pro-Russia hacktivist persona Sentinel Labs first documented in late 2024, and it has been tracked using multiple ransomware tools to conduct attacks aligned with Russian government interests.  After seemingly lying dormant for most of 2025 due to Telegram enforcement actions, the group returned in August 2025 with a new RaaS offering called VolkLocker (aka CyberVolk 2.x).

Below, researchers examine the functionality of VolkLocker, including its Telegram-based automation, encrypti

The United States federal government has ended its longstanding support for the Multi-State Information Sharing and Analysis Center (MS-ISAC), a trusted program for sharing cyber threat intelligence that state and local governments have relied on for years.  The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that its cooperative agreement with the Center for Internet Security (CIS) the nonprofit that runs MS-ISAC expired on 30 September 2025.  With federal funding now cut,

US insurance giant Allianz Life announced on July 26 that hackers had stolen the personal information of many of its customers, financial professionals, and select Allianz Life employees in the United States.  The insurance giant's filing with Maine's attorney general did not immediately provide the number of customers affected.  According to the filing, the data breach, which the company described as a hack, occurred on July 16 and was discovered on July 17. 

TechCrunch first reported the data