X-Industry

When programmers encounter puzzling code, their brains react in measurable ways.  Now, researchers have shown that large language models (LLMs) exhibit similar signs of confusion when reading the same code.  In a study from Saarland University and the Max Planck Institute for Software Systems, scientists compared human brain activity with LLM uncertainty and found striking alignment.  Wherever humans struggled, the models did too.  This discovery, described in the paper “How do Humans and LLMs P

Arizona Attorney General Kris Mayes is suing Temu, a large online marketplace founded in 2022.  According to a 02 December 2025 press release, Temu violated the Arizona Consumer Fraud Act through "unlawful data collection, violations of customers' privacy, and counterfeiting some of Arizona's most iconic brands."  Temu is best known for allowing primarily Chinese sellers to sell products directly to Western consumers, including those in the US.  Mayes accused Temu of harvesting sensitive user da

Consumers are urged to exercise caution this Christmas shopping season, as new research from McAfee Labs indicates a significant increase in brand impersonation by cybercriminals.  The Tech giants Apple, Nintendo, and Samsung, alongside luxury labels like Coach, Dior, and Gucci, are among the most frequently faked brands targeted by scammers.   McAfee’s analysis of festive shopping scams is based on real-world web activity data collected between October and November 2025, specifically focusing o

The slow-motion Russian invasion of Ukraine has highlighted persistent vulnerabilities in Western military readiness, specifically concerning munitions stockpiles, supply chain resilience, and procurement agility.  As the conflict continues, nations are adjusting their force posture and defense planning.  These changes aim not only to support Ukraine but also to prepare for the realities of prolonged, multi-domain warfare.

While quantum computing and automation are shaping the following stages o

In an age where artificial intelligence is increasingly trusted to judge human expression, a subtle but essential flaw has emerged.  Large language models (LLMs), the same systems that generate essays, screen job applications, and moderate online discourse, appear to evaluate content fairly, until they’re told who wrote it.  A new study by researchers Federico Germani and Giovanni Spitale at the University of Zurich, published in Science Advances, reveals that LLMs exhibit systematic bias when t

US DHS, CISA, along with authoring organizations, assess pro-Russia hacktivist groups are conducting less sophisticated, lower-impact attacks against critical infrastructure entities, compared to advanced persistent threat (APT) groups.  These attacks use minimally secured, internet-facing virtual network computing (VNC) connections to infiltrate (or gain access to) OT control devices within critical infrastructure systems.  Pro-Russia hacktivist groups: Cyber Army of Russia Reborn (CARR), Z-Pen

The Hoxhunt 2025 Cyber Threat Intelligence Report delivers a sobering message for security professionals: the most dangerous threats are no longer the most obvious ones.  As 2026 approaches, enterprises are no longer fighting clumsy, error-riddled bulk spam; they are facing a quiet revolution where sophisticated, convincing attacks blend seamlessly into daily workflows, fueled by AI and advanced token-theft toolkits.

See:  https://hoxhunt.com/guide/threat-intelligence-report

The report, based on

UDPGangster is a UDP-based backdoor associated with the MuddyWater threat group, which is known for its cyber espionage operations across the Middle East and neighboring regions.  This malware enables remote control of compromised systems by allowing attackers to execute commands, exfiltrate files, and deploy additional payloads, all communicated through UDP channels designed to evade traditional network defenses.

Researchers recently observed multiple UDPGangster campaigns targeting users in Tu

During a recent incident response engagement, researchers at the FortiGuard IR services (FGIR) responded to a ransomware attack where the threat actor heavily used anti forensic techniques to cover their tracks and to avoid their malware getting into the hands of researchers.  They attempted to achieve this by deleting files and folders they had created, clearing logs and obfuscating malware.

Link to full report:  IR-25-344-001_AutoLogger.pdf

At the end of October, during a global disruption of AWS connections, FortiGuard Labs observed malware named “ShadowV2” spreading via IoT vulnerabilities.  These incidents affected multiple countries worldwide and spanned seven different industries.  To date, the malware appears to have been active only during the large-scale AWS outage.  Researchers believe this activity was likely a test run conducted in preparation for future attacks.  The following article provides a detailed analysis of the

Marquis Software Solutions is notifying banks and credit unions of a ransomware attack that leaked their customer data.  The Texas-based digital and physical marketing firm learned of the ransomware cyber-attack on 14 August 2025, after detecting suspicious activity on its network.  It responded by launching an investigation and notifying law enforcement.  The probe determined that the threat actor breached its SonicWall firewall to gain initial access.[1]

After gaining access, the attackers exf

Some of the nation's largest banks, including JPMorgan Chase, Citi, and Morgan Stanley, spent the end of November 2025 assessing exposure after a significant cyberattack on SitusAMC, a major technology and services vendor in the mortgage and real estate finance ecosystem.  SitusAMC confirmed that a cyberattack hit it on 12 November 2025 and that it has spent nearly two weeks determining which information was accessed. According to a statement posted on its website, the company identified "data r

Industrial cyber security is facing significant challenges driven by the increasing complexity of attacks, such as ransomware and supply-chain compromises, alongside a proliferation of interconnected devices and a persistent shortage of skilled professionals.  Attacks against critical infrastructure have evolved from isolated incidents into coordinated conducted by both state and non-state actors.

Cyber threats have increased in frequency and technical capability, particularly those leveraging A

A Chinese state-aligned threat actor may have been spying on Russia's government for years through its IT sector.  For all of the adversarial intelligence gathering going on in the world today, there is also plenty of spying among friends. Friendly nations, and friendly-ish nations like China and Russia, regularly use cyberspace against their allies to glean potentially valuable political or economic intelligence, gain advantages in strategic negotiations, or simply steal technology.

On 20 Novem

Europol has taken down the illegal cryptocurrency mixing service ‘Cryptomixer’, which is suspected of facilitating cybercrime and money laundering.  During the operation, which was conducted in conjunction with Swiss and German law enforcement, €25m ($30m) worth of the cryptocurrency Bitcoin was seized.  Action took place between 24-28 November 2025 in Zurich, Switzerland.

Three servers were seized, along with the cryptomixer.io domain.  The operation resulted in the confiscation of over 12 tera

After years of quiet escalation, business leaders are finally beginning to grasp just how serious the threat of fraud has become. Today, nearly half of all fraud attempts (41%) now involve artificial intelligence.  Nowhere is this more evident than in the payments industry.  Fraudsters can use AI to generate convincing fake invoices, purchase orders, and payment instructions that mirror legitimate business documents.  I’ve seen examples that are indistinguishable from the real thing, which is a

Imagine if a hacker could gain full control of your smartphone and stream everything on its screen to their own device?  Well, a new Android banking trojan allows them to do just that, but they can also tap, swipe, type and navigate through hijacked smartphones in real time.  According to a new blog post from the cybersecurity site Malwarebytes, security researchers at the online fraud management firm Cleafy have discovered a new Android malware family called Albiriox.  Despite being fairly new,

A long-running malware operation that has evolved over several years has been turning browser extensions in Chrome and Edge into spyware through updates that added malicious functionalities.  According to a report from Koi Security, the ShadyPanda campaign affects 4.3 million users who downloaded these now compromised browser extensions.

The ShadyPanda campaign consists of 20 malicious extensions on the Chrome Web Store and 125 in Edge; initial submissions of the extensions appeared in 2018, and

Cybercriminals have targeted 700Credit, the largest provider of credit, identity, and compliance services for dealerships, breaching sensitive data of approximately 5.6 million customers and nearly 18,000 dealerships in North America.  This incident occurred in late October and involved names, addresses, Social Security numbers, and employment information.

The breach, confirmed by Managing Director Ken Hill, resulted from a compromise of the 700Dealer.com website.  A third-party vendor’s API con

Red Sky Alliance monthly queries our backend databases, identifying all new data containing Motor Vessel (MV) and Motor Tanker (MT) in the subject line of malicious emails.  Malicious actors use emails with Motor Vessel (MV) or Motor Tanker (MT) in the subject line as a lure to entice users in the maritime industry to open emails containing malicious attachments.  Red Sky Alliance is providing this list of Motor Vessels in which we directly observed the vessel being impersonated, with associate