Key Findings In July 2026, a China-aligned threat actor Proofpoint tracks as TA419 conducted multiple credential phishing campaigns impersonating prominent economists and artificial

We asked TBI about allegations of £500,000 corporate memberships and a logo that vanished at Labour conference. They said they’re not talking to us anymore

Explore this post and more from the sysadmin community

A senior FBI official has made an unusually public ‌request to the hacking group ShinyHunters, telling the cybercriminals on Tuesday they should get in touch following a wide-ranging breach of the bur...

The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core components.

Foreign minister summons Russia’s chargé d’affaires over attack on Milrem Robotics as security agency says incident was ‘deliberate and pre-planned’

Last Updated: 2026-09-26T23:22:28Z (UTC) What’s Happening On 2026-09-26T07:00:00Z (UTC), a Reddit posts in the Citrix community indicated that the presence of two 0-day vulnerabilities in Citrix Netscaler devices. The poster was apparently advised to shut down external devices. Research firm WatchTowr corroborated the report, as did researcher Kevin Beaumont. Both Beaumont and WatchTowr doubled down on the claim later in the day. WatchTowr, while unable to confirm sourcing, stated t...

Microsoft details JADEPUFFER-linked Azure reconnaissance, resource deletion, and credential access using compromised service principals, identifying the activity as associated with Storm-3168 and prov...

The predicted wave of Iranian cyber retaliation never came

In this research note, we examine the digital infrastructure of BlackCore, an Israeli influence-for-hire company. We describe how we identified a BlackCore campaign consisting of a training program pr...

Case studies from threat actors disrupted between December 2025 and August 2026 across seven areas of harm, from cyber operations to biological misuse.

Combined action could lift global growth by 2.8% by 2035, report estimates

In collaboration with the SHARE Foundation, the Citizen Lab confirmed that the iPhone of a member of Serbia’s student protest movement was infected with Pegasus spyware.

Trump designated a collective that provides anonymous email services as a foreign “terrorist” group. It could curtail free speech in the U.S.

Trump designated a collective that provides anonymous email services as a foreign “terrorist” group. It could curtail free speech in the U.S.

Join us September 16-19th for LABScon, an intimate, invite-only event for the top cybersecurity minds to gather, share cutting-edge research.

Security researchers say residential proxy networks present a major threat by allowing hackers to commandeer home and office networks for cybercrime.

Discover how the Russian state-sponsored threat group BlueDelta is using the HOOKEDGE backdoor to target defense and diplomatic organizations across Europe

Initiates Operation Economic Outcast **WASHINGTON**—Today, at President Trump’s direction, the U.S. Department of the Treasury has begun Operation Economic Outcast: an unprecedented, whole-of-government, economic campaign against the Islamic Republic of Iran and its enablers. “In the Second World …

Distinct Russian clusters have been conducting phishing activity focused on Application Specific Passwords (ASP), OAuth flows, and malware delivery. All of these operations seem focused on account com...