Cybercriminals have found a way to abuse Microsoft's Trusted Signing platform to sign malware with legitimate certificates, helping bypass security measures. Instead of stealing expensive Extended Validation certificates, attackers now exploit Microsoft's new cloud-based code signing servi...
Coinbase was the primary target in a sophisticated GitHub Actions supply chain attack that compromised hundreds of repositories. Attackers first breached the reviewdog/action-setup@v1 GitHub Action to dump CI/CD secrets from workflow logs, then used a stolen Personal Access Token to inject...
A newly identified APT group, UAT-5918, is targeting Taiwan's critical infrastructure, IT, telecommunications, academia, and healthcare sectors since 2023. The threat actor exploits unpatched vulnerabilities in web servers to establish long-term access for information theft. They deploy sp...
Medusa ransomware operators are deploying a malicious driver called ABYSSWORKER in sophisticated attacks to disable security protections. The driver, signed with stolen certificates, works alongside a HeartCrypt-packed loader to bypass security systems. ABYSSWORKER can terminate processes,...
This report details a China-linked APT group Aquatic Panda's global espionage campaign called "Operation FishMedley" that targeted government entities, Catholic charities, NGOs, and think tanks across six countries in 2022. The ten-month operation employed multiple malware families commonl...
