Threats & Attacks
Ransomware, malware, phishing and the actors behind them.
AI Cybersecurity Governance After IDCF Cloud’s 2026 Ransomware Outage
IDC Frontier’s disclosures on the 2026 IDCF Cloud ransomware incident show why AI cybersecurity governance depends on precise incident facts, clear customer impact, and careful recovery communication.
Onamae VPS Intrusion: Up to 26,739 Servers Reportedly Affected
Onamae Desktop Cloud reported unauthorized access and malware on customer servers, with up to 26,739 potentially affected.
Cybersecurity Is a Field, Not a Phishing Quiz
A grounded map of cybersecurity work—from risk and auditing to security operations—and a practical way to explore which kind of work suits you.
Inside Lazarus’s FlashHole Malware-Delivery Chain
Operation FlashHole pairs familiar Lazarus malware with ML-KEM-1024 to protect payload delivery. Here’s what the reported chain shows—and what defenders can reasonably do about it.
Cybersecurity Best Practices for Infrastructure: What SafePay’s Reach Reveals
SafePay’s reported impact across more than 600 critical infrastructure organizations shows how exposed credentials, edge-device weaknesses and fragile recovery plans can combine in a ransomware incident.
AOMEI’s Brief Update Tampering Left a Longer Endpoint Problem
Three short-lived changes to AOMEI update configuration in 2025 reportedly delivered malware to Backupper and AnyViewer clients. The important distinction: fixing the server does not clean an endpoint that already ran the payload.
Deceptive AI Branding and ClickFix Tactics: How Threat Actors Target Developers Through Trusted Channels
Comprehensive analysis of emerging campaigns impersonating popular AI developer brands using advanced ClickFix-like social engineering, ad abuse, and multi-layer redirects.
Cybersecurity Data Breaches Expose the Blind Spot at the Heart of Vendor Trust
The arrest of Edward Dubrovsky — a well-known ransomware negotiator — reveals how organizations routinely hand attackers the keys to their own incident response program.
When a cybersecurity data breach turns physical: ransomware gangs target employees and their families
Semperis' 2026 Ransomware Risk Report finds attackers increasingly threaten psychological and physical harm against staff, friends and family to force payment. What the survey data shows, what it does not, and how organizations can protect people alongside systems.
The licensing heartbeat that brought down a billion-message phishing network
A technical read of the Yam Store takedown: how Iron Man's self-hosted phishing kits stayed alive through a vendor licensing heartbeat, a 911-build container pipeline, and customer-fronted domains — and why those design choices were also the network's weakest links.
Dismantling Yam Store: Inside the Global Phishing-as-a-Service Operation Behind One Billion Malicious Messages
Expanded article on Yam Store takedown, phishing-as-a-service, and AI cybersecurity threats.
Hirudo’s App-Swap Tactic Puts Global Cybersecurity Events & Conferences and Mobile Banking Defenses to the Test
Detailed analysis of Hirudo, an Android banking malware that uninstalls legitimate banking apps and replaces them with modified versions utilizing YAHFA and Dobby hooking engines to evade Play Integrity and steal credentials, discussed across global cybersecurity events.