Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

New research out of AhnLab documents the Cephalus ransomware group has been aggressively exploiting stolen Remote Desktop Protocol (RDP) credentials to break into networks and execute rapid, destructive encryption campaigns. The pattern is straightforward and brutal: credentials get you in, and once inside the attackers move fast to blind and break recovery.

As Anti-Virus and EDR solutions improve in detection and response capabilities, the job of a red teamer can become quite arduous. Malware payloads and techniques that once dominated networks have failed the test of time as EDR becomes aware of them. If your initial access payloads are detected immediately, your six-week long red team could be dead on arrival.

Arctic Wolf’s The State of Cybersecurity: 2025 Trends Report revealed that 23% of organizations experienced at least one significant ransomware attack in 2024. And these attacks remain difficult for organizations to remediate without succumbing to threat actor demands, with the same report finding 76% of victim organizations are electing to pay the ransom to regain access to their data and environment.

BlueVoyant’s Threat Fusion Cell (TFC) and Security Operations Center (SOC) have uncovered a cyber campaign that signals a concerning evolution in the threat landscape: the rise of the "LLM-Enabled Developer." In-depth analysis suggests the actor behind an ongoing ClickFix campaign leveraged publicly documented advanced attack chains, powered by AI-generated code, to deploy a less sophisticated, but capable Node.js RAT.

The package states it is for the GitHub Actions Toolkit, which has a legitimate npm package @actions/artifact. Therefore this malware package is a clear typosquat with the swapping of the letters “ti” for “it”. We took a look at the “harness” binary as indicated in version 4.0.13.

In the autumn of 2025, well-crafted emails landed in inboxes with subject lines that read like routine diplomacy: invitations to regional workshops, follow-ups on border-facilitation talks, agendas for logistics and procurement. The attachments looked ordinary — a short, convenient file that promised to open a document or shortcut to a resource. But inside those tiny shortcuts lived a trap.

The battle against cyber threats is never-ending — and mobile is the new battleground. Modern workers now rely on mobile devices to access sensitive information, often using a single device for personal and professional purposes. As a result, malicious actors have sensed a blind spot and are using these devices as the first line of attack to gain a foothold into secure systems. 1.2 million enterprise employees were exposed to mobile phishing attacks in Q2 2025.

Government administration, defense, and finance sector organizations are the primary areas Advanced Persistent Threat (APT) groups are targeting, according to the most recent data from the Trustwave SpiderLabs’ Cyber Threat Intelligence (CTI) team. The team found most attacks are launched from China, Russia, and Iran, with the primary targets residing in the US, Ukraine, and, interestingly, Russia. The groups tracked include Lapsus$, ShinyHunters, and Silk Typhoon.