Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

aikido

You're Invited: Delivering malware via Google Calendar invites and PUAs

May 13, 2025 By Mackenzie Jackson In Aikido
On March 19th, 2025, we discovered a package called os-info-checker-es6 and were taken aback. We could tell it was not doing what it said on the tin. But what's the deal? We decided to investigate the matter and initially hit some dead ends. But patience pays off, and we eventually got most of the answers we sought. We also learned about Unicode PUAs (No, not pick-up artists). It was a roller coaster ride of emotions!
Read Post
knowbe4

How to Protect Your Business from Scattered Spider's Latest Attack Methods

May 13, 2025 By KnowBe4 Team In KnowBe4
Mandiant warns that the Scattered Spider cybercriminal group is using “brazen” social engineering attacks to target large enterprise organizations in a wide range of sectors. Specifically, the group targets “organizations with large help desk and outsourced IT functions which are susceptible to their social engineering tactics.” The threat actors impersonate employees and attempt to trick IT workers into granting them access. The group also poses as IT workers to target employees.
Read Post
Risks of Using Public Wi-Fi for Crypto Transactions

Risks of Using Public Wi-Fi for Crypto Transactions

May 13, 2025 By SecuritySenses In SecuritySenses
As cryptocurrency adoption continues to rise, the ease of managing assets through mobile wallets and trading platforms has brought a new layer of convenience. However, this accessibility can also lead to overlooked security risks, especially when users rely on public Wi-Fi networks for transactions. Airports, coffee shops, hotels, and public transportation hubs may offer free internet access, but these networks present significant vulnerabilities that can expose sensitive information.
Read Post
tripwire

LockBit Ransomware Gang Breached, Secrets Exposed

May 9, 2025 By Graham Cluley In Tripwire
Oh dear, what a shame, never mind. Yes, it's hard to feel too much sympathy when a group of cybercriminals who have themselves extorted millions of dollars from innocent victims have found themselves dealing with their own cybersecurity problem. And that's just what has happened to the notorious LockBit ransomware gang, which has been given a taste of its own medicine.
Read Post
netskope

New DOGE Big Balls Ransomware Tools in the Wild

May 7, 2025 By Leandro Fróes In Netskope
During the Netskope Threat Labs hunting activities, we came across a payload that led us to a multi-stage chain involving several custom PowerShell scripts, open source tools (such as Mimikatz and Rubeus), vulnerable drivers being exploited, and red team framework payloads (such as Havoc). After further investigation, we discovered these files were part of the arsenal of what seems to be an operator of a ransomware named “DOGE Big Balls,” a variant of the Fog ransomware.
Read Post
WatchGuard

GhostGPT, the new malicious chatbot and its impact on cybersecurity

May 7, 2025 By Ryan Estes In WatchGuard
At this juncture, it is no surprise that cybercriminals are leveraging the potential of generative artificial intelligence to strengthen their attacks. However, the emergence of new models specifically designed to generate threats quickly has made this task even easier for bad actors. At the end of 2024, researchers discovered a new AI chatbot created for cybercriminal purposes.
Read Post
aikido

RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise)

May 6, 2025 By Charlie Eriksen In Aikido
On 5 May, 16:00 GMT+0, our automated malware analysis pipeline detected a suspicious package released, rand-user-agent@1.0.110. It detected unusual code in the package, and it wasn’t wrong. It detected signs of a supply chain attack against this legitimate package, which has about ~45.000 weekly downloads.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.