Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Corelight

Identifying and detecting ScoutC2 malware

Jul 7, 2026 By Corelight Labs Team In Corelight
At Corelight Labs, our mission is to help organizations stay a step ahead of evolving threats. When our researchers came across Censys' detailed write-up on ScoutC2, a rapidly growing open-source command-and-control (C2) framework favored by threat actors, we knew we needed to bolster community defenses quickly.
Read Post
miniorange

What is a Ransomware Attack? Definition, Types & Prevention Strategies

Jul 6, 2026 By Alankrita Shrivastava In miniOrange
Ransomware isn’t just a rising threat, it’s a daily reality for thousands of businesses around the world. These attacks are faster, smarter, and more damaging than ever, with global losses projected to reach $275 billion a year by 2031, according to Cybersecurity Ventures. Understanding how ransomware works is the first step toward stopping it. In this blog, we’ll break down how these attacks unfold and what you can do to defend your systems.
Read Post
cyberint

BlackMatter Ransomware Explained: Delivery Methods, Tactics, and Targets

Jul 5, 2026 By Adi Bleih In Cyberint
Emerging in July 2021, BlackMatter is a ransomware-as-a-service (RaaS) platform that permits the developers of the ransomware to generate income through the actions of their cybercriminal associates, referred to as BlackMatter actors, who utilize it against targets. BlackMatter is potentially a reimagining of DarkSide, another RaaS that remained operational from September 2020 to May 2021.
Read Post

Ep. 66 - Poisoned Pipelines: TeamPCP and the FBI Flash on Weaponized Dev Tools

Jul 5, 2026 By SafeBreach In SafeBreach
A criminal crew with APT-grade patience is trojanizing the very tools defenders trust. Host Tova Dvorin sits down with Adrian Culley to break down FBI FLASH-20260702-01 (coordinated with CISA) on TeamPCP — the group compromising Trivy, KICS, LiteLLM, and the Telnyx SDK to sit inside CI/CD pipelines. Inside: the CanisterWorm and SANDCLOCK credential stealers, the self-replicating "Mini Shai-Hulud" worm across npm and PyPI, npm account takeovers via expired recovery domains, and five concrete defenses — starting with searching your GitHub org for "tpcp-docs" right now.
View Video
Arctic Wolf

Security Bulletin: GitHub Impersonation Deploys Information Stealer

Jul 2, 2026 By Arctic Wolf Labs In Arctic Wolf
Arctic Wolf Internal Security Operations (SecOps) recently identified a GitHub page impersonating Arctic Wolf to target our customers and prospects. The SecOps team immediately escalated these findings to our Threat Research team, who uncovered a complex attack chain subsequently deploying information-stealing malware. Arctic Wolf has since removed this fake GitHub page.
Read Post
sophos

Vect and TeamPCP partner for ransomware campaigns

Jul 2, 2026 By Sophos Counter Threat Unit Research Team In Sophos
Counter Threat Unit (CTU) researchers investigated two interconnected threat groups known as Vect and TeamPCP. The two groups announced a formal operational partnership in late March 2026 to combine TeamPCP’s credential harvesting and data theft capabilities with Vect’s ransomware deployment infrastructure in a widespread campaign involving supply chain attacks and the extortion of multiple organizations.
Read Post
securonix

Veil#Drop: Blogspot-Hosted PowerShell Loader

Jul 1, 2026 By Akshay Gaikwad, Shikha Sangwan, Aaron Beardslee In Securonix
Veil#Drop is a sophisticated multi-stage malware delivery framework that combines social engineering, compromised websites, malicious JavaScript launchers, PowerShell download cradles, and trusted cloud-hosted infrastructure to deploy PureLog Stealer entirely in memory. The infection chain begins with a deceptively named JavaScript file masquerading as a document (e.g., transcript.pdf.js), which executes through Windows Script Host and launches PowerShell with execution policy bypasses enabled.
Read Post
mend

RubyGems supply chain attack: malware used as a credential exfiltration dead drop

Jul 1, 2026 By Maciej Mensfeld In Mend
Package registries have a well-known abuse pattern: attackers upload malicious packages, and unsuspecting developers install them. Our researchers just found the pattern working in reverse, in a RubyGems supply chain attack that turns the registry into a place to stash stolen data rather than deliver it.
Read Post
Arctic Wolf

From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks

Jun 30, 2026 By Arctic Wolf Labs In Arctic Wolf
Throughout 2026, Arctic Wolf has investigated multiple Anubis ransomware intrusions. Although threat actor tradecraft differs between intrusions, key themes have emerged: abuse of VPN infrastructure, blending in with legitimate activity through the use of Remote Monitoring and Management (RMM) solutions, and using other legitimate binaries on victim devices.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.