Talion Threat Set Radio is your weekly cyber threat intelligence bulletin. We cut through the noise to give you our honest opinion on the threat news that matters.
…
continue reading
SolarWinds flaw exploited in the wild & hardcoded credentials. Report indicates ransom payments will break last years record. Lazarus exploit driver present on every Windows system.By Talion Threat Intelligence Team
…
continue reading
In this weeks episode: - Over 2 Billion Records of Personal Information Leaked. - Critical TCP/IP remote code execution vulnerability patched by Microsoft. - Ringleader of Ransom Cartel extradited to the US to face charges.By Talion Threat Intelligence Team
…
continue reading
The legal challenges against CrowdStrike begin following update incident. CISA re-issues seven year old warning over exploited Cisco install flaw. Chinese group compromises ISP to push poisoned infostealer updates.By Talion Threat Intelligence Team
…
continue reading
Microsoft vows less reliance on kernel drivers following CrowdStrike incident. Cloudflare trial product increasingly abused for criminal obfuscation. Black Basta sees success with in house tools following QBot takedown.By Talion Threat Intelligence Team
…
continue reading
Repair documentation used to push malware after CrowdStrike incident. New Linux variant of the prolific Play ransomware discovered. New ICS malware FrostyGoop responsible for Ukraine attack.By Talion Threat Intelligence Team
…
continue reading
Report highlights alarming speed PoC exploits are weaponized. Kaspersky offers 6 months free service as farewell to US market. Fin7 offers sophisticated evasion tool on underground markets. CrowdStrike botched update causes global havoc.By Talion Threat Intelligence Team
…
continue reading
Eldorado ransomware claims 16 victims in short timeframe. Free decryptor released by Avast for DoNex ransomware strain. Blast Radius attacks leverage MD5 collisions to gain admin.By Talion Threat Intelligence Team
…
continue reading
"regreSSHion" SSH flaw leads to root on Linux servers. GootLoader continues to deploy updated versions in new attacks.By Talion Threat Intelligence Team
…
continue reading
Kaspersky software banned in US due to national security concerns. LockBit misleadingly claims to hit US federal reserve. TeamViewer compromised by Russian state sponsored APT group.By Talion Threat Intelligence Team
…
continue reading
PoC exploit code available for heavily targeted Veeam backup solution. New loader dubbed PhantomLoader delivers MaaS payloads. Black Basta may have exploited flaw 3 months before fix issued, as 0 day.By Talion Threat Intelligence Team
…
continue reading
Attackers target GitHub repos once again in Ransom-lite extortion. Windows will finally depreciate NTLM, providing transition advice. PoC chaining two flaws for Telerik report released.By Talion Threat Intelligence Team
…
continue reading
In this week news: Check Point Zero-day vulnerability. Okta Credential Stuffing. Operation Endgame Targets Botnets.By Talion Threat Intelligence Team
…
continue reading
In this weeks episode, LockBit Ransomware group have had nothing but setbacks since “Operation Chronos”, GitHub alerts users to 2 high severity vulnerabilities and a significant uptick in Docusign phishing emails has been observed in May.By Talion Threat Intelligence Team
…
continue reading
LockBit ransomware admin is named and sanctioned. North Korean actors exploiting weak DMARC policies for spearphishing. Ivanti flaws chained together to drop Mirai botnet.By Talion Threat Intelligence Team
…
continue reading
Developers targeted with Python backdoor during false job interviews. New UK law now in effect limits default passwords on smart devices. New malware emerges targeting small office and home routers.By Talion Threat Intelligence Team
…
continue reading
MITRE breached using two Ivanti zero days. CrushFTP victim of targeted zero day exploitation. ArcaneDoor campaign targets vulnerable Cisco devices.By Talion Threat Intelligence Team
…
continue reading
Large scale exploitation of Palo Alto CVE following PoC disclosures. Atlassian vulnerability leveraged to deploy Cerber ransomware. PuTTY flaw can be used to obtain private cryptographic keys.By Talion Threat Intelligence Team
…
continue reading
Warnings issued regarding 10/10 CVSS score Rust vulnerability. Researchers speculate LLM wrote Powershell for malware strain. Change Healthcare hit by ransom demand again following AlphV exit scam.By Talion Threat Intelligence Team
…
continue reading
Sophisticated supply chain attack attempted against multiple Linux distros. Linux false Sudo prompt flaw has persisted for over a decade. DinodasRAT now targeting Linux servers with new variant.By Talion Threat Intelligence Team
…
continue reading
Huge darknet marketplace seized by German takedown effort. Muddywater group using legitimate RM tools for access. APT31 members sanctioned following US infrastructure attacks.By Talion Threat Intelligence Team
…
continue reading
Fujitsu discover malware compromised systems. Russian actors may be targeting Ukrainian telecoms with new wiper malware. New DoS technique discovered able to create infinite feedback loop.By Talion Threat Intelligence Team
…
continue reading
Russian groups accesses Microsoft source code in follow up from January attack. StopCrypt, the ransomware still targeting individuals over business has been upgraded. DarkGate leverage recent SmartScreen vulnerability in attacks.By Talion Threat Intelligence Team
…
continue reading
The Blackcat / AlphV ransomware operation fakes law enforcement takedown to steal from their own affiliate.By Talion Threat Intelligence Team
…
continue reading
LockBit claims swift recovery from takedown operation, downplaying severity and threatening leaks. Lazarus exploit Windows zero day flaw with new improved Rootkit.By Talion Threat Intelligence Team
…
continue reading
DoJ takes down botnet used by Russian state group. LockBit ransomware operation gutted by the NCA. ScreenConnect under active attack, Lockbit utilised.By Talion Threat Intelligence Team
…
continue reading
Anydesk confirms cyberattack that allowed hackers to gain access to the company's production systems, Cloudflare publicly disclose its internal Atlassian server was breached by a suspected nation-state attacker and the FBI disrupt and neutralize KV-botnet.By Talion Threat Intelligence Team
…
continue reading
Microsoft confirms details of recent Russian compromise. Kasseika joins ransomware groups performing BYOVD attacks. Trickbot browser injection developer jailed.By Talion Threat Intelligence Team
…
continue reading
VMware critical flaw under active exploitation. Critical vulnerability discovered in Juniper firewalls and switches. Ivanti bypass flaw exploited in the wild.By Talion Threat Intelligence Team
…
continue reading
Evasive Async RAT has targeted infrastructure for almost a year. New FBot toolkit targets SaaS and cloud platforms. Turkish group uses Mimic ransomware to target MSSQL servers.By Talion Threat Intelligence Team
…
continue reading
Critical Invanti flaw allows compromise of enrolled devices. Multiple malware strains use Google feature for persistence. Microsoft disables MSIX after it is abused by malware again.By Talion Threat Intelligence Team
…
continue reading
Rhadamanthys infostealer gains popularity with new features. MongoDB confirms breach and theft of customer data. FBI confirms it breached the Blackcat ransomware group.By Talion Threat Intelligence Team
…
continue reading
AlphV ransomware outage rumored to be caused by FBI. New "Pool Party" injection technique evades 5 leading EDR solutions. Lazarus continues to abuse Log4J with 3 new malware strains.By Talion Threat Intelligence Team
…
continue reading
NCSC warns of Russian state group social engineering activity. Okta customers affected by recent attack revised from 1% to 100%. Researchers discover Linux rootkit RAT undetected since 2021.By Talion Threat Intelligence Team
…
continue reading
Ransomware group arrested in Ukraine following attacks against 71 countries. Method discovered to passively extract RSA keys from SSH connections. Chrome fixes its 6th zero day exploited in the wild this year.By Talion Threat Intelligence Team
…
continue reading
Russian state USB malware spreads to unintended targets. Qbot moves to Darkgate and Pikabot following takedown. Criminals claim ability to reuse expired Google auth cookies.By Talion Threat Intelligence Team
…
continue reading
CISA adds three flaws to its KEV Google Workspace and Cloud highlighted as attack vector. VMWare warns of critical VCD flaw.By Talion Threat Intelligence Team
…
continue reading
Microsoft will soon begin moving towards mandatory full MFA adoption. GootLoader variant moves to stealthier self developed bot. BlazeStealer targets developers with malicious code repos.By Talion Threat Intelligence Team
…
continue reading
Recent F5 Big IP flaws exploited in stealthy attacks. Citrix bleed flaw leveraged against government targets. Mozi dismantled by mysterious killswitch command.By Talion Threat Intelligence Team
…
continue reading
Fake Corsair job offers pushing Darkgate malware strain. Ragnar Locker operation dealt heavy blow by Europol. Okta support system compromised, customers breached.By Talion Threat Intelligence Team
…
continue reading
Another Citrix Netscaler flaw exploited as a zero day since August. Microsoft will phase out NTLM with Windows 11, in favour of Kerberos. Multiple nation state groups are exploiting a recent critical WinRAR flaw.By Talion Threat Intelligence Team
…
continue reading
Genetic information stolen by credential stuffing attack. New “rapid reset” zero day enables record breaking DDoS. Microsoft will kill of VBScript in the near future.By Talion Threat Intelligence Team
…
continue reading
New BunnyLoader MaaS becomes popular due to features and pricing. Atlassian Confluence under active exploitation from new 0-day. Looney Tunables vulnerability enables root on popular Linux distros.By Talion Threat Intelligence Team
…
continue reading
Maximum severity CVE assigned to libwebp following Google error New ShadowSyndicate group tied to several ransomware opsBy Talion Threat Intelligence Team
…
continue reading
VenomRAT dropped by fake PoC exploit for WinRAR flaw. Newly observed Sandman group targets Telecoms. BlackCat ransomware operation targets Azure storage.By Talion Threat Intelligence Team
…
continue reading
Teams phishing techniques ignored by Microsoft used by ransomware enablers. A new chain of Kubernetes vulnerabilities can lead to code execution. Operators of the Redline and Vidar malware pivot to ransomware.By Talion Threat Intelligence Team
…
continue reading
Cisco acknowledge VPN zero day exploited by ransomware actors. North Korean threat actors target cyber security researchers. New Blister malware updates drive quiet network infiltration.By Talion Threat Intelligence Team
…
continue reading
PoC Exploit chain enables RCE attacks against Juniper firewalls. Attacks against Citrix Netscaler devices linked to FIN8. Qakbot botnet dismantled in aptly named “Operation Duck Hunt”By Talion Threat Intelligence Team
…
continue reading
WinRAR flaw enables command execution by simply opening an archive. Malware strain maps victims location in real time via Wi-Fi triangulation. PoC exploit released for Ivanti vulnerability recently used in attacks.By Talion Threat Intelligence Team
…
continue reading
Nearly 2000 Citrix NetScaler servers compromised in new campaign. NoFilter, new stealthy privilege escalation technique discovered. Raccoon returns with version 2.3 after 6 month hiatus.By Talion Threat Intelligence Team
…
continue reading
AWS system manager can be leveraged as a remote access trojan. CISA highlights the SUBMARINE backdoor used in Barracuda ESG attacks. Google AMP links abused for stealthy phishing campaigns.By Talion Threat Intelligence Team
…
continue reading