Category: North America

Analyze the latest North American cybersecurity trends, from critical infrastructure protection to evolving threat actor tactics. Get expert insights on regional data security, identity management, and the impact of AI on digital defense across the U.S. and Canada.

Global Security News, North America

ISC Stormcast For Monday, December 22nd, 2025 https://isc.sans.edu/podcastdetail/9748, (Mon, Dec 22nd)

December 21, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

ATM Jackpotting ring busted: 54 indicted by DoJ

December 20, 2025

The U.S. Department of Justice has indicted 54 individuals over a multi-million-dollar ATM jackpotting fraud scheme. U.S. DoJ indicted 54 people for a nationwide ATM jackpotting scheme that stole millions via malware. The case links the crimes to the cybercrime group Tren de Aragua, including charges of fraud, money laundering, and material support to a…

Ukrainian national pleads guilty to Nefilim ransomware attacks

December 19, 2025

Artem Aleksandrovych Stryzhak, a 35-year-old Ukrainian national, pleaded guilty Friday to multiple crimes stemming from his involvement in a string of ransomware attacks targeting U.S. and Europe-based organizations from mid 2018 to late 2021. He faces up to 10 years in jail for conspiracy to commit fraud, including extortion. Stryzhak was arrested in Spain in…

Dismantling Defenses: Trump 2.0 Cyber Year in Review

December 19, 2025

The Trump administration has pursued a staggering range of policy pivots this past year that threaten to weaken the nation’s ability and willingness to address a broad spectrum of technology challenges, from cybersecurity and privacy to countering disinformation, fraud and corruption. These shifts, along with the president’s efforts to restrict free speech and freedom of…

Criminal IP and Palo Alto Networks Cortex XSOAR integrate to bring AI-driven exposure intelligence to automated incident response

December 19, 2025

Torrance, United States / California, 19th December 2025, CyberNewsWire

DLLs & TLS Callbacks, (Fri, Dec 19th)

December 19, 2025

Xavier’s diary entry “Abusing DLLs EntryPoint for the Fun” inspired me to do some tests with TLS Callbacks and DLLs. TLS stands for Thread Local Storage. TLS Callbacks are an execution mechanism in Windows PE files that lets code run automatically when a process or thread starts, before the program’s normal entry point is reached. I’ve…

ISC Stormcast For Friday, December 19th, 2025 https://isc.sans.edu/podcastdetail/9746, (Fri, Dec 19th)

December 18, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

ISC Stormcast For Thursday, December 18th, 2025 https://isc.sans.edu/podcastdetail/9744, (Thu, Dec 18th)

December 17, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Tech sector continues downward slide amid modest US job growth in November

December 17, 2025

The US economy added 64,000 jobs in November, but the slide in tech jobs continued, with the telecom sector and computer systems design seeing declines. The US Bureau of Labor Statistics said the number of people employed in November totaled 163.7 million, while the number of unemployed was 7.1 million. The overall unemployment rate rose…

ISC Stormcast For Wednesday, December 17th, 2025 https://isc.sans.edu/podcastdetail/9742, (Wed, Dec 17th)

December 16, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

ISC Stormcast For Wednesday, December 17th, 2025 https://isc.sans.edu/podcastdetail/9742, (Wed, Dec 17th)

December 16, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

A cyber attack hit Petróleos de Venezuela (PDVSA) disrupting export operations

December 16, 2025

A cyber attack hit Petróleos de Venezuela (PDVSA), Venezuela’s state-owned oil company, over the weekend, disrupting its export operations. Venezuela’s state oil company PDVSA was hit by a cyberattack over the weekend that disrupted export operations. The company says the incident only affected some administrative systems and did not impact operations. “Thanks to the expertise…

Amazon Exposes Years-Long GRU Cyber Campaign Targeting Energy and Cloud Infrastructure

December 16, 2025

Amazon’s threat intelligence team has disclosed details of a “years-long” Russian state-sponsored campaign that targeted Western critical infrastructure between 2021 and 2025. Targets of the campaign included energy sector organizations across Western nations, critical infrastructure providers in North America and Europe, and entities with cloud-hosted network infrastructure. The activity has

ISC Stormcast For Tuesday, December 16th, 2025 https://isc.sans.edu/podcastdetail/9740, (Tue, Dec 16th)

December 15, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

AI is causing all kinds of problems in the legal sector

December 15, 2025

The American Bar Association believes the use of artificial intelligence in the legal sector is eroding key procedures, documentary records and evidence relied on to establish ground-level truth in the court system. In a report released this month the ABA, which sets ethical standards for the legal profession and oversees the accreditation of roughly 400,000…

Critical React2Shell Vulnerability (CVE-2025-55182) Analysis: Surge in Attacks Targeting RSC-Enabled Services Worldwide

December 15, 2025

Torrance, United States / California, December 12th, 2025, CyberNewsWire In December 2025, CVE-2025-55182 (React2Shell), a vulnerability in React…

ISC Stormcast For Monday, December 15th, 2025 https://isc.sans.edu/podcastdetail/9738, (Mon, Dec 15th)

December 14, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Wireshark 4.6.2 Released, (Sun, Dec 14th)

December 14, 2025

Wireshark release 4.6.2 fixes 2 vulnerabilities and 5 bugs. The Windows installers now ship with the Visual C++ Redistributable version 14.44.35112. This required a reboot of my laptop. Didier Stevens Senior handler blog.DidierStevens.com (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

ClickFix Attacks Still Using the Finger, (Sat, Dec 13th)

December 13, 2025

Introduction Since as early as November 2025, the finger protocol has been used in ClickFix social engineering attacks. BleepingComputer posted a report of this activity on November 15th, and Didier Stevens posted a short follow-up in an ISC diary the next day. I often investigate two campaigns that employ ClickFix attacks: KongTuke and SmartApeSG. When…

Abusing DLLs EntryPoint for the Fun, (Fri, Dec 12th)

December 11, 2025

In the Microsoft Windows ecosystem, DLLs (Dynamic Load Libraries) are PE files like regular programs. One of the main differences is that they export functions that can be called by programs that load them. By example, to call RegOpenKeyExA(), the program must first load the ADVAPI32.dll. A PE files has a lot of headers (metadata)…

ISC Stormcast For Friday, December 12th, 2025 https://isc.sans.edu/podcastdetail/9736, (Fri, Dec 12th)

December 11, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Warrant requirements, Democratic worries could factor into spy law renewal debate

December 11, 2025

A fresh effort is mounting in Congress to require federal agents to obtain a warrant before searching a government surveillance database for information about U.S. citizens, as Congress again faces an impending deadline, in four months, to renew a major surveillance law. But there are also signs that renewal of Section 702 of the Foreign…

ISO 27001 vs SOC 2 Certification: What’s the Difference?

December 11, 2025

Want to improve your data security but can’t decide between ISO 27001 and SOC 2? You’re in a familiar position. They’re two of the most popular information security and risk management frameworks in the world, and each one has its benefits. But what is the difference between SOC 2 and ISO 27001? Let’s look at which one is…

Using AI Gemma 3 Locally with a Single CPU , (Wed, Dec 10th)

December 10, 2025

Several months ago, I got a Nucbox K8 Plus minicomputer to use as a Proxmox 9 server. At the time of this acquisition, I didn’t realize this minicomputer had an artificial intelligence (AI) engine [1] build in the CPU that could be used to run AI applications locally. A coworker recommended that I try Google…

ISC Stormcast For Thursday, December 11th, 2025 https://isc.sans.edu/podcastdetail/9734, (Thu, Dec 11th)

December 10, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Ransomware may have extorted over $2.1 billion between 2022-2024, but it’s not all bad news, claims FinCEN report

December 10, 2025

A new report from the United States’s Financial Crimes Enforcement Network (FinCEN) has shone a revealing light on the state of the criminal industry of ransomware. The report, which examines ransomware incidents from 2022 to 2024, reveals that attackers extorted more than $2.1 billion over the three-year period. Yes, that number is enormous – but…

US charges hacker tied to Russian groups that targeted water systems and meat plants

December 10, 2025

The Justice Department has charged a Ukrainian national with conducting cyberattacks on critical infrastructure worldwide as part of two Russian state-sponsored hacking operations that targeted water systems, food processing facilities and government networks across the United States and allied nations. Victoria Eduardovna Dubranova, 33, was arraigned on a second indictment Tuesday after being extradited to…

ISC Stormcast For Wednesday, December 10th, 2025 https://isc.sans.edu/podcastdetail/9732, (Wed, Dec 10th)

December 9, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Best Places to Work in IT 2026

December 9, 2025

In a volatile jobs market upended by AI and a host of other factors, it’s important to recognize employers that go above and beyond to support their IT workforce. For the 32nd year, Computerworld publisher Foundry surveyed large, midsize, and small organizations to find those exceptional organizations. Read our special report to see which companies…

ISC Stormcast For Tuesday, December 9th, 2025 https://isc.sans.edu/podcastdetail/9730, (Tue, Dec 9th)

December 8, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

ISC Stormcast For Tuesday, December 9th, 2025 https://isc.sans.edu/podcastdetail/9730, (Tue, Dec 9th)

December 8, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Officials offer $10M reward for information on IRGC-linked leader and close associate

December 8, 2025

The State Department is seeking help to locate a pair of hackers allegedly working for Shahid Shushtari, a malicious cyber unit operating under Iran’s Revolutionary Guard Corps Cyber-Electronic Command. Officials are offering a reward up to $10 million for information about Mohammad Bagher Shirinkar and Fatemeh Sedighian Kashi. “Help us take the smile off their…

Defense bill addresses secure phones, AI training, cyber troop mental health

December 8, 2025

The Defense Department would require that senior leaders have secure mobile phones, that personnel would get cybersecurity training that includes a focus on artificial intelligence and that cyber troops would have access to mental health services under a compromise annual defense policy bill released over the weekend. The deal between House and Senate negotiators on…

ISC Stormcast For Monday, December 8th, 2025 https://isc.sans.edu/podcastdetail/9728, (Mon, Dec 8th)

December 7, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Performance vs Pricing: How US VPS Plans Compare

December 5, 2025

In this performance vs pricing comparison post, I will show you how US VPS plans compare. The search for a reliable VPS in the United States often feels like a practical balancing act. People want stability without budget creep, and they want enough computing strength to run projects without hitting unexpected limits. The conversation around…

Sprocket Security Earns Repeat Recognition in G2’s Winter 2025 Relationship Index for Penetration Testing

December 5, 2025

Madison, United States, 5th December 2025, CyberNewsWire

AutoIT3 Compiled Scripts Dropping Shellcodes, (Fri, Dec 5th)

December 5, 2025

AutoIT3[1] is a powerful language that helps to built nice applications for Windows environments, mainly to automate tasks. If it looks pretty old, the latest version was released last September and it remains popular amongst developers, for the good… or the bad! Malware written in AutoIt3 has existed since the late 2000s, when attackers realized…

AutoIT3 Compiled Scripts Dropping Shellcodes, (Fri, Dec 5th)

December 5, 2025

ISC Stormcast For Friday, December 5th, 2025 https://isc.sans.edu/podcastdetail/9726, (Fri, Dec 5th)

December 4, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

ISC Stormcast For Friday, December 5th, 2025 https://isc.sans.edu/podcastdetail/9726, (Fri, Dec 5th)

December 4, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

ISC Stormcast For Thursday, December 4th, 2025 https://isc.sans.edu/podcastdetail/9724, (Thu, Dec 4th)

December 3, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Nation-State Attack or Compromised Government? [Guest Diary], (Thu, Dec 4th)

December 3, 2025

[This is a Guest Diary by Jackie Nguyen, an ISC intern as part of the SANS.edu BACS program] The ISC internship didn’t just teach me about security, it changed how I thought about threats entirely. There’s something intriguing about watching live attacks materialize on your DShield Honeypot, knowing that somewhere across the world, an attacker…

Attempts to Bypass CDNs, (Wed, Dec 3rd)

December 3, 2025

Currently, in order to provide basic DDoS protection and filter aggressive bots, some form of Content Delivery Network (CDN) is usually the simplest and most cost-effective way to protect a web application. In a typical setup, DNS is used to point clients to the CDN, and the CDN will then forward the request to the…

Google expands Android scam protection feature to Chase, Cash App in U.S.

December 3, 2025

Google is expanding support for its Android’s in-call scam protection to multiple banks and financial applications in the United States. […]

ISC Stormcast For Wednesday, December 3rd, 2025 https://isc.sans.edu/podcastdetail/9722, (Wed, Dec 3rd)

December 2, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Legislation would designate ‘critical cyber threat actors,’ direct sanctions against them

December 2, 2025

A House Republican introduced legislation Tuesday aimed at deterring cyberattacks against the United States at a time when the Trump administration is prioritizing the punishment of malicious hackers. Rep. August Pfluger, R-Texas, revived legislation he first sponsored in 2022, the Cyber Deterrence and Response Act. The legislation would direct the executive branch to formally designate…

MuddyWater strikes Israel with advanced MuddyViper malware

December 2, 2025

Iran-linked threat actor MuddyWater targeted multiple Israeli sectors with a new MuddyViper backdoor in recent attacks. ESET researchers uncovered a new MuddyWater campaign targeting Israeli organizations and one confirmed Egyptian target. The Iran-linked APT group MuddyWater (aka SeedWorm, TEMP.Zagros, Mango Sandstorm, TA450, and Static Kitten) deployed custom tools to evade defenses and maintain persistence. They used a Fooder loader,…

ISC Stormcast For Tuesday, December 2nd, 2025 https://isc.sans.edu/podcastdetail/9720, (Tue, Dec 2nd)

December 1, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Kevin Lancaster Joins the usecure Board to Accelerate North American Channel Growth

December 1, 2025

Lancaster’s arrival brings significant North American channel experience and expertise, supporting usecure’s ambition to cement its position as the market-leading human risk management solution for MSPs. usecure today announced the appointment of Kevin Lancaster as a Non-Executive Director. Kevin joins usecure with a wealth of experience in the North American channel and a strong background…

ISC Stormcast For Monday, December 1st, 2025 https://isc.sans.edu/podcastdetail/9718, (Mon, Dec 1st)

November 30, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Alliances between ransomware groups tied to recent surge in cybercrime

November 26, 2025

A seasonal surge in malicious activity combined with alliances between ransomware groups led to a 41% increase in attacks between September and October. Cybercriminal group Qilin continues to be the most active ransomware paddlers, responsible for 170 of 594 attacks (29%) in October, NCC Group reports. Sinobi and Akira followed with 15% of ransomware attacks…

ISC Stormcast For Wednesday, November 26th, 2025 https://isc.sans.edu/podcastdetail/9716, (Wed, Nov 26th)

November 25, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

OnSolve CodeRED cyberattack disrupts emergency alert systems nationwide

November 25, 2025

Risk management company Crisis24 has confirmed its OnSolve CodeRED platform suffered a cyberattack that disrupted emergency notification systems used by state and local governments, police departments, and fire agencies across the United States. […]

ISC Stormcast For Tuesday, November 25th, 2025 https://isc.sans.edu/podcastdetail/9714, (Tue, Nov 25th)

November 24, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Panasonic Connect’s Jamil King on 2026 Trends to Watch

November 24, 2025

As the IT channel heads into 2026, partners face accelerating demands around AI adoption, advanced security, and outcome-driven technology investments. In this Q&A, Jamil King, director of the U.S. Mobility Channel at Panasonic Connect North America, breaks down the top 2026 IT channel trends—from evolving customer expectations to the growing need for integrated, vertical-specific solutions—and…

ISC Stormcast For Monday, November 24th, 2025 https://isc.sans.edu/podcastdetail/9712, (Mon, Nov 24th)

November 23, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

YARA-X 1.10.0 Release: Fix Warnings, (Sun, Nov 23rd)

November 23, 2025

YARA-X’s 1.10.0 release brings a new command: fix warnings. If you have a rule that would generate a warning with a help section (explaining how to fix it), like this example rule: rule FixableCountWarning { strings: $a1 = “malicious” $a2 = “badstuff” condition: 0 of ($a*) } Then YARA-X from version 1.10.0 on can…

Wireshark 4.4.1 Released, (Sun, Nov 23rd)

November 23, 2025

Wireshark release 4.6.1 fixes 2 vulnerabilities and 20 bugs. Didier Stevens Senior handler blog.DidierStevens.com (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Use of CSS stuffing as an obfuscation technique?, (Fri, Nov 21st)

November 21, 2025

From time to time, it can be instructive to look at generic phishing messages that are delivered to one’s inbox or that are caught by basic spam filters. Although one usually doesn’t find much of interest, sometimes these little excursions into what should be a run-of-the-mill collection of basic, commonly used phishing techniques can lead…

ISC Stormcast For Friday, November 21st, 2025 https://isc.sans.edu/podcastdetail/9710, (Fri, Nov 21st)

November 20, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

NSO Group argues WhatsApp injunction threatens existence, future U.S. government work

November 20, 2025

NSO Group argued in a court filing this week that the court should pause the permanent injunction preventing it from targeting WhatsApp with its spyware while the company appeals the decision. According to the company, enforcing the injunction would cause irreparable harm to its business and prevent the U.S. government from using its products. Those…

Why Anna Gomez believes the FCC is letting telecoms off easy after Salt Typhoon

November 20, 2025

The Federal Communications Commission is set to vote Thursday on whether to rescind a set of last-minute Biden administration regulations following a massive Chinese compromise of U.S. telecommunications infrastructure last year. Chair Brendan Carr has called the rule ineffective and unlawful, and with the likely support of newly confirmed commissioner Olivia Trusty, there is a…

ISC Stormcast For Thursday, November 20th, 2025 https://isc.sans.edu/podcastdetail/9708, (Thu, Nov 20th)

November 19, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Russian bulletproof hosting provider sanctioned over ransomware ties

November 19, 2025

Today, the United States, the United Kingdom, and Australia announced sanctions targeting Russian bulletproof hosting (BPH) providers that have supported ransomware gangs and other cybercrime operations. […]

Unicode: It is more than funny domain names., (Wed, Nov 12th)

November 19, 2025

When people discuss the security implications of Unicode, International Domain Names (IDNs) are often highlighted as a risk. However, while visible and often talked about, IDNs are probably not what you should really worry about when it comes to Unicode. There are several issues that impact application security beyond confusing domain names. At first sight,…

SecurityMetrics Wins “Data Leak Detection Solution of the Year” in 2025 CyberSecurity Breakthrough Awards Program

November 19, 2025

Orem, United States, November 18th, 2025, CyberNewsWire SecurityMetrics, a leading innovator in compliance and cybersecurity, today announced that…

ISC Stormcast For Wednesday, November 19th, 2025 https://isc.sans.edu/podcastdetail/9706, (Wed, Nov 19th)

November 18, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

KongTuke activity, (Tue, Nov 18th)

November 18, 2025

Introduction Today’s diary is an example of KongTuke activity using fake CAPTCHA pages for a ClickFix-style lure. Also known as LandUpdate808 or TAG-124 and described as a sophisticated TDS system, KongTuke has been active since at least May 2024. I keep track of this campaign through the infosec.exchange Mastodon instance, which is mostly information from…

KongTuke activity, (Tue, Nov 18th)

November 18, 2025

ISC Stormcast For Tuesday, November 18th, 2025 https://isc.sans.edu/podcastdetail/9704, (Tue, Nov 18th)

November 17, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

ISC Stormcast For Tuesday, November 18th, 2025 https://isc.sans.edu/podcastdetail/9704, (Tue, Nov 18th)

November 17, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Decoding Binary Numeric Expressions, (Mon, Nov 17th)

November 17, 2025

In diary entry “Formbook Delivered Through Multiple Scripts“, Xavier mentions that the following line: Nestlers= array(79+1,79,80+7,60+9,82,83,72,69,76,76) decodes to the string POWERSHELL. My tool numbers-to-hex.py is a tool that extracts numbers from text files, and converts them to hexadecimal. Like this: I can then use another tool, hex-to-bin.py to convert the hexadecimal numbers to binary, and…

ISC Stormcast For Monday, November 17th, 2025 https://isc.sans.edu/podcastdetail/9702, (Mon, Nov 17th)

November 16, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Finger.exe & ClickFix, (Sun, Nov 16th)

November 16, 2025

The finger.exe command is used in ClickFix attacks. finger is a very old UNIX command, that was converted to a Windows executable years ago, and is part of Windows since then. In the ClickFix attacks, it is used to retrieve a malicious script via the finger protocol. We wrote about finger.exe about 3 years ago:…

SANS Holiday Hack Challenge 2025, (Sun, Nov 16th)

November 16, 2025

The SANS Holiday Hack Challenge™ 2025 is available. (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

DOJ lauds series of gains against North Korean IT worker scheme, crypto thefts

November 14, 2025

The Justice Department notched a few more wins in the fight against North Korean cryptocurrency heists and the regime’s expansive scheme to get remote IT workers hired at U.S. businesses. Officials’ countermeasures to these schemes, which ultimately launder ill-gotten money to North Korea’s government, involve the targeting of U.S.-based facilitators who provide forged or stolen…

ISC Stormcast For Friday, November 14th, 2025 https://isc.sans.edu/podcastdetail/9700, (Fri, Nov 14th)

November 13, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Iman Ghodosi Joins Prometheus Group as General Manager, APJ

November 13, 2025

COMPANY ANNOUNCEMENT: Prometheus Group, a global leader in enterprise asset management software, has announces the appointment of Iman Ghodosi as General Manager, Asia Pacific & Japan (APJ). Based in Sydney, Ghodosi brings over 25 years of enterprise software leadership across SAP, Oracle, NetSuite, Zuora, and Backbase, and a proven track record of scaling businesses across APJ…

Formbook Delivered Through Multiple Scripts, (Thu, Nov 13th)

November 13, 2025

When I’m teachning FOR610[1], I always say to my students that reverse engineering does not only apply to “executable files” (read: PE or ELF files). Most of the time, the infection path involves many stages to defeat the Security Analyst or security controls. Here is an example that I found yesterday. An email was received…

Formbook Delivered Through Multiple Scripts, (Thu, Nov 13th)

November 13, 2025

ISC Stormcast For Thursday, November 13th, 2025 https://isc.sans.edu/podcastdetail/9698, (Thu, Nov 13th)

November 12, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

SmartApeSG campaign uses ClickFix page to push NetSupport RAT, (Wed, Nov 12th)

November 12, 2025

Introduction This diary describes a NetSupport RAT infection I generated in my lab from the SmartApeSG campaign that used a ClickFix-style fake CAPTCHA page. Known as ZPHP or HANEYMANEY, SmartApeSG is a campaign reported as early as June 2024. When it started, this campaign used fake browser update pages. But it currently uses the ClickFix method of fake…

New Danabot Windows version appears in the threat landscape after May disruption

November 12, 2025

DanaBot returns after 6 months with a new Windows variant (v669), marking its comeback after being disrupted by Operation Endgame in May. DanaBot has resurfaced with a new variant (version 669) targeting Windows systems, six months after Operation Endgame disrupted its activity in May, according to Zscaler ThreatLabz. The researchers identified a set of command…

Google files lawsuit against Lighthouse ‘phishing for dummies’ text scammers

November 12, 2025

Google on Wednesday filed a lawsuit against pesky text message scammers — like those who flood targets with notices that they have unpaid road tolls, or have a package waiting — in an attempt to disrupt a “phishing for dummies” operation the company accuses of victimizing more than 1 million people. The lawsuit against 25…

Russian hacker admits helping Yanluowang ransomware infect companies

November 12, 2025

A Russian hacker accused of helping ransomware gangs break into businesses across the United States is set to plead guilty, according to recently filed federal court documents. 25-year-old Aleksey Olegovich Volkov worked as an “initial access broker”, a cybercriminal specialist who focuses on the earliest stage of an attack: gaining the first foothold inside a…

ISC Stormcast For Wednesday, November 12th, 2025 https://isc.sans.edu/podcastdetail/9696, (Wed, Nov 12th)

November 11, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

ISC Stormcast For Tuesday, November 11th, 2025 https://isc.sans.edu/podcastdetail/9694, (Tue, Nov 11th)

November 10, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

It isn’t always defaults: Scans for 3CX usernames, (Mon, Nov 10th)

November 10, 2025

Today, I noticed scans using the username “FTP_3cx” showing up in our logs. 3CX is a well-known maker of business phone system software [1]. My first guess was that this was a default user for one of their systems. But Google came up empty for this particular string. The 3CX software does not appear to…

DataStrike COO on H-1B Visa Concerns & Building Domestic Staff

November 10, 2025

As H-1B visa costs skyrocket due to recent federal action, many companies are reconsidering their talent sourcing heading into 2026. We spoke with Rob Brown, president and COO at database and cloud services provider DataStrike, about his company’s decision to retain domestic talent and where the market for onshore teams is heading. Why service providers…

ISC Stormcast For Monday, November 10th, 2025 https://isc.sans.edu/podcastdetail/9692, (Mon, Nov 10th)

November 9, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Honeypot: Requests for (Code) Repositories, (Sat, Nov 8th)

November 8, 2025

This is just a quick diary entry to report that I saw requests on my honeypot for (code) repositories: /.git/logs/refs/remotes/origin/main /.git/objects/info /.github /.github/dependabot.yml /.github/funding.yml /.github/ISSUE_TEMPLATE /.gitlab/issue_templates /.gitlab-ci /.git-secret /.svnignore /aws/bucket /s3/backup /s3/bucket /s3/credentials So watch out what you publish online when you deploy a repository to your web site. Didier Stevens Senior handler blog.DidierStevens.com…

Russian national pleads guilty to breaking into networks for Yanluowang ransomware attacks

November 7, 2025

A 25-year-old Russian national pleaded guilty to multiple charges stemming from their participation in ransomware attacks and faces a maximum penalty up to 53 years in prison. Aleksei Olegovich Volkov, also known as “chubaka.kor,” served as the initial access broker for the Yanluowang ransomware group while living in Russia from July 2021 through November 2022,…

ISC Stormcast For Friday, November 7th, 2025 https://isc.sans.edu/podcastdetail/9690, (Fri, Nov 7th)

November 6, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Binary Breadcrumbs: Correlating Malware Samples with Honeypot Logs Using PowerShell [Guest Diary], (Wed, Nov 5th)

November 5, 2025

[This is a Guest Diary by David Hammond, an ISC intern as part of the SANS.edu BACS program] My last college credit on my way to earning a bachelor’s degree was an internship opportunity at the Internet Storm Center. A great opportunity, but one that required the care and feeding of a honeypot. The day…

Cloudflare Scrubs Aisuru Botnet from Top Domains List

November 5, 2025

For the past week, domains associated with the massive Aisuru botnet have repeatedly usurped Amazon, Apple, Google and Microsoft in Cloudflare’s public ranking of the most frequently requested websites. Cloudflare responded by redacting Aisuru domain names from their top websites list. The chief executive at Cloudflare says Aisuru’s overlords are using the botnet to boost…

ISC Stormcast For Thursday, November 6th, 2025 https://isc.sans.edu/podcastdetail/9688, (Thu, Nov 6th)

November 5, 2025

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Updates to Domainname API, (Wed, Nov 5th)

November 5, 2025

For several years, we have offered a “new domain” list of recently registered (or, more accurately, recently discovered) domains. This list is offered via our API (https://isc.sans.edu/api). However, the size of the list has been causing issues, resulting in a “cut-off” list being returned. To resolve this issue, I updated the API call. It is…

Global Security News, North America

Breaking News, cyber crime, Global Security News, hacking, malware, North America

Australia, Canada, Cybercrime, Cybersecurity, Global Security News, North America, Ransomware

doge, Global Security News, Latest Warnings, Ne'er-Do-Well News, North America, The Coming Storm

Global Security News, North America, Press Release

Global Security News, North America

Global Security News, North America

Global Security News, North America

Global Security News, North America

Global Security News, North America

Global Security News, North America

Breaking News, Global Security News, hacking, hacking news, information security news, North America, Security

Global Security News, North America

Global Security News, North America

AI, Artificial Intelligence (AI), Global Security News, Government, North America, Technology

CISA, cyber attack, Global Security News, News, North America, Press Release

Global Security News, North America

Global Security News, North America

Global Security News, North America

Global Security News, North America

Global Security News, North America

Federal Bureau of Investigation (FBI), Global Security News, Government, North America, Policy, privacy

Global Security News, ISO 27001, North America, SOC 2

Global Security News, North America

Global Security News, North America

FinCEN, Global Security News, Guest blog, North America, Ransomware

critical infrastructure, Cybercrime, Global Security News, Government, North America, Threats

Global Security News, North America

Global Security News, North America

Global Security News, North America

Global Security News, North America

Cybersecurity, Department of Justice (DOJ), Federal Bureau of Investigation (FBI), Global Security News, Government, North America, Threats

Artificial Intelligence (AI), Congress, Global Security News, Government, North America, Policy

Global Security News, North America

Global Security News, North America, Resources

Global Security News, North America, Press Release, report

Global Security News, North America

Global Security News, North America

Global Security News, North America

Global Security News, North America

Global Security News, North America

Global Security News, North America

Global Security News, North America

Global Security News, Google, Mobile, North America, Security

Global Security News, North America

Cybersecurity, Geopolitics, Global Security News, Government, North America, Policy

APT, Breaking News, Global Security News, hacking, information security news, malware, North America

Global Security News, North America

Cyberattacks, Cybercrime, Security, Global Security News, North America

Global Security News, North America