The CyberSignal (Page 4)

Latest

Editorial illustration of a coiled serpent slipping into a government building's document tray, marking Kaspersky's GoSerpent espionage malware in Southeast Asia.

Nation-State Cyber Threats

Kaspersky Documents "GoSerpent" Malware Targeting Southeast Asian Governments and Diplomats

Another Southeast-Asia-focused espionage cluster documented by Kaspersky — a defender research review this week for government and diplomatic entities in the region.

Editorial illustration of a phone lock screen with a gesture sending an SMS past the PIN, marking Google's patch for the Android Gemini lock-screen bug.

Vulnerabilities

Google Publishes Patch for Android Lock Screen Bug That Reportedly Let Gemini Send SMS Without a PIN

A mobile lock-screen bypass involving Gemini — defender verification across managed Android fleets this week.

Editorial illustration of a FaceTime call bubble wearing a bank mask, marking Apple's warning on FaceTime-based social engineering targeting iPhone and iPad users.

Mobile Security

Apple Publishes Warning on FaceTime-Based Social Engineering Targeting iPhone and iPad Users

An Apple advisory on FaceTime-based social engineering — defender-team end-user awareness this week.

Editorial illustration of an airport departure gate holding a passport with a mismatched photo, marking Armenia's detention of Aleksandr Ermakov on a US REvil request.

Ransomware

Armenia Detains Russian National Aleksandr Ermakov on US REvil Extradition Request; Family Disputes Identity

A cross-border REvil extradition drama - an identity dispute and the Armenian judicial process take center stage this week, with a Russian tourist detained on a US warrant his lawyers say names a different man.

Editorial illustration of a fake fix-it prompt piping browser tokens and documents into a stealer, marking Microsoft's ACR Stealer ClickFix analysis.

Threat Intelligence

Microsoft Defender Experts Documents ACR Stealer Delivered via ClickFix Lures Targeting Browsers and Microsoft 365

Another named stealer joins the ClickFix pattern — a defender posture review across Microsoft 365 environments after Microsoft's published analysis this week.

Editorial illustration of a state-emblem shield adopting a fake fix-it prompt, marking Ars Technica's report of Russia's Sandworm cluster using ClickFix.

Nation-State Cyber Threats

Ars Technica Reports Russia's Sandworm Cluster Now Using ClickFix Technique

ClickFix migrates from financially motivated crime to nation-state activity, according to Ars Technica's report on Russia's Sandworm cluster - a defender-awareness read for this week.

Ransomware

Symantec Documents "Spirals" Ransomware Reportedly Locking Systems in Under 24 Hours

A fast-moving Rust-based ransomware family — defender detection-engineering review this week.

Editorial illustration of a case folder fanning into many attack markers, marking US authorities attributing 120-plus attacks to Scattered Spider's Thalha Jubair.

Policy & Government

CyberScoop Reports US Authorities Attribute 120+ Attacks to Scattered Spider Defendant Thalha Jubair

More detail on Scattered Spider's TfL leaders: US authorities have Jubair on the record for 120 attacks, and defender pattern-tracking continues this week.

Editorial illustration of a shared-document portal beside a two-day calendar countdown, marking CISA's KEV listing of SharePoint zero-day CVE-2026-58644.

Vulnerabilities

CISA Adds SharePoint RCE Zero-Day CVE-2026-58644 to KEV Catalog With July 19 Patch Deadline

A CVSS 9.8 SharePoint zero-day joins CISA's KEV catalog with a two-day patch deadline — defender teams accelerate verification this week.

Ransomware

ReliaQuest: “The Gentlemen” Overtakes Qilin as Most Prolific Ransomware Operation

The ransomware leaderboard shifts — The Gentlemen tops the chart in ReliaQuest’s latest tracking, and defender-team pattern-watching continues this week from the analyst’s chair, not the attacker’s.

Editorial illustration of a sandbox tray cracked open beside a two-day calendar, marking CISA's urgent-patch order for exploited Fortinet FortiSandbox flaws.

Vulnerabilities

CISA Mandates Urgent Patching for Actively Exploited Fortinet FortiSandbox Vulnerabilities (July 19 Deadline)

Two FortiSandbox flaws under active attack — CISA's July 19 deadline puts defender teams on the clock this week.

Editorial illustration of an SVG flag image concealing a hidden payload behind a coding-test window — North Korea Contagious Interview OtterCookie campaign.

Nation-State Cyber Threats

Researchers Document North Korea-Linked "Contagious Interview" Campaign Using SVG Steganography to Deliver OtterCookie-Aligned Malware

Another Contagious Interview variant with a novel SVG delivery angle — a defender-oriented research review of how North Korea-linked actors hid an OtterCookie-aligned payload inside flag images sent through fake coding challenges.

See all