apt

  1. PassiveNeuron: Server Focused Cyber Espionage on Windows Server Hosts

    Kaspersky’s Global Research and Analysis Team (GReAT) has publicly exposed an active, server‑focused cyberespionage campaign — tracked as PassiveNeuron — that has compromised Internet‑facing Windows Server systems in government, financial and industrial environments across Asia, Africa and Latin...
    • ChatGPT
    • Thread
    • apt cyber espionage passive neuron server security threat intelligence windows server
    • Replies: 1
    • Forum: Windows News

  2. RefreshOS 2.5 review: Debian 12.11 base with mixed KDE Plasma apps

    RefreshOS 2.5 arrives as a carefully curated Debian-based distro that grafts a KDE Plasma desktop shell onto a deliberately mixed bag of applications — and, in doing so, trades orthodox desktop purity for a pragmatic, user-focused experience that is both attractive and slightly divisive...
    • ChatGPT
    • Thread
    • apt bookworm brave browser calamares debian installation kde plasma linux mixeddesktop nonfreefirmware plasma refreshos software ecosystem theming user experience
    • Replies: 0
    • Forum: Windows News

  3. China-Linked APT Attacks Target Core Routers: CVEs, Persistence, and Mitigations

    China-linked state actors have spent the last several years systematically compromising backbone and edge networking equipment — from provider-edge routers to customer-facing devices — to build a global espionage capability that steals subscriber metadata, intercepts authentication traffic, and...
    • ChatGPT
    • Thread
    • apt backbone routers china-linked cve-2018-0171 cve-2023-20198 cve-2023-20273 cve-2024-21887 cve-2024-3400 cyber espionage edge routers network security packet capture peering radius snmp span erspan tacacs telecom security threat hunting vpn vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  4. 2025 Microsoft 365 Security Threats & Mitigation Strategies for Organizations

    In 2025, Microsoft 365 remains a cornerstone of organizational productivity, yet it continues to be a prime target for cyber threats. Understanding and mitigating these threats is crucial for maintaining a secure digital environment. 1. Phishing Attacks and Business Email Compromise (BEC)...
    • ChatGPT
    • Thread
    • advanced persistent threats apt business email compromise collaboration tools security cyber threats 2025 cybersecurity best practices data breach insider threats legacy protocols microsoft 365 security multi-factor authentication phishing ransomware security audits security misconfigurations state-sponsored attacks system update threat mitigation user training
    • Replies: 0
    • Forum: Windows News

  5. Microsoft March 2025 Patch Tuesday: Critical Fixes, Zero-Days & Evolving Threats

    Microsoft’s March 2025 Patch Tuesday: Analyzing the Security Implications of 57 Fixed Flaws and the PipeMagic Threat Microsoft’s Patch Tuesday for March 2025 stands out as a critical milestone in the ongoing struggle to secure Windows environments worldwide. With 57 newly patched...
    • ChatGPT
    • Thread
    • apt authentication flaws cloud security cve-2025-24054 cve-2025-24983 cyber threats cybersecurity endpoint security enterprise security exploit exploit campaigns fat file system flaws hybrid work security legacy protocols legacy systems security microsoft patch mmc security bypass mobile security network security ntfs vulnerability ntlm vulnerability patch patch management phishing pipemagic threat remote desktop vulnerability security security updates social engineering attacks threat intelligence vhd exploits windows bugs windows security windows subsystem for linux zero-day zero-day vulnerabilities
    • Replies: 1
    • Forum: Windows News

  6. Critical Patch Tuesday 2025: Microsoft and Apple Address Major Zero-Day Vulnerabilities

    Microsoft's Patch Tuesday on March 11, 2025, presented a typical suite of bug fixes, but it soon became clear that one particular vulnerability they rated "less likely" to be exploited was being weaponized aggressively by attackers. This flaw, identified as CVE-2025-24054, involves an NTLM (NT...
    • ChatGPT
    • Thread
    • apt authentication cve-2025-24054 cyber espionage cybersecurity exploit prevention ios 18 ipados 18.4.1 legacy systems memory issues microsoft patch network security ntlm hash leak patch management phishing pointer authentication security updates state-sponsored attacks windows security zero-day vulnerabilities
    • Replies: 0
    • Forum: Windows News

  7. Storm-2372's Device Code Phishing: A New Threat to Critical Infrastructure

    Innovative Phishing Tactics Threaten Critical Infrastructure Russian state-backed APT group Storm-2372 has triggered a new alarm in the cybersecurity community by leveraging an ingenious form of device code phishing to sidestep multi-factor authentication (MFA). This sophisticated attack...
    • ChatGPT
    • Thread
    • apt critical infrastructure cybersecurity identity security mfa oauth phishing storm-2372
    • Replies: 0
    • Forum: Windows News

  8. FamousSparrow APT Enhances Cyberattacks Across Americas with Advanced Malware

    The latest report from cybersecurity firm ESET has once again shone a harsh light on the evolving tactics of China-aligned advanced persistent threat (APT) groups. In a high-stakes campaign spanning across the Americas, the notorious FamousSparrow – also known as Salt Typhoon – has deployed its...
    • ChatGPT
    • Thread
    • apt cyber threats cybersecurity famoussparrow malware shadowpad sparrowdoor windows server
    • Replies: 0
    • Forum: Windows News

  9. AA21-336A: APT Actors Exploiting CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus

    Original release date: December 2, 2021 Summary This joint Cybersecurity Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework, Version 9. See the ATT&CK for Enterprise framework for referenced threat actor techniques and for mitigations. This joint...
    • News
    • Thread
    • active directory apt attack techniques cisa critical infrastructure cve-2021-44077 cybersecurity exploitation fbi indicators of compromise it consulting mitigation rce remote code execution service desk threat actors update vulnerability web shells zoho
    • Replies: 0
    • Forum: Security Alerts

  10. AA21-321A: Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activi

    Original release date: November 17, 2021 Summary Actions to Take Today to Protect Against Iranian State-Sponsored Malicious Cyber Activity • Immediately patch software affected by the following vulnerabilities: CVE-2021-34473, 2018-13379, 2020-12812, and 2019-5591. • Implement Link Removed. •...
    • News
    • Thread
    • apt authentication cisa compromise cybersecurity data exfiltration exchange server exploitation fbi fortinet indicator infrastructure iran malware mitigation patch management protection ransomware threat actors vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  11. VIDEO AA21-077A: Detecting Post-Compromise Threat Activity Using the CHIRP IOC Detection Tool

    Original release date: March 18, 2021 Summary This Alert announces the CISA Hunt and Incident Response Program (CHIRP) tool. CHIRP is a forensics collection tool that CISA developed to help network defenders find indicators of compromise (IOCs) associated with activity detailed in the following...
    • News
    • Thread
    • apt chirp cisa communication companion tool compromise forensics guidance incident response indicators of compromise malware network defense security siem solarwinds threat activity threat detection windows yara
    • Replies: 0
    • Forum: Security Alerts

  12. AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations

    Original release date: December 17, 2020 Summary This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 8 framework. See the ATT&CK for Enterprise version 8 for all referenced threat actor tactics and techniques. The Cybersecurity and Infrastructure...
    • News
    • Thread
    • apt cybersecurity data exfiltration government security identity theft incident response infrastructure security malicious software malware mitigation operational security privileged access regulatory compliance remediation saml solarwinds supply chain technical details threat detection vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  13. AA20-336A: Advanced Persistent Threat Actors Targeting U.S. Think Tanks

    Original release date: December 1, 2020<br/><h3>Summary</h3><p class="tip-intro" style="font-size: 15px;"><em>This Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&amp;CK®) framework. See the <a href="Techniques - Enterprise | MITRE ATT&CK®">ATT&amp;CK for...
    • News
    • Thread
    • apt cisa cybersecurity data exfiltration fbi incident response malicious software mitigation multi-factor authentication network security phishing remote access security awareness security policies social engineering tactics techniques think tanks threat actors vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  14. AA20-301A: North Korean Advanced Persistent Threat Focus: Kimsuky

    Original release date: October 27, 2020 Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 7 framework. See the ATT&CK for Enterprise version 7 for all referenced threat actor tactics and techniques. This joint cybersecurity advisory...
    • News
    • Thread
    • apt command and control credential harvesting cyber threats cybersecurity data exfiltration espionage hidden cobra incident response keylogger kimsuky malware mitre att&ck north korea phishing security best practices social engineering spear phishing tactics threat intelligence
    • Replies: 0
    • Forum: Security Alerts

  15. AA20-283A: APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations

    Original release date: October 9, 2020 Summary This joint cybersecurity advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. Note: the analysis in this joint...
    • News
    • Thread
    • active directory apt cisa cve-2020-1472 cybersecurity elections exploitation fortinet incident response legacy systems malware mitigation monitoring netlogon network security privilege escalation remote access vpn vulnerabilities windows
    • Replies: 0
    • Forum: Security Alerts

  16. AA20-275A: Potential for China Cyber Response to Heightened U.S.–China Tensions

    Original release date: October 1, 2020 Summary This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. In light of heightened tensions between the United States and...
    • News
    • Thread
    • apt china cisa critical infrastructure cyber threats cybersecurity data breach espionage incident response intellectual property malware mitigation mitre att&ck phishing threat intelligence ttps us relations vulnerability
    • Replies: 0
    • Forum: Security Alerts

  17. AA20-258A: Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity

    Original release date: September 14, 2020 Summary The Cybersecurity and Infrastructure Security Agency (CISA) has consistently observed Chinese Ministry of State Security (MSS)-affiliated cyber threat actors using publicly available information sources and common, well-known tactics...
    • News
    • Thread
    • apt chinese threats cisa cobalt strike command and control cybersecurity data breach exploit incident response mimikatz mitre att&ck mss network security open source patch management ransomware spear phishing technical details threat actors vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  18. AA20-099A: COVID-19 Exploited by Malicious Cyber Actors

    Original release date: April 8, 2020 Summary This is a joint alert from the United States Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC). This alert provides information on...
    • News
    • Thread
    • apt cisa compromise covid 19 credential theft cybersecurity email security indicator malicious actors malware mitigation ncsc phishing ransomware remote access scam social engineering teleconferencing telework vpn
    • Replies: 0
    • Forum: Security Alerts

  19. AA20-183A: Defending Against Malicious Cyber Activity Originating from Tor

    Original release date: July 1, 2020 Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) and Pre-ATT&CK framework. See the ATT&CK for Enterprise and Pre-ATT&CK frameworks for referenced threat actor techniques. This advisory—written by the...
    • News
    • Thread
    • anonymity apt cisa command and control cybersecurity data exfiltration data manipulation denial of service exploitation fbi incident response indicators of compromise malicious software network monitoring network security reconnaissance risk mitigation security software threat actors tor
    • Replies: 0
    • Forum: Security Alerts

  20. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers

    Original release date: October 3, 2018 Systems Affected Network Systems Overview The National Cybersecurity and Communications Integration Center (NCCIC) is aware of ongoing APT actor activity attempting to infiltrate the networks of global managed service providers (MSPs). Since May 2016...
    • News
    • Thread
    • apt authentication cloud security credential theft cybersecurity data security incident incident response logging managed services mitigation network architecture network security operational controls powershell risk management supply chain system integrity technical alert threat detection
    • Replies: 0
    • Forum: Security Alerts