Výsledky hledání

The End of Point-in-Time Compliance: Why Continuous Audit Readiness Matters to You in the AI Era 

Key Takeaways Periodic audits provide a point-in-time assessment, but they cannot demonstrate whether controls remain effective between audit cycles. Qualys platform data shows 10.5 billion configuration findings across customer environments but only 1.6% represent meaningful exposure and under 1% are prioritized, business-critical findings. Verizon’s 2026 DBIR found the median time to resolve weak passwords and misconfigured permissions is about 8 months. Across 1 billion misconfiguration…

US

tg: rozbor tg: návod tg: propagace tp: ransomware tp: AI tp: identita

18. 9. 00:52 · Qualys · The End of Point-in-Time Compliance: Why Continuous Audit Readiness Matters to You in the AI Era 

AI Threat Landscape Digest: July–August 2026

The defining development of the period came not from attackers but from the AI labs themselves, whose models broke out of controlled evaluations and reached real systems. In the wild, the criminal and state use of AI continued to mature along the lines tracked in earlier editions: models now act as attack operators, an underground market supplies the access, and AI systems have themselves become a target. The substantial distance between what the strongest models demonstrated under evaluation…

OpenAI Hugging Face Anthropic Meta IL

tg: rozbor tg: přehled tp: ransomware tp: AI

17. 9. 16:41 · Check Point Research · AI Threat Landscape Digest: July–August 2026

Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use

Compared with the same period last year, ransomware incidents in Japan increased slightly by approximately 4.7%, indicating that ransomware continues to pose a significant threat.In Japan, The Gentlemen was the most active ransomware group in the first half of 2026.Attackers continue to primarily target small- and medium-sized enterprises, with organizations capitalized at less than JPY 1 billion accounting for approximately 80% of the total — an increase of around 13% from the previous year…

EPSS 0.00 CVE-2025-2479 výroba a průmysl US

tg: rozbor tp: ransomware tp: AI

17. 9. 12:00 · Cisco Talos · Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use

How Attackers Abuse VSS, and How Huntress Detects It

Attackers exploit Volume Shadow Copy for credential theft and ransomware defense evasion. See how Huntress spots the difference from routine IT activity.

US

tg: rozbor tg: propagace tp: ransomware tp: identita

14. 9. 15:00 · Huntress · How Attackers Abuse VSS, and How Huntress Detects It

New Android malware encrypts files, steals data, and harasses victims

A new Android malware strain called Mantax Otax combines ransomware and spyware capabilities to encrypt files, steal sensitive data, and spam and harass victims. [...]

US

tg: rozbor tp: malware tp: ransomware tp: únik dat

10. 9. 23:40 · BleepingComputer · New Android malware encrypts files, steals data, and harasses victims

Grand Theft Auto VI hype leads to malware

Threat actors are exploiting GTA6 hype with fake leaked downloads spread via SEO poisoning, packed with RATs, infostealers, and wiper ransomware. Here’s what Huntress found.

US

tg: varování tg: rozbor tp: malware tp: ransomware

9. 9. 16:00 · Huntress · Grand Theft Auto VI hype leads to malware

Ransomware in 2026: What the Data Demands From You

Group-IB's 2026 data shows ransomware accelerating across APAC. See where response plans fail, and the 5-pillar framework built to hold under pressure.

SG

tg: rozbor tg: návod tg: propagace tp: ransomware

8. 9. 05:30 · Group-IB · Ransomware in 2026: What the Data Demands From You

Angry Birds: Toy Ghouls’ new toys

Introduction We continue tracking the activity of Toy Ghouls (also known as Bearlyfy, Laboo.boo, and Feral Wolf), a financially motivated group that has been targeting Russian organizations since 2025. The attackers initially relied exclusively on tools pulled from public GitHub repositories along with leaked Babuk and LockBit ransomware builders, later shifting to their own custom ransomware, GenieLocker. In early July 2026, we observed the group using a custom backdoor for the first time. We…

Microsoft RU

tg: varování tg: rozbor tp: malware tp: ransomware

4. 9. 12:00 · Securelist (Kaspersky) · Angry Birds: Toy Ghouls’ new toys

Ungentlemanly behavior: Insights into a ransomware operation

Analysis of 15 intrusions revealed tradecraft used by GOLD SHERWOOD affiliatesCategories: Threat ResearchTags: ransomware as a service, The Gentlemen, GOLD SHERWOOD, Ransomware

GB

tg: rozbor tp: malware tp: ransomware

1. 9. 02:00 · Sophos Threat Research · Ungentlemanly behavior: Insights into a ransomware operation

Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter

A joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs reveals that both state-sponsored actors and cybercriminals independently converge on the same edge infrastructure. Special thanks to SentinelOne® Incident Readiness & Response for their contributions to this publication.It is the shared attack surface where state-sponsored threat actors and financially motivated criminal groups independently converge — not the province of a single adversary category, and not exclusively a…

Fortinet Citrix Ivanti Palo Alto Networks US

tg: zneužíváno tg: rozbor tp: ransomware tp: špionáž

26. 8. 15:00 · Tenable Research · Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter

Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

Research by: Jaromír Hořejší (@JaromirHorejsi) Key points StopAndProtect is a newly identified operation that combines file encryption with data theft. The criminals abuse thousands of hacked WordPress websites as their infrastructure – using them to spread the malware, control infected machines, and store stolen documents, screenshots, and activity logs (records created by malware to track its actions, progress, or status during execution). Operational security (OPSEC) failures by the…

WordPress IL

tg: varování tg: rozbor tp: malware tp: phishing tp: ransomware tp: únik dat

18. 8. 15:05 · Check Point Research · Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

New Report: AI threats are here. Why Q2 2026 signals the end of traditional patch cycles

You can’t patch everything. So what do you fix first? Findings in Q2 2026 have changed traditional answers.The latest Quarterly Threat Landscape Report from Rapid7 Labs shows vulnerability disclosures still surging while attackers use automation and AI-assisted tooling to compress the time between disclosure and exploitation. The gap that patch cycles were built to fill is closing. Speed and volume are overwhelming security teams that have relied on traditional patch cycles and reactive…

CVSS 7.0 Microsoft veřejná správa finance zdravotnictví výroba a průmysl US

tg: rozbor tp: ransomware tp: AI tp: špionáž tp: průmyslové systémy

18. 8. 14:49 · Rapid7 · New Report: AI threats are here. Why Q2 2026 signals the end of traditional patch cycles

Detecting cloud ransomware in Azure with Tenable One’s cloud detection and response capabilities

Learn how Tenable One Cloud Exposure helps you unmask the sophisticated tactics of cybercrime group Storm-0501, which carries out Azure-based cloud ransomware campaigns. Tenable One Cloud Exposure uses AI-powered threat stories to expose Storm-0501 TTPs, backed by precision-engineered threat detection alerts.Key takeawaysStorm-0501 demonstrates that cloud-first ransomware groups have shifted from simple endpoint encryption to the total hijacking of cloud tenants.Storm-0501 systematically…

Microsoft US

tg: rozbor tg: propagace tp: ransomware tp: identita

17. 8. 17:15 · Tenable Research · Detecting cloud ransomware in Azure with Tenable One’s cloud detection and response capabilities

The State of Ransomware Q2 2026

For the past year, the ransomware conversation has centered on concentration: a handful of dominant RaaS operations controlling most of the damage, and a shrinking pool of active groups fighting over the same territory. The State of Ransomware Q2 2026 report from Check Point Research shows that picture starting to shift. The leaders are still winning, but the road to joining them has gotten a great deal shorter. Key observed findings The ecosystem stayed concentrated even as its tail widened…

IL

tg: rozbor tp: ransomware tp: AI

13. 8. 14:54 · Check Point Research · The State of Ransomware Q2 2026

DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

In this article Pre-encryptionEncryptionPost-encryptionDefending against DeadLock ransomwareIndicators of compromise Microsoft Threat Intelligence tracks DeadLock ransomware as an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications and data leak operations. Its recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used throughout the extortion…

doprava výroba a průmysl US

tg: rozbor tp: malware tp: ransomware

10. 8. 17:00 · Microsoft Security Blog · DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

128 Seconds to disruption: Microsoft Defender stops ransomware at QNET 

In this article What is device isolation?Case study: QNETAttack chain overviewMITRE ATT&CK techniques observedReferencesLearn more Microsoft Defender’s attack disruption now includes device isolation, a new response action that extends autonomous protection directly to compromised endpoints. At QNET, an attacker initiated a multi-stage attack using a legitimate Windows tool on a compromised endpoint to retrieve a malicious remote payload–a classic living-off-the-land (LOL) technique that often…

Microsoft obchod US

tg: incident tg: rozbor tg: propagace tp: malware tp: ransomware

4. 8. 19:54 · Microsoft Security Blog · 128 Seconds to disruption: Microsoft Defender stops ransomware at QNET 

You were onto something with “It’s the Climb,” Miley

Welcome to this week’s edition of the Threat Source newsletter. For my fianceé’s 30th birthday, I took her on a weekend trip to Shenandoah National Park – a favorite of ours since we went to a wedding there several years back. We’ve done several incredible hikes over the years, but one in particular had always loomed over my head: Old Rag, a 9.3 mile circuit hike that’s largely considered the most difficult in Virginia. I've always been warned that at the beginning and end, you hate Old Rag.…

zdravotnictví veřejná správa US

tg: rozbor tg: přehled tp: phishing tp: ransomware tp: identita

30. 7. 20:00 · Cisco Talos · You were onto something with “It’s the Climb,” Miley

The Signs Were There: What the First Autonomous Ransomware Case Confirms

An AI agent has run a ransomware intrusion on its own for the first time, from break-in to data destruction. The autonomous attacks TrendAI™ Research predicted are beginning to arrive, and defending against them shifts from blocking known indicators to detecting behavior.

JP

tg: rozbor tp: ransomware tp: AI

24. 7. 02:00 · Trend Micro · The Signs Were There: What the First Autonomous Ransomware Case Confirms

Ransomware in 2026: Same Business, New Rules

The ransomware economy has been rewired. Meet the eight ransomware groups driving the shift, from affiliate breakaways to AI-assisted attacks based on Group-IB Threat Intelligence.

SG

tg: rozbor tp: ransomware tp: AI

23. 7. 16:28 · Group-IB · Ransomware in 2026: Same Business, New Rules

Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel

Cisco Talos has discovered a new Rust-based remote access trojan (RAT) we call “msaRAT” attributed to the Chaos ransomware group. The name is derived from the binding names found in the binary: “msaOpen,” “msaClose,” “msaError,” and “msaMessage”.msaRAT is implemented using the Tokio asynchronous runtime, with primary capabilities of browser-leveraged remote code execution and covert tunneling to establish command-and-control (C2) communications.This RAT never touches the network directly — it…

US

tg: rozbor tp: malware tp: ransomware

23. 7. 12:00 · Cisco Talos · Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel

Proofpoint Research Finds 65% of Organizations Affected by Ransomware Say AI Made Attacks More Effective

US

tg: rozbor tp: ransomware tp: AI

22. 7. 08:06 · Proofpoint · Proofpoint Research Finds 65% of Organizations Affected by Ransomware Say AI Made Attacks More Effective

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

Key Takeaways This case was first reported to customers in a threat brief released in July 2025 and in a public flash alert in August 2025 in partnership with Swisscom B2B CSIRT, which observed another intrusion tied to the same campaign. This report contains data from both intrusions. We plan to release a DFIR Labs […] The post From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira appeared first on The DFIR Report.

US

tg: varování tg: rozbor tp: malware tp: ransomware

29. 6. 15:07 · The DFIR Report · From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

How the Huntress SOC Stopped a VPN-Based Ransomware Attack

Get an insider look at how the Huntress SOC stopped an unsecured VPN based ransomware attack. Learn why your business needs more than just software to stay secure.

US

tg: rozbor tg: propagace tp: ransomware

13. 3. 08:00 · Huntress · How the Huntress SOC Stopped a VPN-Based Ransomware Attack