-
ESET Threat Report H1 2025
A view of the H1 2025 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts A view of the H1 2025 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts Go to Source
-
Microsoft SharePoint Zero-Day EXPLAINED — How Hackers Got In Without a Password
Two previously unknown zero-day vulnerabilities in Microsoft SharePoint Server (on-premises) are being actively exploited in the wild as part of a highly coordinated espionage campaign. Microsoft has linked these attacks to China-based APT actors, and at least 75 organizations worldwide have confirmed breaches. The flaws, identified as CVE-2025-53770 and CVE-2025-53771, enable unauthenticated remote code execution…
-
BladedFeline: Whispering in the dark
ESET researchers analyzed a cyberespionage campaign conducted by BladedFeline, an Iran-aligned APT group with likely ties to OilRig ESET researchers analyzed a cyberespionage campaign conducted by BladedFeline, an Iran-aligned APT group with likely ties to OilRig Go to Source
-
How to Easily Escalate to Root on Linux Using the Latest Sudo Vulnerabilities
A newly disclosed pair of critical vulnerabilities in Sudo — the powerful Unix/Linux command-line tool that allows users to run commands as root — poses a significant local privilege escalation threat. These flaws impact major Linux distributions and allow unprivileged local users to gain root access, thereby compromising system integrity. Summary of the Vulnerabilities The…
-
Koske Malware Detection: New AI-Generated Linux Threat in the Wild
Attackers are increasingly leveraging AI to compromise critical business assets, signaling a dangerous evolution in the threat landscape. Check Point Research’s AI Security Report 2025 highlights how threat actors are using AI for deepfake impersonation, automated malware creation, jailbroken LLMs, and generative disinformation campaigns. Following the campaigns involving AI lures to disseminate CyberLock, Lucky_Gh0$t, and…
-
Fake Receipt Detector Technology: Protecting Financial Integrity in the Digital Age
The rise of sophisticated digital tools and artificial intelligence has revolutionized many aspects of business and finance, but it has also created new opportunities for fraudulent activities. Among the most concerning developments is the increasing prevalence of fake receipts and fraudulent expense documentation. As businesses, insurance companies, and financial institutions grapple with these challenges, the…
-
Epsilon Red Ransomware Detection: New Adversary Campaign Targeting Users Globally via ClickFix
Following closely after the Interlock ransomware attacks that used a new custom RAT delivered through a modified ClickFix variant called FileFix, a new malicious campaign has emerged, also leveraging a ClickFix-themed malware delivery website. Defenders have uncovered a novel global Epsilon Red ransomware operation that began in July 2025, in which attackers use fake ClickFix…
-
Interlock Ransomware Detection: The FBI, CISA, and Partners Issue Joint Alert on Massive Attacks via the ClickFix Social Engineering Technique
In mid-July 2025, researchers spread the news of the reemergence of the Interlock ransomware group, leveraging a modified version of the ClickFix malware to deliver a novel PHP-based iteration of their custom RAT. In response to the growing threat, the authoring agencies, including the FBI and CISA, have recently issued a joint cybersecurity alert notifying…
-
BreachForums Is DEAD — Cybercrime’s Biggest Empire Just Got Crushed!
A coordinated law enforcement operation in France has resulted in the arrest of key figures behind BreachForums, one of the most active and influential marketplaces for cybercriminals in recent years. The takedown marks a significant disruption in the cybercriminal economy, highlighting both the global reach of modern threat actors and the increasing sophistication of cross-border…
-
CVE-2025-53770 Detection: Microsoft SharePoint Zero-Day Vulnerability Is Actively Exploited for RCE Attacks
This summer saw a surge of critical vulnerabilities impacting Microsoft products. A new RCE vulnerability in Windows, tracked as CVE-2025-33053, had been actively weaponized by the Stealth Falcon APT group. At the same time, another severe flaw, dubbed EchoLeak (CVE-2025-32711), was uncovered in Microsoft Copilot, enabling silent data exfiltration via email with no user interaction…