Ethan Andrews

Threat actors are utilizing VHDX disk images to deliver Remcos RAT through a multi-stage process involving WMI execution and reflective .NET loading to bypass security controls.

A critical vulnerability chain named SearchLeak allows attackers to exfiltrate sensitive Microsoft 365 data via a single-click URL exploit targeting Copilot Enterprise Search.

A chain of three vulnerabilities in the LiteLLM AI gateway allows low-privilege users to bypass authorization, escalate to administrative privileges, and execute arbitrary code on the host server.

North Korea-aligned actors are targeting developers via phishing and malicious GitHub repositories using VS Code's 'runOn' features to deliver cross-platform malware.

Vulnerabilities in the Google Cloud Vertex AI SDK for Python allow attackers to achieve cross-tenant RCE by hijacking model uploads via bucket squatting and malicious pickle deserialization.

The Gentlemen ransomware, operated by the Phantom Mantis group (LARVA-368), has evolved from a RaaS affiliate into an independent operation featuring AI-assisted development and a self-propagating worm module.

The GreatXML zero-day exploit leverages Windows Defender Offline Scan and weak WinRE integrity checks to bypass BitLocker encryption via crafted unattend.xml files.

Suspected Lazarus Group (DPRK) operators are using malicious VS Code extensions like jupyter-powerdev to deliver a multi-stage backdoor utilizing SharePoint for C2 and Roslyn for in-memory execution.

Threat actor link99 systematically exploits abandoned Azure and DigitalOcean DNS zone delegations to host Thai gambling platforms under the authority of over 160 enterprise and government domains.

Attackers are abusing Google Forms' editor invite feature to bypass email security and harvest sensitive information using name-matching social engineering pretexts.