KongTuke: A King Among Threat Groups 2026-03-18 at 16:02 By This blog is the latest in a series that delves into the deep research conducted daily by the LevelBlue SpiderLabs team on major threat actor groups currently operating globally. It is an overview of the findings. This article is an excerpt from LevelBlue SpiderLabs Blog […]
KongTuke: A King Among Threat Groups Read More »
How LevelBlue OTX and Cybereason XDR Detected a North Korea-Linked Remote IT Worker 2026-03-17 at 16:02 By Tue Luu Talk about dodging the insider threat from hell. From August 15 to 25, 2025, the SpiderLabs threat intel team, through the integration of LevelBlue OTX threat intelligence with Cybereason XDR behavioral analytics, detected a North Korea […]
How LevelBlue OTX and Cybereason XDR Detected a North Korea-Linked Remote IT Worker Read More »
Beware the ClickFix Trap: REMCOS RAT Hiding in “Helpful” PUAs 2026-03-13 at 19:32 By Hema Loganathan Cybereason GSOC has observed a notable increase in infections involving REMCOS RAT, often delivered through vulnerable or potentially unwanted applications (PUAs). This article is an excerpt from LevelBlue SpiderLabs Blog View Original Source
Beware the ClickFix Trap: REMCOS RAT Hiding in “Helpful” PUAs Read More »
Weaponizing Safe Links: Abuse of Multi-Layered URL Rewriting in Phishing Attacks 2026-03-13 at 19:32 By John Kevin Adriano In 2024, threat actors were already abusing URL rewriting mechanisms in phishing campaigns to mask malicious domains. Between the second and fourth quarters of 2025, LevelBlue SpiderLabs identified a notable escalation in this tactic, with adversaries deliberately […]
Weaponizing Safe Links: Abuse of Multi-Layered URL Rewriting in Phishing Attacks Read More »
Epic Fury Update: Stryker Attack Highlights Handala’s Shift from Espionage to Disruption 2026-03-13 at 19:32 By Arthur Erzberger On March 11, 2026, the medical technology vendor Stryker disclosed a global cyberattack affecting its Microsoft environment. The company said there was no indication of ransomware or malware, but the full scope and restoration timeline were unknown. […]
Epic Fury Update: Stryker Attack Highlights Handala’s Shift from Espionage to Disruption Read More »
LevelBlue SpiderLabs Breaks Down the Role of Cyber Operations Taken in the Iran Crisis 2026-03-13 at 19:32 By Gal Romano As combat operations that began on February 28 with joint US-Israeli strikes on Iran’s military and leadership continue, cybersecurity analysts are turning their attention to how this 21st-century conflict is unfolding in the digital domain. […]
LevelBlue SpiderLabs Breaks Down the Role of Cyber Operations Taken in the Iran Crisis Read More »
The 6 Steps Organizations Should Immediately Take to Mitigate Quantum-Related Risk 2026-03-10 at 16:00 By Lynn Burns The reality of quantum computing is not quite here, but nobody should fool themselves into believing they should not prepare ahead of time. This article is an excerpt from LevelBlue Blog View Original Source
The 6 Steps Organizations Should Immediately Take to Mitigate Quantum-Related Risk Read More »
Operation Epic Fury Decoded: Iran’s Cyber Escalation Playbook Webinar Replay 2026-03-09 at 17:02 By LevelBlue SpiderLabs has been tracking the very active and destructive cyber activities taking place during theongoing US-Israel-Iran war since it kicked off on March 2. This article is an excerpt from LevelBlue Blog View Original Source
Operation Epic Fury Decoded: Iran’s Cyber Escalation Playbook Webinar Replay Read More »
LevelBlue SpiderLabs: APAC Emerges as Primary Target for Manufacturing Cyberattacks 2026-02-28 at 10:37 By The manufacturing sector faces a 793% surge in cyberattacks, with APAC manufacturers being the primary targets worldwide. Sophisticated threat actors—including Lazarus Group, APT41, and Russian ransomware affiliates—are driving a wave of ransomware and cyber espionage campaigns against manufacturers. Ransomware and cyber […]
LevelBlue SpiderLabs: APAC Emerges as Primary Target for Manufacturing Cyberattacks Read More »
Par for the Course: Why Golf Facilities Are Prime Targets for Cyberattacks 2026-01-29 at 17:29 By Golf can be an incredibly frustrating game to play. This article is an excerpt from LevelBlue Blog View Original Source
Par for the Course: Why Golf Facilities Are Prime Targets for Cyberattacks Read More »
When AI Becomes the Insider Threat 2026-01-08 at 17:29 By James Prince Remember that annoying ‘paperclip’ in Microsoft Word 97? The one that was always trying to help you…Fast forward nearly 30 years and we now have AI. This article is an excerpt from LevelBlue Blog View Original Source
When AI Becomes the Insider Threat Read More »
AI-Enabled Cyber Intrusions: What Two Recent Incidents Reveal for Corporate Counsel 2026-01-06 at 17:02 By Daniel Ilan, Rahul Mukhi, Prudence Buckland, Melissa Faragasso This article was authored by Daniel Ilan, Rahul Mukhi, Prudence Buckland, and Melissa Faragasso from Cleary Gottlieb, and Brian Lichter and Elijah Seymour from Stroz Friedberg, a LevelBlue company. This article is […]
AI-Enabled Cyber Intrusions: What Two Recent Incidents Reveal for Corporate Counsel Read More »
LevelBlue Predictions 2026: The Never Ending Story Evolving Threats and Adversary Tactics 2025-12-23 at 17:02 By As 2025 closes and we look toward 2026, the cybersecurity industry is bracing for radical changes that go beyond just intensifying existing problems. This article is an excerpt from LevelBlue Blog View Original Source
A Rising Tide of Threats: The Offshore Energy Industry’s Threat Landscape 2025-12-15 at 13:48 By Key Findings: This article is an excerpt from LevelBlue SpiderLabs Blog View Original Source
A Rising Tide of Threats: The Offshore Energy Industry’s Threat Landscape Read More »
Extortion-as-a-Service: The Latest Threat Actor Criminal Ecosystem 2025-12-11 at 16:26 By Serhii Melnyk For centuries, threat actors, both cyber and physical, have understood the benefits of using extortion to further their criminal activities. This has led some cyber threat groups to create Extortion-as-a-Service (EaaS) businesses. These are a formalized way for cybercriminals to offer extortion […]
Extortion-as-a-Service: The Latest Threat Actor Criminal Ecosystem Read More »
Sha1-Hulud: The Second Coming of The New npm GitHub Worm 2025-12-03 at 16:04 By Karl Sigler Sha1-Hulud is back with a new evolution of its supply-chain attack that targets development environments via Node Package Manager (npm). npm is a very popular package manager for Node.js that provides millions of predeveloped packages of code to be […]
Sha1-Hulud: The Second Coming of The New npm GitHub Worm Read More »
Defining and Defending Against a Zero Day Attack 2025-12-02 at 16:35 By Unexpected attacks are the hardest to fend off. This article is an excerpt from Trustwave Blog View Original Source
Defining and Defending Against a Zero Day Attack Read More »
Handala’s Latest Publication Targets Israeli High-Tech Specialists 2025-11-26 at 20:39 By Arthur Erzberger The Handala hacker group has recently published a list of Israeli high-tech and aerospace professionals, accompanied by aggressive, misleading descriptions labeling them as criminals. Most of the data appears to have been scraped from LinkedIn, with no evidence of wrongdoing by the […]
Handala’s Latest Publication Targets Israeli High-Tech Specialists Read More »
SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp 2025-11-19 at 19:03 By Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi Trustwave SpiderLabs researchers have recently identified a banking Trojan we dubbed Eternidade Stealer, which is distributed through WhatsApp hijacking and social engineering lures. In this blog post, we will break down the techniques used in the […]
SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp Read More »
Microsoft Issues Emergency Patch for Windows Server Update Services RCE Vulnerability CVE-2025-59287 2025-11-14 at 15:10 By Fernando Martinez LevelBlue Labs is tracking a severe vulnerability in Windows Server Update Services (WSUS), CVE-2025-59287, that allows attackers to remotely execute code without authentication and is being exploited by threat actors to compromise vulnerable Windows Server users. This […]