Security Research

Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems

Emerging Threats, News, Security Research /

Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems 2026-08-04 at 16:20 By Nikita Kazymirskyi In light of the water-sector activity described below, we’ve increased monitoring for related indicators of compromise across our client environments. Please contact your LevelBlue account team with questions specific to your environment. This article is an excerpt […]

Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems Read More »

Novel Java-Based QuimaRAT Targets Windows, macOS, and Linux

Reports, Security Research, Threat Intelligence /

Novel Java-Based QuimaRAT Targets Windows, macOS, and Linux 2026-06-25 at 17:00 By Remote access trojans (RATs) are legacy threats that continue to evolve alongside an expanding and ever-changing threat landscape. Following our recently published articles about novel and notable RATs, including KarstoRAT, the latest version of ClickFix, and ClickFix’s macOS variant, we analyzed QuimaRAT, a

Novel Java-Based QuimaRAT Targets Windows, macOS, and Linux Read More »

LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign

Security Research, Threat Intelligence, Vulnerabilities /

LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign 2026-06-24 at 16:43 By Dawid Nesterowicz In Norse mythology, Loki, the god of mischief, has powerful and deceptive transformation abilities. True to its namesake, the malware LokiBot has appeared in numerous variants and payload formats since its discovery more than a decade ago. In

LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign Read More »

SpiderLabs Ransomware Tracker Update January 2025: Qilin Continues as Dominant Threat Group

data breach, Security Research, Threat Intelligence /

SpiderLabs Ransomware Tracker Update January 2025: Qilin Continues as Dominant Threat Group 2026-02-03 at 17:02 By The January 2026 edition of LevelBlue SpiderLabs ransomware tracker noted a sharp fall in the number of attacks launched compared to December 2025. Qilin remained the top attacker, but there was a reshuffling of the remaining top five attackers

SpiderLabs Ransomware Tracker Update January 2025: Qilin Continues as Dominant Threat Group Read More »

LevelBlue SpiderLabs: Ransomware Attacks Up 17% in 2025

Security Research, Vulnerabilities /

LevelBlue SpiderLabs: Ransomware Attacks Up 17% in 2025 2025-12-30 at 17:07 By Global Ransomware Surges in 2025: Total ransomware attacks rose by 17.2% year-over-year, with LevelBlue SpiderLabs tracking approximately 7,400 incidents compared to 6,017 in 2024. Qilin and Akira Lead the Threat Landscape: Following the disappearance of Ransomhub and the disruption of Lockbit3, Qilin emerged

LevelBlue SpiderLabs: Ransomware Attacks Up 17% in 2025 Read More »

A Year in Review: Taking a Look Back at LevelBlue SpiderLabs’ 2025 Predictions

Artificial Intelligence, Perspectives, Security Research /

A Year in Review: Taking a Look Back at LevelBlue SpiderLabs’ 2025 Predictions 2025-12-19 at 17:05 By At this time last year, LevelBlue asked its experts to offer up some thoughts on what the coming year, 2025, would bring. This article is an excerpt from LevelBlue Blog View Original Source

A Year in Review: Taking a Look Back at LevelBlue SpiderLabs’ 2025 Predictions Read More »

Threat Intelligence News from LevelBlue SpiderLabs December 2025

News, Security Research, Vulnerabilities /

Threat Intelligence News from LevelBlue SpiderLabs December 2025 2025-12-15 at 13:48 By LevelBlue SpiderLabs is the threat intelligence unit of LevelBlue and includes a global team of threat researchers and data scientists who, combined with proprietary technology in data analytics and machine learning (ML), analyze one of the largest and most diverse collections of threat

Threat Intelligence News from LevelBlue SpiderLabs December 2025 Read More »

SpiderLabs Ransomware Tracker Update November 2025: Qlin, Cl0p, and Akira Vie for Top Attacker

data breach, Security Research, Vulnerabilities /

SpiderLabs Ransomware Tracker Update November 2025: Qlin, Cl0p, and Akira Vie for Top Attacker 2025-12-03 at 16:04 By Trustwave SpiderLabs ransomware tracker noted a slight dip in the overall number of attacks that took place in November 2025, but the research team saw the threat group Cl0p surge, conducting 98 attacks during the month, up

SpiderLabs Ransomware Tracker Update November 2025: Qlin, Cl0p, and Akira Vie for Top Attacker Read More »

The Cat’s Out of the Bag: A ‘Meow Attack’ Data Corruption Campaign Simulation via MAD-CAT

data breach, Emerging Threats, Security Research, Vulnerabilities /

The Cat’s Out of the Bag: A ‘Meow Attack’ Data Corruption Campaign Simulation via MAD-CAT 2025-11-07 at 19:39 By Karl Biron In 2024, I published Feline Hackers Among Us? (A Deep Dive and Simulation of the Meow Attack), which explored the notorious Meow attack campaign that had plagued unsecured databases since 2020. That article focused

The Cat’s Out of the Bag: A ‘Meow Attack’ Data Corruption Campaign Simulation via MAD-CAT Read More »

Dissecting and Understanding APT Threat Group Activity

data breach, Emerging Threats, Security Research, Threat Intelligence /

Dissecting and Understanding APT Threat Group Activity 2025-11-06 at 16:45 By Trustwave SpiderLabs CTI APT Groups Prioritize Espionage and Data Theft: Approximately two-thirds of all Trustwave SpiderLabs-tracked APT group activity is motivated by espionage, targeting government, defense, and telecom sectors primarily in the US, Ukraine, and Russia. Top Attacker Nations: China (41%), Iran (12.5%), and

Dissecting and Understanding APT Threat Group Activity Read More »

SpiderLabs Ransomware Tracker Update October 2025: Qlin Doubles Down on Attacks

data breach, DFIR, Emerging Threats, Security Research, Vulnerabilities /

SpiderLabs Ransomware Tracker Update October 2025: Qlin Doubles Down on Attacks 2025-11-04 at 17:18 By The worldwide ransomware landscape saw a dramatic shift in attacks in October 2025, jumping 41% month over month, with the most prolific attacker, Qlin, more than doubling the number of attacks it launched, according to Trustwave, A LevelBlue Company, research.

SpiderLabs Ransomware Tracker Update October 2025: Qlin Doubles Down on Attacks Read More »

Scattered LAPSUS$ Hunters: Anatomy of a Federated Cybercriminal Brand

Artificial Intelligence, data breach, Security Research, Vulnerabilities /

Scattered LAPSUS$ Hunters: Anatomy of a Federated Cybercriminal Brand 2025-11-04 at 16:27 By Trustwave SpiderLabs’ Cyber Threat Intelligence team is tracking the recent emergence of what appears to be the consolidation of three well-known threat groups into a “federated alliance” that offers, among its activities, Extortion-as-a-Service (EaaS). This article is an excerpt from SpiderLabs Blog

Scattered LAPSUS$ Hunters: Anatomy of a Federated Cybercriminal Brand Read More »

The Rise of Phantom Cyber Firms: How to Spot Them and What to Verify Before you Engage

Emerging Threats, Security Research /

The Rise of Phantom Cyber Firms: How to Spot Them and What to Verify Before you Engage 2025-10-23 at 17:11 By Grant Hutchons It’s bad enough that organizations must worry about threat actors launching phishing attacks, injecting ransomware, or exploiting vulnerabilities; now, there is a new attack variant on the loose. Legal scammers. This article

The Rise of Phantom Cyber Firms: How to Spot Them and What to Verify Before you Engage Read More »

SocGholish: Turning Application Updates into Vexing Infections

Emerging Threats, Security Research, Vulnerabilities /

SocGholish: Turning Application Updates into Vexing Infections 2025-10-16 at 17:45 By Cris Tomboc This blog is the latest in a series that delves into the deep research conducted daily by the Trustwave SpiderLabs Threat Operations team on major threat actor groups and malware currently operating globally. This article is an excerpt from Trustwave Blog View

SocGholish: Turning Application Updates into Vexing Infections Read More »

Notepad++ DLL Hijacking (CVE-2025-56383): CVSS 8.4 or CVSS 0.0?

Security Research, Threat Intelligence, Vulnerabilities /

Notepad++ DLL Hijacking (CVE-2025-56383): CVSS 8.4 or CVSS 0.0? 2025-10-04 at 01:35 By A vulnerability on a popular source-code editor has been recently released along with a proof-of-concept (POC) exploit, but the security community isn’t so sure that it’s a legitimate flaw. This article is an excerpt from SpiderLabs Blog View Original Source

Notepad++ DLL Hijacking (CVE-2025-56383): CVSS 8.4 or CVSS 0.0? Read More »

SpiderLabs Ransomware Tracker Update September 2025: Qilin, Akira Top Ransomware Attackers

data breach, DFIR, News, Security Research, Vulnerabilities /

SpiderLabs Ransomware Tracker Update September 2025: Qilin, Akira Top Ransomware Attackers 2025-09-30 at 16:00 By The threat groups Qilin and Akira together conducted about one-quarter of the 402 ransomware attacks tracked by Trustwave SpiderLabs in September, with the manufacturing and technology sectors receiving the brunt of these efforts. This article is an excerpt from Trustwave

SpiderLabs Ransomware Tracker Update September 2025: Qilin, Akira Top Ransomware Attackers Read More »

From Folding to Folded: Hacking High Volume Mailer Machines

Managed Security Services, Security Research, Threat Intelligence, Vulnerabilities /

From Folding to Folded: Hacking High Volume Mailer Machines 2025-09-30 at 16:00 By John Jackson The Quadient DS-700iQ is a high-volume folder-inserter machine designed for automating the process of assembling, folding, and inserting mail into envelopes for large mailing operations. It features a modular design that can handle complex mailing jobs, supports multiple feeders and

From Folding to Folded: Hacking High Volume Mailer Machines Read More »

REDCap: Multiple Cross-Site Scripting (XSS) Vulnerabilities

Database Protection, Security Research, Vulnerabilities /

REDCap: Multiple Cross-Site Scripting (XSS) Vulnerabilities 2025-09-26 at 20:23 By Harold Zang REDCap, developed by Vanderbilt University, is a secure platform designed for data collection in research studies and operations. This article is an excerpt from SpiderLabs Blog View Original Source

REDCap: Multiple Cross-Site Scripting (XSS) Vulnerabilities Read More »

LevelBlue Spotlight Report Finds Manufacturers Struggling with the Impact of AI and Supply Chain Risk

Artificial Intelligence, Emerging Threats, Reports, Security Research, Vulnerabilities /

LevelBlue Spotlight Report Finds Manufacturers Struggling with the Impact of AI and Supply Chain Risk 2025-09-24 at 16:22 By LevelBlue’s newly released 2025 Spotlight Report: Cyber Resilience and Business Impact in Manufacturing, uncovered the different ways this sector has increased its understanding of the role cybersecurity must play moving forward, including the need to adopt

LevelBlue Spotlight Report Finds Manufacturers Struggling with the Impact of AI and Supply Chain Risk Read More »

Scroll to Top