CyberSecure Specialist

23 May

ESET takes part in global operation to disrupt Lumma Stealer

Information

ESET has collaborated with Microsoft, BitSight, Lumen, Cloudflare, CleanDNS, and GMO Registry in a global disruption operation against Lumma Stealer, an infamous malware-as-a-service (MaaS) infostealer. The operation targeted Lumma Stealer infrastructure with all known C&C servers in the past year, rendering the exfiltration network, or a large part of it, nonoperational. Key points of this blogpost: ESET took part in a coordinated global operation to disrupt Lumma Stealer. ESET provided technical analysis and statistical information,…

Read More
22 May

Oops: DanaBot Malware Devs Infected Their Own PCs

Information, Insights

The U.S. government today unsealed criminal charges against 16 individuals accused of operating and selling DanaBot, a prolific strain of information-stealing malware that has been sold on Russian cybercrime forums since 2018. The FBI says a newer version of DanaBot was used for espionage, and that many of the defendants exposed their real-life identities after accidentally infecting their own systems with the malware. DanaBot’s features, as promoted on its support site. Image: welivesecurity.com. Initially spotted…

Read More
22 May

Advisory Update on Cyber Threat Activity Targeting Commvault’s SaaS Cloud Application (Metallic)

Attacks, Insights, Malware

Commvault is monitoring cyber threat activity targeting their applications hosted in their Microsoft Azure cloud environment. Threat actors may have accessed client secrets for Commvault’s (Metallic) Microsoft 365 (M365) backup software-as-a-service (SaaS) solution, hosted in Azure. This provided the threat actors with unauthorized access to Commvault’s customers’ M365 environments that have application secrets stored by Commvault. See the following resource for more information: Notice: Security Advisory (Update). CISA believes the threat activity may be part of…

Read More
22 May

Cybersecurity and AI: Integrating and Building on Existing NIST Guidelines

Insights

What is NIST up to? On April 3, 2025, NIST hosted a Cybersecurity and AI Profile Workshop at our National Cybersecurity Center of Excellence (NCCoE) to hear feedback on our concept paper which presented opportunities to create profiles of the NIST Cybersecurity Framework (CSF) and the NIST AI Risk Management Framework (AI RMF). These would serve to support the cybersecurity community as they adopt AI for cybersecurity, need to defend against AI-enabled cybersecurity attacks, as well as protect AI systems…

Read More
22 May

New Best Practices Guide for Securing AI Data Released

Attacks, Insights, Malware

Today, CISA, the National Security Agency, the Federal Bureau of Investigation, and international partners released a joint Cybersecurity Information Sheet on AI Data Security: Best Practices for Securing Data Used to Train & Operate AI Systems.  This information sheet highlights the critical role of data security in ensuring the accuracy, integrity, and trustworthiness of AI outcomes. It outlines key risks that may arise from data security and integrity issues across all phases of the AI…

Read More
21 May

Russian GRU Cyber Actors Targeting Western Logistics Entities and Tech Companies

Attacks, Insights, Malware

Today, CISA, the National Security Agency, the Federal Bureau of Investigation, and other U.S. and international partners released a joint Cybersecurity Advisory, Russian GRU Targeting Western Logistics Entities and Technology Companies.   This advisory details a Russian state-sponsored cyber espionage-oriented campaign targeting technology companies and logistics entities, including those involved in the coordination, transport, and delivery of foreign assistance to Ukraine. Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center, military unit…

Read More
21 May

Threat Actors Target U.S. Critical Infrastructure with LummaC2 Malware

Attacks, Insights, Malware

Today, CISA and the Federal Bureau of Investigation released a joint Cybersecurity Advisory, LummaC2 Malware Targeting U.S. Critical Infrastructure Sectors. This advisory details the tactics, techniques, and procedures, and indicators of compromise (IOCs) linked to threat actors deploying LummaC2 malware. This malware poses a serious threat, capable of infiltrating networks and exfiltrating sensitive information, to vulnerable individuals’ and organizations’ computer networks across U.S. critical infrastructure sectors. As recently as May 2025, threat actors have been…

Read More
21 May

ESET APT Activity Report Q4 2024–Q1 2025

Information

ESET APT Activity Report Q4 2024–Q1 2025 summarizes notable activities of selected advanced persistent threat (APT) groups that were documented by ESET researchers from October 2024 until the end of March 2025. The highlighted operations are representative of the broader landscape of threats we investigated during this period, illustrating the key trends and developments, and contain only a fraction of the cybersecurity intelligence data provided to customers of ESET’s private APT reports. During the monitored…

Read More
21 May

The who, where, and how of APT attacks in Q4 2024–Q1 2025

Information

ESET Chief Security Evangelist Tony Anscombe highlights key findings from the latest issue of the ESET APT Activity Report 19 May 2025 Today, the ESET research team released its latest issue of the APT Activity Report that details the operations of some of the world’s most notorious nation state-affiliated hacking collectives from October 2024 to March 2025. Their analysis reveals sustained efforts by advanced threat actors targeting a broad array of geographies and industry sectors,…

Read More
20 May

KrebsOnSecurity Hit With Near-Record 6.3 Tbps DDoS

Information, Insights

KrebsOnSecurity last week was hit by a near record distributed denial-of-service (DDoS) attack that clocked in at more than 6.3 terabits of data per second (a terabit is one trillion bits of data). The brief attack appears to have been a test run for a massive new Internet of Things (IoT) botnet capable of launching crippling digital assaults that few web destinations can withstand. Read on for more about the botnet, the attack, and the…

Read More