Malware

24 Nov

​​Spyware Allows Cyber Threat Actors to Target Users of Messaging Applications​

Attacks, Insights, Malware

CISA is aware of multiple cyber threat actors actively leveraging commercial spyware to target users of mobile messaging applications (apps).1 These cyber actors use sophisticated targeting and social engineering techniques to deliver spyware and gain unauthorized access to a victim’s messaging app, facilitating the deployment of additional malicious payloads that can further compromise the victim’s mobile device.   These cyber actors use tactics such as: Phishing and malicious device-linking QR codes to compromise victim accounts…

Read More
19 Nov

CISA Releases Guide to Mitigate Risks from Bulletproof Hosting Providers

Attacks, Insights, Malware

Today, Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the U.S. National Security Agency, U.S. Department of Defense Cyber Crime Center, U.S. Federal Bureau of Investigation, and international partners, released the guide Bulletproof Defense: Mitigating Risks from Bulletproof Hosting Providers to help Internet Service Providers (ISPs) and network defenders mitigate cybercriminal activity enabled by Bulletproof Hosting (BPH) providers. A BPH provider is an internet infrastructure provider that knowingly leases infrastructure to cybercriminals. These providers…

Read More
14 Nov

Fortinet Releases Security Advisory for Relative Path Traversal Vulnerability Affecting FortiWeb Products

Attacks, Insights, Malware

CISA is aware of exploitation of a newly disclosed vulnerability, CVE-2025-64446, in Fortinet FortiWeb, a web application firewall. This vulnerability affects the following FortiWeb versions:1 8.0.0 through 8.0.1 7.6.0 through 7.6.4 7.4.0 through 7.4.9 7.2.0 through 7.2.11 7.0.0 through 7.0.11 CVE-2025-64446 is a relative path traversal vulnerability CWE-23: Relative Path Traversal that may allow an unauthenticated malicious actor to execute administrative commands on a system via specially crafted HTTP or HTTPS requests.  Fortinet recommends affected…

Read More
13 Nov

Watch out for SVG files booby-trapped with malware

Information, Malware

What you see is not always what you get as cybercriminals increasingly weaponize SVG files as delivery vectors for stealthy malware Camilo Gutiérrez Amaya 22 Sep 2025  •  , 4 min. read A recent malware campaign making the rounds in Latin America offers a stark example of how cybercriminals are evolving and finetuning their playbooks. But first, here’s what’s not so new: The attacks rely on social engineering, with victims receiving emails that are dressed…

Read More
13 Nov

CISA Releases 18 Industrial Control Systems Advisories

Attacks, Insights, Malware

CISA released 18 Industrial Control Systems (ICS) Advisories. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.   ICSA-25-317-01 Mitsubishi Electric MELSEC iQ-F Series ICSA-25-317-02 AVEVA Application Server IDE ICSA-25-317-03 AVEVA Edge ICSA-25-317-04 Brightpick Mission Control / Internal Logic Control ICSA-25-317-05 Rockwell Automation Verve Asset Manager ICSA-25-317-06 Rockwell Automation Studio 5000 Simulation Interface ICSA-25-317-07 Rockwell Automation FactoryTalk DataMosaix Private Cloud ICSA-25-317-08 General Industrial Controls Lynx+ Gateway ICSA-25-317-09 Rockwell Automation FactoryTalk Policy…

Read More
13 Nov

CISA and Partners Release Advisory Update on Akira Ransomware

Attacks, Insights, Malware

Today, Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the Federal Bureau of Investigation, Department of Defense Cyber Crime Center, Department of Health and Human Services, and international partners, released an updated joint Cybersecurity Advisory, #StopRansomware: Akira Ransomware, to provide network defenders with the latest indicators of compromise, tactics, techniques, and procedures, and detection methods associated with Akira ransomware activity. This advisory reflects new findings as of Nov. 13, 2025, highlighting Akira ransomware’s evolution and continued threat…

Read More
12 Nov

Update: Implementation Guidance for Emergency Directive on Cisco ASA and Firepower Device Vulnerabilities

Attacks, Insights, Malware

CISA has released Emergency Cisco Directive 25-03 Implementation Guidance to assist federal agencies in addressing critical vulnerabilities in Cisco Adaptive Security Appliances (ASA) and Firepower devices. Emergency Directive 25-03: Identify and Mitigate Potential Compromise of Cisco Devices, issued on Sept. 25, identified known vulnerabilities CVE-2025-20333 and CVE-2025-20362, and mandated immediate action to mitigate risks. Threat actors continue to target these devices, posing significant risk to all organizations.  The implementation guidance provides information on the minimum software versions that…

Read More
10 Nov

Beware of threats lurking in booby-trapped PDF files

Information, Malware

Looks can be deceiving, so much so that the familiar icon could mask malware designed to steal your data and money. Fabiana Ramírez Cuenca 06 Oct 2025  •  , 5 min. read PDF files have become a staple of our daily digital lives, both at work and at home. They work seamlessly across operating systems and devices, and they couldn’t be easier to create and share. Every day, countless PDF (Portable Document Format) files are…

Read More
06 Nov

SnakeStealer: How it preys on personal data – and how you can protect yourself

Information, Malware

Here’s what to know about the malware with an insatiable appetite for valuable data, so much so that it tops this year’s infostealer detection charts Martina López 22 Oct 2025  •  , 3 min. read Infostealers remain one of the most persistent threats on today’s threat landscape. They’re built to quietly siphon off valuable information, typically login credentials and financial and cryptocurrency details, from compromised systems and send it to adversaries. And they do so…

Read More
30 Oct

New Guidance Released on Microsoft Exchange Server Security Best Practices

Attacks, Insights, Malware

Today, CISA, in partnership with the National Security Agency and international cybersecurity partners, released Microsoft Exchange Server Security Best Practices, a guide to help network defenders harden on-premises Exchange servers against exploitation by malicious actors. Threat activity targeting Exchange continues to persist, and organizations with unprotected or misconfigured Exchange servers remain at high risk of compromise.  Best practices in this guide focus on hardening user authentication and access, ensuring strong network encryption, and minimizing application…

Read More