Tag

incident response

12 stories

Chainalysis Confirms Customer Data Exposure After Attackers Used “Offensive Agentic Techniques”

Blockchain analytics firm Chainalysis has disclosed a security incident after attackers used what the company described as "offensive agentic techniques" to gain unauthorized access to internal systems and tools. The company says some customer information—names, email addresses, user IDs, and organizational role labels—was accessed, but it has found no evidence that sensitive investigation data, authentication credentials, or session tokens were exposed. Chainalysis is still determining the full scope of accessed…

Saugata DattaOct 31, 20263 min read12

Cybersecurity

Breaking the Ransomware Chain: Flashpoint’s 2026 Survival Guide

Ransomware is scaling faster than many organizations anticipated. In the first half of 2026, Flashpoint tracked 6,256 ransomware incidents — a 45% jump from 2025 — driven by expanding Ransomware-as-a-Service (RaaS) ecosystems, commoditized tooling, and growing use of AI. For security leaders, threat hunters, and intelligence teams, understanding how these operations form and where they can be interrupted has become a business-critical priority. Why ransomware is surging Flashpoint’s analysis points…

Saugata DattaOct 27, 20262 min read61

Cybersecurity

Citrix NetScaler Zero-Day in the Wild: Remote Code Execution, Web Shells and What to Do Now

A critical remote code execution flaw in Citrix NetScaler ADC and Gateway — tracked as CVE-2026-88771 — is being actively exploited to run commands on exposed appliances, install web shells and deliver malware. Observers report attackers using a staged technique that poisons logs, triggers a diagnostic process to execute embedded commands, and then attempts to persist via web shells or a FreeBSD x64 binary. With NetScaler devices frequently positioned at…

Saugata DattaOct 23, 20264 min read138

Compliance and Privacy

Quest Diagnostics’ Quanum LSM Compromised: What Patients and Providers Need to Know

Quest Diagnostics disclosed that an unauthorized party accessed its Quanum Lab Services Manager (Quanum LSM) system, a platform used by healthcare clients to order laboratory tests and retrieve results. The company detected the activity on October 21, 2026, and temporarily suspended access to the affected service while investigators work to determine what patient information, if any, was actually exposed. Quest says its core business operations remain intact and that other…

Saugata DattaOct 23, 20264 min read139

Compliance and Privacy

Lee Orders Nationwide Security Sweep After Multiple South Korean Bank Breaches

South Korea’s president, Lee Jae Myung, has ordered an urgent and comprehensive investigation into a string of recent data breaches that exposed personal information across several banks and finance firms. The incidents, reported in early October 2026, have raised alarms about the security of employee-support systems and third-party services that sit outside core customer banking platforms. Authorities are probing whether automated tools — including traces of AI-driven automation — played…

Saugata DattaOct 4, 20264 min read208

Cybersecurity

Citrix NetScaler Reboots After Emergency 0-Day Patch: What Teams Need to Know

Citrix released emergency builds to address two actively exploited zero-day vulnerabilities in NetScaler appliances, but some organizations report that the patched appliances are repeatedly rebooting. What began as a rapid mitigation effort to stop remote command execution and DTLS-related attacks has morphed into an availability problem for some deployments—raising the difficult question defenders must balance: is this an operational outage or evidence of ongoing compromise? This post explains what’s known,…

Saugata DattaOct 3, 20264 min read262

Cybersecurity

Akira Ransomware Uses Windows Safe Mode to Shut Down EDR Before Launching Encryptor

Akira’s latest tactics expand the ransomware playbook: instead of relying solely on kernel drivers or signed binaries to disable protections, an affiliate in a recent intrusion rebooted a compromised host into Safe Mode with Networking to silence endpoint defenses while keeping network access for remote control and exfiltration. The operation began with a successful credential-spraying attack against an exposed SonicWall SSL VPN that lacked MFA, and it unfolded rapidly—domain enumeration,…

Saugata DattaAug 13, 20264 min read289

Azure

Microsoft Outlook.com Hits Service Degradation: What Happened and How to Prepare

On April 27, 2026, Microsoft acknowledged a service degradation affecting Outlook.com after users across multiple regions reported problems accessing their inboxes. The company’s Microsoft 365 Status account on X confirmed intermittent issues, and Microsoft’s service health dashboard classified the incident as a “Service Degradation” rather than a full outage. For many organizations and individual users, the disruption meant delayed email delivery, pages that failed to load, or an inability to…

Saugata DattaApr 27, 20264 min read352

Cybersecurity

Stryker Confirms Massive Wiper Strike — Thousands of Devices Erased in Alleged Iran-Linked Operation

Stryker, the global medical technology company, confirmed on March 11, 2026, that it suffered a significant, destructive cyberattack that disabled large parts of its corporate Microsoft environment and resulted in the wiping of thousands of devices. The company characterized the incident as a deliberate data-destruction operation rather than a ransomware extortion scheme, and investigators and security firms have pointed to an Iran-linked threat actor claiming responsibility. What happened Stryker reported…

Saugata DattaMar 17, 20264 min read568

Cloud Computing

VoidLink Malware Framework: Key Points on How It Targets Kubernetes and AI Workloads

Title: VoidLink Malware Framework: Key Points on How It Targets Kubernetes and AI Workloads Overview VoidLink is a modular malware framework observed targeting cloud-native environments, with emphasis on Kubernetes clusters and AI infrastructure. Goal: persistence, lateral movement, data exfiltration, and abuse of compute (e.g., model theft, crypto-mining, or training/serving misuse). Modularity enables plugins for container escape, kubeconfig harvesting, and targeted abuse of GPU resources. Threat model Targets: misconfigured clusters, exposed…

Saugata DattaMar 5, 20264 min read671

Artificial Intelligence

When Money Talks and Machines Mimic: Ransomware, Extortion, and the AI Arms Race in Cybersecurity

The landscape of cyber threats has shifted decisively toward financially motivated crime. Extortion and ransomware now drive more than half of attacks with known motivations, as opportunistic criminal groups scale operations with automated tooling and AI. Speed, automation, and deception combine to inflict outsized damage on vulnerable organizations and public services. Why extortion and ransomware dominate Ransomware and extortion target assets that are both critical and costly to restore. Hospitals,…

Saugata DattaFeb 11, 20263 min read770

Cybersecurity

Microsoft Adds Native System Monitor (Sysmon) Support to Windows 11

Microsoft has begun shipping System Monitor (Sysmon) as a native, opt-in capability in Windows 11 preview builds. This change moves a widely used, high-fidelity endpoint telemetry tool from an optional Sysinternals download to an OS-managed feature. For security teams, IT operations, and incident responders, native Sysmon promises simpler deployment, stronger integration with Windows management channels, and a more consistent telemetry baseline across managed fleets — provided organizations adopt it carefully…

Saugata DattaFeb 6, 20266 min read879

Free Tools: IP, DNS, SSL