South Korea’s president, Lee Jae Myung, has ordered an urgent and comprehensive investigation into a string of recent data breaches that exposed personal information across several banks and finance firms. The incidents, reported in early October 2026, have raised alarms about the security of employee-support systems and third-party services that sit outside core customer banking platforms. Authorities are probing whether
Tag: incident response
Citrix NetScaler Reboots After Emergency 0-Day Patch: What Teams Need to Know
Citrix released emergency builds to address two actively exploited zero-day vulnerabilities in NetScaler appliances, but some organizations report that the patched appliances are repeatedly rebooting. What began as a rapid mitigation effort to stop remote command execution and DTLS-related attacks has morphed into an availability problem for some deployments—raising the difficult question defenders must balance: is this an operational outage
Akira Ransomware Uses Windows Safe Mode to Shut Down EDR Before Launching Encryptor
Akira’s latest tactics expand the ransomware playbook: instead of relying solely on kernel drivers or signed binaries to disable protections, an affiliate in a recent intrusion rebooted a compromised host into Safe Mode with Networking to silence endpoint defenses while keeping network access for remote control and exfiltration. The operation began with a successful credential-spraying attack against an exposed SonicWall
Microsoft Outlook.com Hits Service Degradation: What Happened and How to Prepare
On April 27, 2026, Microsoft acknowledged a service degradation affecting Outlook.com after users across multiple regions reported problems accessing their inboxes. The company’s Microsoft 365 Status account on X confirmed intermittent issues, and Microsoft’s service health dashboard classified the incident as a “Service Degradation” rather than a full outage. For many organizations and individual users, the disruption meant delayed email
Stryker Confirms Massive Wiper Strike — Thousands of Devices Erased in Alleged Iran-Linked Operation
Stryker, the global medical technology company, confirmed on March 11, 2026, that it suffered a significant, destructive cyberattack that disabled large parts of its corporate Microsoft environment and resulted in the wiping of thousands of devices. The company characterized the incident as a deliberate data-destruction operation rather than a ransomware extortion scheme, and investigators and security firms have pointed to
VoidLink Malware Framework: Key Points on How It Targets Kubernetes and AI Workloads
Title: VoidLink Malware Framework: Key Points on How It Targets Kubernetes and AI Workloads Overview VoidLink is a modular malware framework observed targeting cloud-native environments, with emphasis on Kubernetes clusters and AI infrastructure. Goal: persistence, lateral movement, data exfiltration, and abuse of compute (e.g., model theft, crypto-mining, or training/serving misuse). Modularity enables plugins for container escape, kubeconfig harvesting, and targeted