Cybersecurity Threat Advisory: Linux kernel RDS vulnerability
A critical Linux kernel vulnerability, CVE-2026-43502 (ZcopyReaper), affects the RDS zerocopy send path. The flaw allows unprivileged local attackers to escalate privileges and gain root access on affected systems. A public proof-of-concept (PoC) exploit is available, making immediate patching essential...
Cybersecurity Threat Advisory: SynkLoader Teams phishing campaign
Security researchers have identified a phishing campaign that uses Microsoft Teams messages impersonating IT support staff to distribute a newly discovered malware known as SynkLoader. Read this Cybersecurity Threat Advisory to understand the risks associated with SynkLoader, identify potential exposure,...
Cybersecurity Threat Advisory: SilverFox deploys ValleyRAT rootkit
SilverFox threat actors are actively running a ValleyRAT campaign to bypass security controls, escalate privileges, and maintain deep system access while avoiding detection. Organizations should treat this as a high-priority threat. Continue reading this Cybersecurity Threat Advisory to protect against...
Cybersecurity Threat Advisory: Microsoft Teams TURN relay exploit
Threat actors are using a custom backdoor to route their command-and-control (C2) traffic through Microsoft Teams’ TURN relay infrastructure. This technique blends malicious traffic with legitimate Teams communications. As a result, attackers can bypass traditional network defenses, maintain covert access...
Cybersecurity Threat Advisory: ClickFix attacks
This Cybersecurity Threat Advisory has been revised based on a proactive threat hunt by Barracuda Managed XDR, which identified additional indicators of compromise (IOCs) and informed enhanced defensive guidance for customers. Threat actors are actively exploiting a critical Ghost CMS...
Cybersecurity Threat Advisory: RMM-based phishing attacks
An ongoing phishing campaign has been observed targeting multiple vectors and leveraging legitimate Remote Monitoring and Management (RMM) tools to establish persistent remote access on compromised hosts. Read this Cybersecurity Threat Advisory to mitigate risk for you and your clients....
Cybersecurity Threat Advisory: Blue Hammer zero-day
A researcher leaked a zero‑day vulnerability dubbed “BlueHammer” to protest Microsoft’s handling of the private disclosure process. Although the published code contains implementation bugs, attackers with local access can still use it to compromise affected systems. Read this Cybersecurity Threat...
Cybersecurity Threat Advisory: CloudZ RAT targeting Microsoft Phone Link
A new CloudZ RAT variant uses a stealthy plugin called Pheno to hijack Microsoft Phone Link on Windows 10 and 11, allowing attackers to intercept SMS messages and one-time passcodes synced from mobile devices. Active since at least January, the...
Cybersecurity Threat Advisory: Telecoms targeted with new malware
A China‑linked advanced persistent threat group, UAT‑9244, has been targeting telecommunications (telecom) providers in South America since at least 2024. Learn more about this targeted campaign and how to protect your environment in this Cybersecurity Threat Advisory. What is the...
Cybersecurity Threat Advisory: Google security page spoofed in PWA attack
A phishing campaign is using a spoofed Google Account security page to distribute a malicious Progressive Web App (PWA). The app is designed to steal one‑time passcodes, collect cryptocurrency wallet addresses, and turn victims’ browsers into proxies for attacker traffic....
