Login Subscribe

7secure Coverage

Articles

Search and filter the broader reporting stream across incidents, AI security, policy, and operational coverage.

Threat Intelligence

Iranian Hackers Repurpose IP Cameras for Espionage and Disruption in Middle East Conflict

Iranian Hackers Repurpose IP Cameras for Espionage and Disruption in Middle East Conflict

Check Point researchers have identified a coordinated Iranian campaign that systematically compromises unsecured IP camera installations across the region. The actors first gain access through default credentials or vulnerable firmware, then install custom backdoors that allow persistent remote control. The compromised cameras serve as low‑profile footholds for intelligence gathering—

Malware & Ransomware

LummaStealer Returns, Teams with CastleLoader to Boost Persistence

LummaStealer Returns, Teams with CastleLoader to Boost Persistence

Bitdefender has identified a new wave of LummaStealer activity in which the notorious infostealer is being delivered by the CastleLoader dropper. The loader installs itself in legitimate‑looking directories, modifies autostart registry keys, and injects the payload into trusted system processes, giving the malware a durable foothold and helping it

Compliance & Regulation

CrowdStrike Secures NCSC CIR Certification, Boosting UK Incident Response Trust

CrowdStrike Secures NCSC CIR Certification, Boosting UK Incident Response Trust

CrowdStrike announced that its Incident Response services have been awarded the UK National Cyber Security Centre (NCSC) Cyber‑Incident Response (CIR) assurance. The certification confirms that CrowdStrike’s processes, tooling, and expertise meet the NCSC’s rigorous standards for handling complex, high‑impact cyber incidents across government and critical infrastructure

Threat Intelligence

Spotting the Difference: Targeted Intrusion vs Automated Scan

Spotting the Difference: Targeted Intrusion vs Automated Scan

A recent SANS diary entry detailed a week‑long investigation where security analysts initially flagged dozens of inbound connection attempts as possible breaches. By correlating source IP reputation, timing, payload consistency, and the presence of known threat‑actor tooling, the team identified a small subset of events that matched a

Vulnerabilities & Exploits

GoAnywhere MFT Zero‑Day Bypasses Perimeter Defenses, Exposes File Transfer Core

GoAnywhere MFT Zero‑Day Bypasses Perimeter Defenses, Exposes File Transfer Core

VMware’s investigation uncovered a high‑severity deserialization flaw in the GoAnywhere Managed File Transfer (MFT) platform. The zero‑day allowed an attacker to achieve remote code execution without authentication, effectively taking control of the file‑transfer service. Because GoAnywhere often sits behind the corporate firewall and is trusted for

Vulnerabilities & Exploits

Hidden Web Scripts Hijack AI Agents via Indirect Prompt Injection

Hidden Web Scripts Hijack AI Agents via Indirect Prompt Injection

Researchers at Unit42 observed attackers placing specially crafted strings inside ordinary web pages—HTML, JavaScript, or comments—that are later consumed by AI agents performing web‑scraping or content‑analysis tasks. When the AI parses the page, the malicious payload is treated as part of its prompt, causing the model

Threat Intelligence

AI‑Powered Tycoon2FA Kit Hijacks MFA at Scale

AI‑Powered Tycoon2FA Kit Hijacks MFA at Scale

Microsoft’s investigation uncovered the Tycoon2FA phishing kit, which uses artificial‑intelligence to perform real‑time man‑in‑the‑middle attacks on multi‑factor authentication (MFA) sessions. The kit injects malicious code into compromised browsers, captures one‑time passwords and push‑notification approvals, and then forwards the credentials to the

Threat Intelligence

GreyNoise Feeds Real‑Time Blocklists Directly into CrowdStrike Falcon

GreyNoise Feeds Real‑Time Blocklists Directly into CrowdStrike Falcon

GreyNoise has integrated its threat‑intelligence platform with CrowdStrike Falcon, delivering live blocklist data straight into the endpoint detection and response (EDR) console. The feed tags inbound IPs and domains that are known to be scanning, probing, or otherwise malicious, giving analysts instant visibility into suspicious internet traffic without manual