Kaspersky researcher discovered a vulnerability in RPC architecture that enables an attacker to create a fake RPC server and escalate their privileges.

The Silver Fox group is targeting companies in Russia and India by impersonating tax authorities to distribute ValleyRAT and the new ABCDoor backdoor.

Kaspersky expert breaks down a new phishing scheme that uses the Amazon SES cloud email service. Let’s look at some examples to see how you can tell a phishing email from a real one.

We explain what suspicious websites are and how to distinguish a safe site from a fraudulent one. A new category in Kaspersky solutions: we’re sharing global statistics on untrusted site detection.

Kaspersky researchers uncovered malicious wheel packages in PyPI that targeted both Windows and Linux and contained a dropper delivering malware dubbed ZiChatBot. We attribute this activity to OceanLotus APT.

This report provides statistical data on published vulnerabilities and exploits we researched during Q1 2026. It also includes summary data on the use of C2 frameworks in APT attacks.

During a security assessment of Kaspersky USB Redirector, we discovered CVE-2025-68670: a pre-auth RCE in the xrdp server component. Project maintainers promptly patched the vulnerability.

Kaspersky researchers are sharing insights into the main ransomware trends for 2026: EDR killers on the rise, switching from data encryption to data leaks, and more.

Kaspersky researchers analyze a range of new PebbleDash-based tools used in recent Kimsuky campaigns and reveal their connection to the AppleSeed malware cluster.

Across Q1 2026, PIXM detected and analyzed over 75 distinct phishing campaigns. What stands out is not the volume — it is how rapidly the campaigns matured across the quarter. January's attacks relied on credential harvesting forms and consumer brand impersonation. By March, the same threat surface featured 100+ phishing pages hosted on Microsoft's own Azure infrastructure, comprehensive MFA bypass against authenticator apps and FIDO tokens, and fully functional proxy-based site clones.

Come ho raccontato qualche giorno fa su altri canali ho iniziato a lavorare su una serie di video + articoli tecnici dedicati esclusivamente a chi vuole iniziare a lavorare nel contesto cybersecuri…

Cari supporter – ovvero coloro che oltre a leggere i miei post e vedere i video hanno anche deciso di sostenere il mio progetto di divulgazione – ho un aggiornamento strutturale da farv…

Il progetto podcast ha effettivamente preso una buona piega: assieme ad Andrea stiamo registrando con la media delle due puntate al mese e da quando ne ho parlato l’ultima volta ci sono quatt…

Premessa Questo post riprende una serie di contenuti che avevo in roadmap sul tema MISP e vorrei farlo discutendo alcuni use case su cui sto lavorando. Come alcuni sanno tempo fa ho iniziato a lavo…

Opacità, rischi sistemici e vulnerabilità diffusa: quanto e come sono protetti i nostri porti, aeroporti, ferrovie e non solo?

La mappatura dei fondali oceanici sta diventando un elemento sempre più importante della competizione tra le due superpotenze, per motivi militari, economici e scientifici.

Scommesse su guerre e tragedie, rischi di insider trading e minacce: perché la nuova frontiera della speculazione selvaggia deve preoccuparci

È possibile sottrarsi alle grandi piattaforme e ricreare un ambiente online libero, collettivo e governato dagli stessi utenti? Come scrive Kenobit in “Assalto alle piattaforme”, le alternative esistono, ma la strada per conquistare la libertà digitale è ancora molto lunga.

A 24-year-old British national and senior member of the cybercrime group "Scattered Spider" has pleaded guilty to wire fraud conspiracy and aggravated identity theft. Tyler Robert Buchanan admitted his role in a series of text-message phishing attacks in the summer…

A Brazilian tech firm that specializes in protecting networks from distributed denial-of-service (DDoS) attacks has been enabling a botnet responsible for an extended campaign of massive DDoS attacks against other network operators in Brazil, KrebsOnSecurity has learned. The firm's chief…

An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States today, after a cybercrime group defaced the service's login page with a ransom demand that…

Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code. That reality is on full display this month with some of the…

Hacktive Security - Advanced Cyber Security Services

Ciao a tutti! 👋 Grazie al via libera dei soci nell’ultima assemblea, abbiamo ufficialmente depositato il nuovo statuto associativo, in …

How corporate/retail accounts are exploited for financial fraud through sophisticated device fingerprinting and mule networks.

While analyzing global smishing operations spanning APAC, LATAM, Europe, and MEA, Group-IB researchers uncovered the 'Phoenix System' administrative panel, a centralized Phishing-as-a-Service (PhaaS) platform with real-time victim monitoring, geofencing, and live-phishing interventions to bypass multi-factor authentication.

Your SOC was half prepared for brand threats, but this integration changes that. Group-IB Digital Risk Protection meets Google SecOps, bringing external brand intelligence directly into your SIEM/SOAR and closing the signal gap your analysts might’ve missed.