Mississippi medical center reopens clinics hit by ransomware attack
The University of Mississippi Medical Center (UMMC) says it has resumed normal operations, nine days after a ransomware attack blocked access to electronic medical records and took down many of its IT systems.
How a Brute Force Attack Unmasked a Ransomware Infrastructure Network
A routine RDP brute-force alert led to unusual credential hunting and a geo-distributed VPN-linked infrastructure. Huntress Labs explains how one compromised login unraveled a suspected ransomware-as-a-service ecosystem tied to initial access brokers.
If you've spent any real time in the security trenches, you know the real enemy isn't just ransomware gangs, nation-state hackers, or relentless botnets. "Breakout time" is the critical window from initial access to lateral movement, when attackers start spreading across your network. A study on generative AI in SOCs using Microsoft Security Copilot found a 30.13% reduction in mean time to resolution three months post-adoption, based on telemetry from over 150 organizations and more than 95,000 incidents. Microsoft's own Randomized Controlled Trials on Copilot for Security involved 296 participants across professional and novice analysts. The results were hard to ignore: professionals saw a 7% overall accuracy boost, up to 12% in script analysis, and completed tasks 23.1% faster, with incident summarization improving by 46.2%. Novice analysts saw even more dramatic gains: a 35% accuracy surge, 43% improvement in guided response tasks, and 25.9% overall time savings. Automating incident summaries, script interpretation, and response guidance reduces cognitive load and lets analysts focus on the high-judgment work that actually requires a human brain. NightBeacon: Binary Defense's AI-Powered Platform At Binary Defense, we've channeled this into NightBeacon, our LLM-driven platform built for rapid AI deployment in SOCs. Mean Time to Resolution drops from a 4 to 6 hour average per incident to 2.8 to 4.2 hours, a 30.13% reduction. Incident summarization time cuts roughly in half, from 20 to 30 minutes down to 10 to 15. In one Binary Defense deployment, a manufacturing client saw MTTR drop from 5.2 hours to 3.6 hours, averting potential production halts that would have cost far more than the platform itself. From Microsoft's RCTs, professionals complete tasks 23.1% faster overall, with incident reports coming in 20.5% faster. Novice analysts hit 25.9% faster overall and 19.2% faster on guided response tasks. In practice, Binary Defense clients have seen teams process 35% more high-priority alerts. Overall accuracy for novice analysts jumped from 7.15 to 9.67 out of 10 in the Microsoft study, a 35% improvement that's the difference between a missed indicator and a contained incident. In our operations, it means junior analysts perform like veterans, reducing errors and helping them grow faster. At Binary Defense, we're not just watching the horizon.
Statistics on Android malware and the most notable mobile threats of 2025: preinstalled backdoors Keenadu and Triada, spyware Trojans, the Kimwolf IoT botnet, and Mamont banking Trojans.
Phishing OAuth: campagne contro enti pubblici sfruttano Microsoft
Nuove campagne di phishing stanno sfruttando in modo strumentale il protocollo OAuth per distribuire malware e compromettere endpoint aziendali, con un focus particolare su organizzazioni governative e del settore pubblico. A diffondere la notizia è stata Microsoft stessa che ha rilevato un abuso sistematico dei meccanismi di redirect legittimi previsti dallo standard di autorizzazione. Secondo …
L’attacco fisico al data center Amazon negli Emirati che ridefinisce il rischio cloud
L'attacco alla struttura AWS degli Emirati Arabi Uniti segna la prima volta che un data center, in zona di guerra, di una grande azienda tecnologica statunitense ha subito un'interruzione a causa di un'azione militare. Ciò solleva interrogativi sul ritmo di espansione delle Big Tech nella regione e su come mitigare i rischi degli attacchi fisici
Oblivion RAT - An Android Spyware Platform With a Built-In APK Factory
Technical analysis of Oblivion RAT Android malware: $300/month MaaS platform with APK builder, AccessibilityService hijacking, and fake ZIP encryption.
Complice la diffusione di OpenClaw, ritorna attuale il tema della sicurezza degli agenti AI che, prima di essere questione tecnica, è materia prettamente architetturale. Le imprese devono intervenire sui modelli AI, sulle integrazioni e sulla governance
CISA flags VMware Aria Operations RCE flaw as exploited in attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a VMware Aria Operations vulnerability tracked as CVE-2026-22719 to its Known Exploited Vulnerabilities catalog, flagging the flaw as exploited in attacks.
Telecamere di Teheran hackerate e IA: l’arma letale del Mossad per uccidere Khamenei
La morte di Khamenei ha svelato qualcosa che i professionisti della sicurezza informatica sapevano già: le infrastrutture di videosorveglianza pubblica sono tra i sistemi più vulnerabili e pericolosamente sottovalutati. Ecco cosa è successo, come è tecnicamente possibile e, soprattutto, cosa possiamo imparare per difenderci
Hacked traffic cams and hijacked TVs: How cyber operations supported the war against Iran
After U.S. and Israeli forces started bombing Iran, reports say cyber operations have disrupted communications, supporting surveillance activities, and have been used in psychological operations.
Google Chrome shifts to two-week release cycle for increased stability
Google Chrome will shift from a four-week to a two-week release cycle to roll out new features, bug fixes, and performance improvements more frequently.
Aggiornamenti Android marzo 2026, corretta una zero-day già sfruttata: cosa fare subito
Google ha rilasciato l’Android Security Bulletin di marzo 2026, il più corposo dell’anno: 129 vulnerabilità corrette di cui una, la CVE-2026-21385 nel componente grafico Qualcomm, risulta già attivamente sfruttata in attacchi mirati. Ecco tutto quello che c’è da sapere per valutare l’esposizione e agire con priorità
LexisNexis confirms data breach as hackers leak stolen files
American data analytics company LexisNexis Legal & Professional has confirmed to BleepingComputer that hackers breached its servers and accessed some customer and business information.
Attacchi cyber in Iran: le 3 ipotesi del crollo della connettività Internet
La connettività Internet in Iran è crollata drasticamente alle 7 di mattino e poi di nuovo più tardi, con una connettività minima rimanente. Una speculazione ragionata su ciò che è successo e perché la rete è diventata geopolitica in modo irreversibile
Middle East on the Brink: Iran-US-Israel Hostilities Trigger Cyber-Kinetic Conflict
Middle East tensions soar as Iran, US, and Israel engage in cyber and military strikes, triggering a hybrid conflict with global security implications.
Compromised Site Management Panels are a Hot Item in Cybercrime Markets
Compromised cPanel credentials are being sold in bulk across underground channels as plug-and-play phishing and scam infrastructure. Flare explains how analyzing 200,000 underground posts reveals a commoditized market for hacked site management panels.
