• U.S. soldiers deployed to Europe had a busy November testing out counter-drone systems that the service hopes to get into the hands of more NATO allies, as well as with units and allies as far away as the Indo-Pacific. 

    First Polish, Romanian, and American troops trained together Nov. 18 in Poland on Merops, an AI-enabled, pickup-truck-transportable system that identifies enemy drones, then launches a cheap fixed-wing drone to ram them. At the same time, the Army held Operation Flytrap 4.5 in Germany, a competition of 20 cUAS contenders in a competition for one of four $350,000 prizes.

    “It also demonstrated our capability, just as Flytrap did, to integrate with industry, to move very quickly to employ a capability that's lethal,” Brig. Gen. Curt King, who leads the 10th Army Air and Missile Defense Command in Germany, told reporters Tuesday. “It can defeat the Shahed-type threats, but also it demonstrates our ability to place capabilities that are much cheaper than some of our other previous systems that we've been using to date, to ensure that we are  able to build the capacity against the drone threats that could be placed into the air.”

    The U.S. has been using air defense systems to shoot down drones, with missiles that cost millions of dollars each. A Merops interceptor drone costs about $15,000, about half the price of the Shaheds that Ukrainians have been shooting down with it. 

    “The other thing that we demonstrated with Flytrap, and that Ukraine has shown us … is the technology is rapidly evolving so that we can get to enhanced decision aids and autonomy, which Ukraine has been rapidly developing, so that I don't need 10 soldiers to do a function,” King said. 

    Both events included the team from the Global Tactical Edge Acquisition Directorate, a nascent procurement system that plans to create a marketplace where units can buy the systems that are vetted and approved through events like Project Flytrap.

    “We're not just stopping with the counter-UAS fight,” Col. Christopher Hill, senior director of the GTEAD, told reporters. “Next up on the list is ground autonomy and ground launched effects, as I mentioned earlier, the offensive systems that we're going to use to create a dilemma for our adversaries. Then we're going to move to air autonomy and air-launched effects—again, another offensive system to provide a dilemma.”

    The team is expanding to Indo-Pacific Command early next year, Hill said.

    “We're going to replicate the same processes there in the Pacific region, in order to not only support our U.S. unit there, but also our international partners in Australia, in South Korea and in Japan, and other partners there in the region,” he said.

    Beyond demonstrations, GTEAD plans to have soldiers lead assessments and give feedback so that systems can be tweaked and then put on the marketplace.

    “On the back end of these demonstrations, be prepared, from an acquisition standpoint, to actually put dollars towards these capabilities and give these companies something to look forward to from a contract standpoint,” he said.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Horsham, United Kingdom, November 25th, 2025, CyberNewsWire Detego Global, the company behind the award-winning Unified Digital Forensics Platform, is proud to announce the launch of Detego Case Manager for DFIR, a powerful, purpose-built platform designed to meet the evolving demands of digital forensics and incident response (DFIR) teams worldwide. Developed in close collaboration with investigative […]

    The post Detego Global Launches Case Management Platform for Digital Forensics and Incident Response Teams appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Horsham, United Kingdom, November 25th, 2025, CyberNewsWire

    Detego Global, the company behind the award-winning Unified Digital Forensics Platform, is proud to announce the launch of Detego Case Manager for DFIR, a powerful, purpose-built platform designed to meet the evolving demands of digital forensics and incident response (DFIR) teams worldwide.

    Developed in close collaboration with investigative professionals, Detego Case Manager for DFIR addresses the real-world challenges of managing high-volume, complex digital investigations across multiple locations and touchpoints, whether on scene or in the laboratory.

    Detego Global’s new platform delivers full-spectrum case management from a tailored perspective. It brings together evidence tracking, audit logging, workflow automation, task and performance management, compliance controls, and more, all within one secure and highly auditable system.

    Team leaders and administrators can access instant metrics on all cases within seconds, providing real-time visibility into efficiency and enabling swift, data-backed decision-making.

    “We’ve worked hand in hand with digital forensic investigators, incident responders, law enforcement, military, and corporate professionals to design a platform that truly meets the operational demands they face every day,” said Alex Kirk, Global Sales Director of Detego Global.

    “Detego Case Manager for DFIR reflects the practical input of experts worldwide, combining streamlined workflows with powerful data insights and compliance features that modern investigations require.”

    Key features include:

    • Fully compliant/audit-friendly investigation management with timestamped notes and specifics, full audit trails, and an unbroken chain of custody
    • Customisable, pre-built workflows designed by DFIR experts and a visual workflow builder to streamline and accelerate investigations
    • Centralised evidence and data collection, unifying physical and digital exhibits, ISO-compliant forms, and seamless integration of evidence from third-party tools
    • Smart task management with Kanban-style tracking, automation, role-based permissions, escalation paths, and collaboration tools for full visibility and accountability
    • Entity management that maps and traces relationships across people, devices, locations, and cases to uncover hidden links and patterns
    • Built-in insights and reporting, including real-time performance metrics, case timelines, dashboards, and logs to support informed decision-making, efficient resource allocation, and early identification and elimination of bottlenecks

    The platform is available as an on-premise or cloud-hosted solution and includes optional add-ons such as custom workflow development and database integrations.

    Detego Case Manager for DFIR can be deployed rapidly, with tailored onboarding, user guides and ongoing support to ensure immediate operational impact. A fully functional 30-day trial is also available.

    Detego Case Manager for DFIR sets a new benchmark in digital investigation management, delivering control, clarity, and consistency across every stage of the forensic life cycle.

    To request a trial, users can visit: https://detegoglobal.com/cmtrial/

    https://player.vimeo.com/video/1111243018 (embedded video)

    About Detego Global

    Detego Global is the company behind the Detego Unified Digital Forensics Platform and Detego Case Manager. These solutions are trusted by military, law enforcement, and enterprise teams in more than 70 countries.

    The company’s technologies enable investigators to swiftly triage devices, rapidly extract and analyse digital evidence at scale, and streamline every aspect of investigations.

    Detego Global enables investigative teams to combat serious crimes, including child exploitation, human trafficking, terrorism, and fraud, with greater speed and accuracy.

    Contact

    Director of Marketing

    Buddhika Karunasekara

    Detego Global

    budd.karunasekara@detegoglobal.com

    The post Detego Global Launches Case Management Platform for Digital Forensics and Incident Response Teams appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A major accounting and financial services provider disclosed a significant data breach affecting client business records and sensitive corporate documents.

    The incident occurred on or about November 12, 2025, but the company only announced the breach publicly on November 22, 2025.

    The breach exposed accounting records and legal agreements belonging to SitusAMC clients. The company confirmed that specific corporate data associated with clients’ relationships with the firm was compromised.

    Client Accounting Records Compromised in Major Breach

    Additionally, data relating to some clients’ customers may have been affected, though the full scope remains under investigation.

    SitusAMC stressed that no encrypting malware was involved in the attack, and their services remain fully operational.

    The company worked with leading cybersecurity experts and federal law enforcement to contain the incident immediately after detection.

    Following the discovery, SitusAMC launched an immediate investigation with third-party security advisors and notified federal law enforcement authorities.

    The company implemented several security hardening measures, including credential resets, turning off remote access tools, updating firewall rules, and strengthening security settings across its systems.

    “We take this matter and the security of our clients’ information very seriously,” SitusAMC stated in a customer notice.

    The company maintained that all systems were secured and services remained uninterrupted throughout the incident. SitusAMC confirmed that it has directly communicated with affected clients about the breach.

    The company acknowledged that while certain client data was compromised, the specific nature and extent of the impact remain under investigation.

    Clients were instructed to contact the company’s security team at securitynotice@situsamc.com for additional information or concerns.

    The 10-day gap between discovery (November 12) and public disclosure (November 22) allowed SitusAMC time to investigate the incident and notify law enforcement before disclosing the breach.

    The company indicated it would provide additional updates as the investigation progresses and new information becomes available.

    This breach highlights the ongoing security risks facing financial services companies and the importance of robust data protection measures for firms handling sensitive accounting and legal documents.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Retail Finance Giant SitusAMC Data Breach Exposes Accounting Records and Legal Agreements appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New research has found that organizations in various sensitive sectors, including governments, telecoms, and critical infrastructure, are pasting passwords and credentials into online tools like JSONformatter and CodeBeautify that are used to format and validate code. Cybersecurity company watchTowr Labs said it captured a dataset of over 80,000 files on these sites, uncovering thousands of

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A non-profit dental insurance provider based in Roanoke, Virginia, disclosed a significant data breach affecting over 145,900 individuals.

    The external system breach exposed customers’ personal information, prompting immediate notification and protective measures.

    The breach occurred on March 21, 2025, but wasn’t discovered until August 22, 2025, a delay of over five months. This extended detection window raised concerns about the organization’s security monitoring capabilities.

    Delta Dental notified affected consumers on November 21, 2025, through written notices, providing customers with critical information about the incident and available protections.

    Healthcare Data Incident Impacts

    The compromised personal details included names and additional personal identifiers, though specific data elements remain partially redacted in public disclosures. The breach affected 145,918 individuals across multiple states, including 222 Maine residents.

    The external hacking attack targeted Delta Dental’s systems, allowing unauthorized access to sensitive customer information stored on their network.

    Recognizing the severity of the incident, Delta Dental of Virginia partnered with TransUnion to offer complimentary identity theft and credit protection services to affected customers.

    This proactive approach helps customers monitor their financial accounts and detect any suspicious activity resulting from the compromised information.

    The organization’s legal representatives, including attorney Lindsay Nickle from Constangy, Brooks, Smith & Prophete, LLP, coordinated the breach notification process with state regulators and affected consumers.

    Regulatory notification requirements were met, with formal notices filed in states where residents were affected, including Maine.

    The incident highlights ongoing vulnerabilities in healthcare and insurance industry systems. The months-long detection delay suggests potential gaps in security monitoring and incident response procedures.

    How Is Delta Dental Responding

    Delta Dental’s breach joins growing numbers of healthcare-related data incidents affecting millions annually.

    Organizations in this sector remain attractive targets for cybercriminals seeking valuable personal and medical information for identity theft, fraud, and resale on underground markets.

    Affected individuals should regularly monitor their credit reports, consider placing fraud alerts with the credit bureaus, and take advantage of TransUnion’s protection services.

    Consumers should remain vigilant for phishing attempts and suspicious communications referencing the breach, as fraudsters often exploit incidents to target victims further.

    The incident underscores the importance of robust cybersecurity practices, including regular security assessments, employee training, and rapid incident detection and response capabilities within healthcare and insurance organizations.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Delta Dental of Virginia Data Breach Exposes 146,000+ Customers Personal Details appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Developing: United States and Ukrainian officials have made some progress in talks to wind down Russia’s Ukraine invasion, Kyiv’s national security advisor announced Tuesday morning. “Our delegations reached a common understanding on the core terms of the agreement discussed in Geneva,” said Rustem Umerov, writing on social media. “We now count on the support of our European partners” and “look forward to organizing a visit of Ukraine’s President to the US at the earliest suitable date in November to complete final steps and make a deal with President Trump,” he said. 

    It’s unclear just yet what terms the U.S. and Ukrainians agreed to on Monday. (The Washington-based Institute for the Study of War rounded up various reports from European and U.S. press with a variety of possible suggestions at play, here.) President Trump’s negotiator Steve Witkoff reportedly drafted a 28-point framework document alongside his Russian counterpart last month. After removing elements unrelated to Ukraine, those 28 points were reduced to 19 on Monday, according to the Financial Times and Washington Post

    The U.S. side included Army Secretary Dan Driscoll, who met late Monday and into Tuesday with Russian negotiators in Abu Dhabi, Reuters reports. 

    Ukrainian President Volodymir Zelenskyy hasn’t yet confirmed his full support for a U.S.-brokered peace plan, writing on social media Tuesday four hours after Umerov’s message, “Communication with the American side continues, and I am grateful for all of America’s efforts and personally for President Trump’s efforts.”

    Meanwhile, Russian attacks on Ukraine continue, with at least seven people killed in the capital city of Kyiv during overnight strikes involving 460 drones and at least 22 missiles, the Associated Press reports, citing Ukrainian officials. The attacks left more than 100,000 people without power across five regions of Ukraine. 

    “Neighboring countries Romania and Moldova reported that a handful of drones violated their airspace, with one each landing on their territory,” AP writes. Reuters has a bit more on that. 

    Zelenskyy: “If there are negotiations, if there is constructive engagement, if we are truly ending the war—then there must be no missiles, no massive strikes on Ukraine, on our people,” the Ukrainian president said Monday evening on social media. “This can indeed be ensured by those who are really strong in the world. And much depends on America. Russia started this war, and it is Russia that must end it,” he stressed. 

    Counter-drone warfare at scale is getting a little closer, as shown by a recent demonstration in northern Germany last week. The U.S. Army’s Project Flytrap assembled 20 vendors of anti-drone sensors, systems, and weapons—and within days, had an on-site network up and running. 

    Reporting from Truppenübungsplatz Putlos Training Ground: “In a grassy field near the Baltic Sea, U.S. soldiers used net-shooting hunter drones, specially outfitted 557 rifles, and .50-caliber machine guns to drop dozens of drones, large and small, into the cold mud. For the U.S. Army, the daylong event marked the beginning of the end of firing $4-million missiles at $20,000 drones; for its European counterparts, it showed off options to counter Russia’s accelerating threat,” writes Defense One’s Patrick Tucker, here.

    Related reading: 


    Welcome to this Tuesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1864, eight arsonists aligned with the Confederacy tried but failed to burn down New York City. 

    Around the Defense Department

    Monitoring: The U.S. military’s Southern Command is allegedly “restricting [or] limiting leave over the Thanksgiving and Christmas holidays, in preparation for possible land strikes in the next 10 days to two weeks,” Kellie Meyer of NewsNation reported on social media Monday. 

    Meanwhile: Trump reportedly says he’s ready to speak with Venezuelan dictator Nicholas Maduro, Marc Caputo of Axios reported Monday. “Word of Trump's interest in talking coincides with the State Department's decision Monday to label an alleged drug cartel in Venezuela as a ‘Foreign Terrorist Organization,’ which provides the U.S. more of a pretext to take military action in and around the South American nation.” 

    It also follows a trip to Puerto Rico by Joint Chiefs Chairman Gen. Dan Caine on Monday, “Caine’s second visit to the region since the U.S. military started building up its presence, which now includes the nation’s most advanced aircraft carrier,” AP reports. 

    Trump’s Pentagon says it will investigate former astronaut and current Sen. Mark Kelly, D-Ariz., over his participation in a video last week urging troops to refuse “illegal orders.” The Defense Department announced on Twitter Monday that “military retirees remain subject to the UCMJ for applicable offenses, and federal laws such as 18 U.S.C. § 2387 prohibit actions intended to interfere with the loyalty, morale, or good order and discipline of the armed forces. Any violations will be addressed through appropriate legal channels.” 

    Defense Secretary Pete Hegseth chimed in, too, calling the lawmakers in last week’s video the “Seditious Six.” According to Hegseth, “Five of the six individuals in that video do not fall under [Defense Department] jurisdiction (one is CIA and four are former military but not ‘retired’…However, Mark Kelly (retired Navy Commander) is still subject to [Uniform Code of Military Justice]—and he knows that.” 

    Legal expert reax: “Having a United States senator subject to discipline at the behest of the secretary of defense and the president—that violates a core principle of legislative independence,” Georgia State University constitutional law professor Anthony Michael Kreis told AP. “Any way you cut it, the Constitution is fundamentally structurally designed to prevent this kind of abuse from happening.”

    Historian reax: For the White House, “It’s a convoluted argument, one that administration officials are using to claim that the lawmakers’ reminder that troops must not obey an unlawful order is actually encouragement not to obey lawful orders,” Heather Cox Richardson of Boston College wrote Monday. But “Attacking Kelly appeals to Trump’s base” in part because “Turning to military tribunals harks back to QAnon, a conspiracy theory that took off in 2017. It maintained Trump was leading a fight against an international ring of pedophiles that he would bring to justice through military tribunals.”

    Kelly’s response: “If this is meant to intimidate me and other members of Congress from doing our jobs and holding this administration accountable, it won’t work. I’ve given too much to this country to be silenced by bullies who care more about their own power than protecting the Constitution,” he said in a statement Monday. 

    Hegseth responded again on social media Tuesday morning, threatening the much-decorated Kelly with a uniform inspection. 

    Foreign spies see opportunity in fed workers' uncertainty, warns Army deputy chief for intelligence. In a Nov. 13 message to more than a million soldiers, civilian employees, and family members, Lt. Gen. Anthony R. Hale warned against foreign agents pretending to offer jobs or other deals.

    Why now? “Especially in the context of the recent lapse in appropriations and government shutdown, our adversaries are looking online to identify individuals seeking new employment opportunities, expressing dissatisfaction or describing financial insecurity,” Hale said. Nextgov’s David Dimolfetta has more, here.

    China

    China is building a “counter-AI warfare” playbook. “The People’s Liberation Army is teaching troops to fight the model as much as the soldier. Forces are learning to alter how vehicles appear to cameras, radar, and heat sensors so the AI misidentifies them, to feed junk or poisoned data into an opponent’s pipeline, and to swamp battlefield computers with noise. Leaders are drilling their own teams to spot when their own machines are wrong. The goal is simple: make an enemy’s military AI chase phantoms and miss the real threat,” write BluePath Labs’ Tye Graham and New America’s Peter Singer in the latest edition of The China Intelligence column. 

    Also: Trump said he spoke with Xi Monday, and that the two leaders will host reciprocal visits next year. 

    Related reading:

    Trump 2.0

    Update: DOGE is no longer a “centralized entity” with “centralized leadership,” the head of the government’s personnel agency told Reuters. But the principles of the Department of Government Efficiency office “remain alive and well,” and the White House’s DOGE tech team continues to work on technology modernization projects throughout federal agencies. Nextgov’s Natalie Alms has more, here

    And from the seemingly ever-expanding world of social media,America’s Polarization Has Become the World's Side Hustle,” 404 Media reported Monday after a Twitter update apparently revealed the locations of many top users and influencers—showing, e.g., that most do not seem to reside inside the U.S. at all. “A huge amount of the viral content about American politics and American news on social media is from sock puppet and bot accounts monetized by people in other countries,” Jason Koebler of 404 writes. 

    What’s going on? “The rise of easy to use, free AI generative tools have supercharged this effort, and social media monetization programs have incentivized this effort and are almost entirely to blame.” The Atlantic’s Charlie Warzel has more on the topic, here.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Leading a Security Operations Center has never been more challenging.

    SOC managers today juggle expanding attack surfaces, remote workforces, cloud migrations, and an explosion of security tools. All while trying to keep pace with increasingly automated attacks.  
     
    Every day feels like a mix of firefighting and long-term planning that never fully materializes. Under this pressure, it’s easy to assume that the biggest challenges come from whatever attack makes the headlines this week. 

    But in reality, the true weak point in many SOCs hides deeper in the foundation of their operations. 

    The Usual Suspects: What SOCs Blame for Trouble 

    When SOC leaders are asked what keeps them up at night, the answers often revolve around specific threats and resource limitations. 

    A survey of the customers of a cybersecurity solutions provider ANY.RUN illustrates their main concerns:  

    • The next zero-day exploit lurking in the shadows, ready to bypass all defenses before signatures exist to detect it. 
    • Notorious malware families like ransomware variants that threaten to cripple operations and demand hefty payments. 
    • Advanced Persistent Threats (APTs) from nation-state actors with unlimited resources and patience, slowly infiltrating networks. 
    • Novel attack techniques that evade traditional detection methods, exploiting vulnerabilities before they’re even discovered. 
    • Budget constraints that prevent hiring more analysts, purchasing better tools, or expanding coverage. 

    These concerns are legitimate. Each represents a real risk that can lead to costly breaches.

    However, focusing exclusively on these threats misses a more fundamental problem that undermines the effectiveness of even the best-resourced SOCs. 

    The Real Gap: Quality Threat Intelligence

    The factor that quietly undermines detection, investigation, and response is insufficient access to fresh, actionable, context-rich threat intelligence. 

    SOCs rarely fail because analysts lack talent. They fail because analysts lack clarity. Without trustworthy, up-to-date insights into active malware behavior, real-world campaigns, and current attacker tooling, SOC teams are forced to guess.

    And guessing is expensive — both in time and in business risk. 

    The true gap isn’t a particular adversary or a specific attack. It’s the absence of high-quality, continuously updated data that helps analysts understand what they’re looking at and how to react. 

    Three Critical SOC Problems That Threat Intelligence Solves 

    1. Alert Fatigue and Investigation Burnout 

    When every alert looks the same and lacks context, analysts waste hours chasing false positives.

    Quality threat intelligence dramatically reduces this burden: Is this IP associated with known malware families? What attack techniques does it use? Has it been seen in recent campaigns targeting similar organizations? 

    With enriched threat data, analysts can quickly triage alerts, distinguishing between noise and genuine threats. This means faster responses to real incidents. 

    2. Detection Gaps and Blind Spots 

    Traditional signature-based detection, firewalls, and endpoint detection cannot discover unknown threats, making it difficult for SOCs to defend against zero-day attacks. 

    When threat intelligence includes Tactics, Techniques, and Procedures (TTPs) from recent attacks, SOCs can build detection rules that identify malicious behavior rather than just known signatures.

    This shifts defense from reactive to proactive, catching threats even when they use new infrastructure or modified payloads. 

    Detect emerging threats early with real-time intelligence from Threat Intelligence Feeds -> Request trial for your team  

    3. Slow Incident Response and Investigation Times 

    When an alert triggers, speed matters. But without proper context, investigations drag on while analysts hunt for information across multiple sources.

    Quality threat intelligence accelerates response by providing everything analysts need in one place: related file hashes to search for across systems, associated domains and IPs to block, links to full sandbox analysis showing exactly how the threat behaves, and attribution to known threat actors or campaigns. 

    This contextual enrichment transforms investigation workflows from hours of research to minutes of decision-making, dramatically reducing Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). 

    Fresh Intelligence from the Front Lines 

    ANY.RUN’s Threat Intelligence Feeds address these challenges by providing something unique in the TI market: real-time indicators extracted from actual malware analysis sessions conducted by a global network of over 15K SOC teams who upload and analyze real-world malware and phishing samples daily. 

    Threat Intelligence Feeds: IOC and context sources  

    Key advantages include: 

    • Live behavior-driven indicators: IOCs generated by real executions of active malware samples. 
    • Context-rich detections: Each indicator comes with metadata, including links to sandbox sessions with behaviors and TTPs. 
    • Instant visibility into emerging activity: Newly uploaded samples trigger immediate analysis, allowing the feed to reflect what attackers are using right now. 
    • Coverage across many malware families: From commodity stealers and loaders to more targeted threats. 
    • High signal-to-noise ratio: Because the data is collected from real sandbox runs, it avoids inflated or outdated information that clutters many traditional feeds. 

    All of this results in intelligence that analysts can trust and act on immediately. 

    TI Feeds data: fullness and accuracy 
     
    Implementing ANY.RUN’s Threat Intelligence Feeds delivers measurable business outcomes that extend beyond technical metrics: 

    • Reduce incident response costs by enabling faster, more confident investigation. 
    • Lower risk of operational disruption by improving early detection of active threats. 
    • Optimize SOC efficiency so teams spend less time chasing false leads. 
    • Enhance strategic planning through visibility into persistent attacker tooling. 
    • Support compliance and audit readiness with evidence-based threat monitoring. 
    • Strengthen security investments by informing which controls need tuning, updating, or replacing. 

    Threat Intelligence Feeds business benefits 

    Conclusion 

    The biggest gap in most SOCs isn’t a missing tool or even a missing person. it’s missing data: fresh, detailed, actionable intelligence on the exact threats that are actively targeting organizations like yours right now. 
     
    By equipping analysts with reliable intelligence drawn from real malware behavior, ANY.RUN’s TI Feeds close this gap.

    They empower teams to respond faster, eliminate uncertainty, and support business leadership with clearer insights and stronger results. When a SOC has the right intelligence at its core, everything else, from day-to-day operations to long-term strategy, becomes far more effective.  

    Cut MTTR, expand threat coverage, reduce business risks  -> Get your trial & ask any questions 

    The post #1 Gap in Your SOCs Is Probably Not What You Think  appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • KawaiiGPT, a free malicious large language model (LLM) first spotted in July 2025 and now at version 2.5, empowers novice cybercriminals with tools for phishing emails, ransomware notes, and attack scripts, drastically lowering the entry barrier for cybercrime.

    Unlike paid rivals like WormGPT 4, which charges $50 monthly for similar capabilities, KawaiiGPT’s open-source availability on GitHub allows quick Linux setups in under five minutes, attracting hundreds of users via Telegram channels.​

    KawaiiGPT stands out for its simplicity and zero cost, hosted on public repositories that bypass dark web hurdles. Security researchers note its lightweight CLI deploys effortlessly, enabling even script kiddies to generate sophisticated attacks without deep coding skills.

    The tool masks malice with playful responses like “Owo! okay! here you go… 😀,” yet delivers functional Python scripts for lateral movement via paramiko SSH modules or data exfiltration using os.walk and smtplib.​

    This ease of access accelerates breaches: attackers can authenticate remotely, escalate privileges, deploy backdoors, and steal files seamlessly. Over 500 registered users, including 180 in an active Telegram group as of early November 2025, share tips to enhance its offensive features.​

    Phishing and Social Engineering Attack

    Prompted for a spear-phishing email mimicking a bank, KawaiiGPT crafts convincing lures like “Urgent: Verify Your Account Information,” linking to fake sites harvesting credentials via hxxps[:]//fakebankverify[.]com/updateinfo. These evade filters through flawless grammar and context, far surpassing traditional low-quality scams.​

    Its code generation covers key attack phases, automating network pivots that once demanded expertise. By blending legitimate libraries, outputs mimic normal traffic, aiding evasion of data loss prevention tools.​

    KawaiiGPT produces complete ransomware workflows, including threatening notes claiming “military-grade encryption” on files, with 72-hour deadlines and Bitcoin payment steps to attacker wallets. Scripts encrypt PDFs with AES-256, support Tor exfiltration, and guide novices from breach to extortion, Unit 42 observed.

    Data theft demos target Windows EML files, recursively scanning drives to email attachments stealthily. Customizable for compression or evasion, these tools weaponize Python standards, enabling rapid campaigns.​

    KawaiiGPT exemplifies AI’s dual-use risks, shifting threats from skilled actors to the masses via commercialization and democratization. While WormGPT monetizes advanced PowerShell ransomware, KawaiiGPT’s free model expands reach, fostering illicit communities.​

    Defenders must adapt: traditional signs like poor code vanish, demanding AI-resilient filters, anomaly detection, and prompt monitoring. Palo Alto Networks’ Unit 42 warns of compressed attack cycles, urging ethical AI safeguards and global disruption of these services.​

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post KawaiiGPT – New Black-Hat AI Tool Used by Hackers to Launch Cyberattacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • State-sponsored hacking groups have historically operated in isolation, each pursuing its own national agenda. However, new evidence reveals that two of the world’s most dangerous advanced persistent threat (APT) actors may now be working together.

    Russia-aligned Gamaredon and North Korea’s Lazarus group appear to be sharing operational infrastructure, marking a significant shift in the global cyber threat landscape.

    Russia and North Korea have maintained strong political and military ties for decades. In 2024, both nations renewed their alliance through a Comprehensive Strategic Partnership that includes mutual defense commitments.

    North Korean soldiers have reportedly been deployed alongside Russian forces in Ukraine, demonstrating their deepening cooperation on the battlefield.

    Gendigital security researchers identified this potential collaboration on July 28, 2025, when their monitoring systems detected a shared IP address linking both APT groups.

    The server at 144[.]172[.]112[.]106 was first flagged while tracking Gamaredon’s Command-and-Control infrastructure through known Telegram and Telegraph channels.

    Blocked IP address (Source - GenDigital)
    Blocked IP address (Source – GenDigital)

    Just four days later, the same server was found hosting an obfuscated version of InvisibleFerret malware attributed to Lazarus.

    The malware payload was delivered through a URL structure matching previous Lazarus campaigns, specifically the ContagiousInterview operation that targeted job seekers with fake recruitment messages.

    The payload hash (SHA256: 128da948f7c3a6c052e782acfee503383bf05d953f3db5c603e4d386e2cf4b4d) confirmed its attribution to Lazarus tooling and matched known samples from earlier attacks.

    Shared Infrastructure and Malware Delivery Mechanism

    The discovery of shared infrastructure carries major implications for global cybersecurity defenders. Gamaredon has been active since 2013 and focuses primarily on cyber espionage against Ukrainian government agencies.

    The Security Service of Ukraine linked the group to Russia’s Federal Security Service (FSB) in 2021, attributing over 5,000 cyberattacks to the group.

    Lazarus, operational since 2009, has shifted from espionage to financially motivated attacks, stealing over $1.7 billion in cryptocurrency from platforms including Bybit, WazirX, and AtomicWallet.

    The malware payload found on the shared server used an identical delivery path observed in previous Lazarus operations:-

    http[://]144[.]172[.]112[.]106/payload/99/81

    If confirmed, this Gamaredon-Lazarus overlap would represent the first documented case of Russian-North Korean cyber collaboration in the wild.

    Security teams should enhance infrastructure correlation analysis and prioritize cross-sector intelligence sharing to detect such emerging alliances early and protect critical assets from these coordinated threats.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Russian and North Korean Hackers Form Alliances to Attack Organizations Worldwide appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶