Sebastion

Intelligence · Updated daily

Security Intelligence

AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.

RSS feedCVE index906 entries
VulnerabilitiesMalwareCampaignsSupply ChainPolicyTools

Page 22 of 37

526–550 of 906
highCampaignResolved

Gentlemen ransomware gang escalates infrastructure through SystemBC botnet integration

Gentlemen ransomware operators have integrated SystemBC proxy malware into their attack chain, leveraging a botnet of over 1,570 corporate hosts to obfuscate command-and-control communications and expand operational resilience. This represents a maturation of the gang's infrastructure and signals they are adopting commodity malware to increase attack surface.

Corporate networks (estimated 1,570+ victims)
highSupply ChainResolved

Vercel breach exposes developer infrastructure at scale: supply-chain risk for thousands of deployed applications

Vercel, a major cloud deployment platform used by thousands of companies, has confirmed a security incident with threat actors claiming to possess stolen data and attempting to sell it. This represents a significant supply-chain risk given Vercel's position in the modern development workflow and the potential scope of compromised customer environments.

Vercel
criticalPolicyResolved

Non-human Identity Sprawl: The Unmonitored Credential Crisis Behind 68% of Cloud Breaches

Unmanaged service accounts, API keys, and orphaned credentials represent the largest attack surface in cloud environments, with compromised non-human identities responsible for nearly 7 in 10 cloud breaches in 2024. Organisations typically lack visibility into 40-50 automated credentials per employee that persist after project termination or staff departure.

Enterprise cloud deployments across AWS, Azure, GCP
informationalToolResolved

NAKIVO v11.2 Adds Ransomware Defenses as Backup Vendors Race to Harden Against Attack Surface Expansion

NAKIVO released v11.2 with enhanced ransomware detection capabilities, faster replication, and support for vSphere 9 and Proxmox VE 9.0. This reflects the broader industry trend of backup vendors integrating proactive threat detection as ransomware operators increasingly target backup infrastructure.

NAKIVO Backup & Replication, VMware vSphere environments, Proxmox VE deployments
criticalVulnerabilityResolved

Protobuf.js RCE via PoC Publication: Supply Chain Risk for JavaScript Ecosystems

A critical remote code execution flaw in protobuf.js has been exploited with published proof-of-concept code, enabling arbitrary JavaScript execution in applications using this widely-deployed serialisation library. This poses immediate risk to any Node.js or browser-based system consuming untrusted Protocol Buffer messages.

protobuf.js, JavaScript applications, Node.js services +1
highCampaignResolved

MSP sector faces escalating phishing-driven attacks; incident response strategies lag behind threat evolution

Phishing remains the primary attack vector for most cybercriminals, and managed service providers are struggling to implement integrated security and recovery strategies proportionate to current threat velocity. MSPs must evolve beyond reactive patching to include workable incident response and business continuity frameworks.

Managed Service Providers (MSPs), Corporate clients of MSPs
highCampaignResolved

Underground Carding Networks Standardise Vendor Vetting: Operationalising Trust in Stolen Payment Data Markets

Cybercrime forums now circulate structured guides teaching threat actors how to evaluate carding shops through data quality metrics, seller reputation scoring, and shop longevity assessment. This professionalisation of underground marketplaces reduces friction in stolen payment data transactions and increases the operational security of organised crime networks.

Payment card holders, Financial institutions, Carding shop operators
highMalwareResolved

Payouts King ransomware weaponises QEMU hypervisor for blind-spot evasion

Payouts King ransomware operators are deploying QEMU virtual machines as covert execution containers, using reverse SSH tunnels to maintain hidden command channels that bypass endpoint detection and response tools. This represents a maturation of VM-based evasion tactics in ransomware operations.

Systems running endpoint detection and response (EDR) solutions, Windows hosts with QEMU installation capability
informationalToolResolved

Google deploys Gemini to raise the cost of ad fraud, but adversary adaptation remains the defining challenge

Google is expanding its use of Gemini AI models to detect and block malicious ads across its advertising platforms as threat actors refine evasion techniques. This represents an incremental defensive improvement in an ongoing arms race rather than a structural shift in ad ecosystem security.

Google Ads, Google Display Network, Google advertising platforms
criticalSupply ChainResolved

Marimo notebook vulnerability weaponised for malware distribution via Hugging Face trusted infrastructure

Attackers exploited a flaw in Marimo (a reactive Python notebook framework) to execute arbitrary code and deploy NKAbuse malware variants through Hugging Face Spaces, a platform trusted by ML researchers and developers. This represents a supply-chain attack exploiting both a software vulnerability and the trust model of a widely-used ML hosting platform.

Marimo, Hugging Face Spaces, Python notebook users