Explore

Trendline Trendline
Itron Discloses Cyber-Attack, Ensures Continued Operations

Itron Discloses Cyber-Attack, Ensures Continued Operations

Itron Discloses Cyber-Attack, Ensures Continued Operations
Trendline Trendline
Itron Investigates Cybersecurity Breach, Operations Remain Unaffected

Itron Investigates Cybersecurity Breach, Operations Remain Unaffected

Itron Investigates Cybersecurity Breach, Operations Remain Unaffected
Trendline Trendline
Itron Investigates Cybersecurity Breach Affecting Its Systems

Itron Investigates Cybersecurity Breach Affecting Its Systems

Itron Investigates Cybersecurity Breach Affecting Its Systems
Rapid Read Rapid Read
Firestarter Malware Persists Despite Cisco Firewall Patches

Firestarter Malware Persists Despite Cisco Firewall Patches

The Firestarter malware, associated with the ArcaneDoor threat actor, has been found to persist in Cisco's Firepower and Secure Firewall devices despite security patches released in September last year. This malware, identified as a Linux binary, embeds itself in the Firepower eXtensible Operating System (FXOS) base layer, surviving device reboots and evading detection. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the UK's National Cyber Security Centre (NCSC) have issued alerts, advising organizations to follow emergency directives, including physically disconnecting affected firewalls to disrupt the malware's persistence.
Rapid Read Rapid Read
Chinese National Extradited to U.S. for Alleged Silk Typhoon Cyber Attacks on 13,000 Organizations

Chinese National Extradited to U.S. for Alleged Silk Typhoon Cyber Attacks on 13,000 Organizations

A Chinese national, Xu Zewei, has been extradited from Italy to the United States to face charges related to a series of cyber attacks during the pandemic. These attacks, allegedly orchestrated by China's intelligence services, targeted over 13,000 U.S. organizations, including those involved in COVID-19 research. Xu and his co-conspirators are accused of exploiting vulnerabilities in Microsoft Exchange Server to steal sensitive information. The attacks were part of a broader espionage campaign known as HAFNIUM, which targeted various sectors such as infectious disease experts, law firms, and defense contractors. Xu was arrested in Milan at the request of U.S. authorities and is now held in a federal prison in Houston.
Rapid Read Rapid Read
Former Ransomware Negotiator Admits to Aiding Cybercriminals in Extortion Scheme

Former Ransomware Negotiator Admits to Aiding Cybercriminals in Extortion Scheme

A former ransomware negotiator has pleaded guilty to aiding a ransomware group in extorting tens of millions of dollars from companies. The individual, Martino, was involved in providing the ransomware group with sensitive information, such as companies' insurance policy limits and internal negotiation positions, in exchange for a share of the profits. This information was used to facilitate the ransomware attacks, which included the deployment of Blackcat ransomware against multiple U.S. victims between April and November 2023. Law enforcement has seized $10 million in assets from Martino, including digital currency and luxury items. The case highlights the betrayal of trust by Martino, who was employed by the cybersecurity firm DigitalMint, and his collaboration with two other individuals, Ryan Goldberg and Kevin Martin, in the extortion scheme.
Rapid Read Rapid Read
Chinese Hacker Extradited to U.S. for Alleged Cyberattacks on American Institutions

Chinese Hacker Extradited to U.S. for Alleged Cyberattacks on American Institutions

Xu Zewei, accused of conducting cyberattacks on behalf of the Chinese government, has been extradited to the United States. The U.S. Justice Department alleges that Xu, working as a contractor for the Chinese Ministry of State Security, targeted U.S. universities to steal COVID-19 research and hacked Microsoft Exchange servers. These attacks were part of a broader campaign attributed to the Chinese-backed hacking group Hafnium. Xu's extradition follows his arrest in Italy and marks a significant step in the U.S. government's efforts to hold foreign hackers accountable.
Discover daily Discover daily
On This Day, Captain Midnight Hijacked HBO’s Signal

On This Day, Captain Midnight Hijacked HBO’s Signal

On April 27, 1986, a significant event unfolded in the world of satellite broadcasting that would lead to lasting changes in security and legislati...
Rapid Read Rapid Read
Cisco Confirms 'Firestarter' Malware Persists Despite Firewall Patches, Urges Hard Reboot

Cisco Confirms 'Firestarter' Malware Persists Despite Firewall Patches, Urges Hard Reboot

Cisco has acknowledged that the 'Firestarter' malware, deployed by the ArcaneDoor threat actor, remains active despite security patches released in September last year. This malware affects the Firepower and Secure Firewall devices by embedding itself as a Linux binary in the Firepower eXtensible Operating System (FXOS). It survives device reboots by copying itself to a log directory and manipulating the storage mount list. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Britain's National Cyber Security Centre (NCSC) have named the malware 'Firestarter'. CISA advises organizations to perform a hard reboot by unplugging the devices to disrupt the malware's persistence routine.
Trendline Trendline
Driven Brands Faces Class Action Lawsuit Over Alleged Financial Misrepresentations

Driven Brands Faces Class Action Lawsuit Over Alleged Financial Misrepresentations

Driven Brands Faces Class Action Lawsuit Over Alleged Financial Misrepresentations
Rapid Read Rapid Read
FIRESTARTER Backdoor Compromises Federal Cisco Device, Survives Security Patches

FIRESTARTER Backdoor Compromises Federal Cisco Device, Survives Security Patches

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has disclosed a security breach involving a federal civilian agency's Cisco Firepower device. The device, running Adaptive Security Appliance (ASA) software, was compromised by malware known as FIRESTARTER in September 2025. This backdoor malware allows remote access and control, and was deployed by an advanced persistent threat (APT) actor exploiting now-patched vulnerabilities in Cisco's ASA firmware. Despite security patches, FIRESTARTER persists on affected devices, maintaining access for threat actors. The malware's resilience is attributed to its ability to survive firmware updates and device reboots, unless a hard power cycle is performed. The breach highlights ongoing cybersecurity challenges in protecting critical infrastructure from sophisticated cyber threats.
Rapid Read Rapid Read
US Federal Agency's Cisco Firewall Compromised by 'Firestarter' Backdoor

US Federal Agency's Cisco Firewall Compromised by 'Firestarter' Backdoor

A U.S. federal agency has been compromised by the 'Firestarter' backdoor, part of a China-linked espionage campaign targeting Cisco firewalls. The campaign, known as ArcaneDoor, exploited vulnerabilities in Cisco's Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Despite patches issued by Cisco, the malware persists, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to issue an updated directive. Federal agencies are required to check for infections and apply necessary patches by April 24, 2026. The Firestarter backdoor allows attackers remote access and control, posing a significant threat to national security.