VulnHub

Cofense researchers have identified a new tactic employed by the Global Group ransomware gang that targets large enterprises. The group uses payment-themed phishing emails to lure victims into downloading malicious ISO files. Once these files are executed, they deploy WinMerge, a legitimate file comparison tool, to facilitate the encryption of files on the victim's system. This technique allows attackers to bypass some security measures, making detection more difficult. The implications of this attack are significant, as it highlights the evolving methods ransomware groups are using to infiltrate corporate environments and extort money from organizations.

Cisco has issued a warning about a critical zero-day vulnerability affecting its Catalyst SD-WAN Manager, which is used by companies to oversee their SD-WAN networks. The flaw, identified as CVE-2026-76504, allows remote attackers to exploit the system's API without needing any login credentials, essentially granting them admin-level access. This poses a significant risk to organizations using this management software, as it could lead to unauthorized control and potential data breaches. Cisco has released patches to fix the issue, but there are no workarounds available for users who need immediate protection. Companies are urged to apply the fixes as soon as possible to mitigate the risk of exploitation.

A Russian advanced persistent threat group, known as Star Blizzard, has shifted its tactics by introducing a new method called 'RedFlick.' This approach targets Ukrainian-linked organizations, including NGOs, think tanks, and journalists, to deploy a malicious backdoor known as CosmicPulse. This change in strategy allows attackers to expand their phishing efforts, increasing the risk for individuals and organizations connected to Ukraine. The move is particularly concerning given the ongoing conflict and the vulnerability of these groups to cyber attacks. As this situation develops, it is crucial for affected parties to remain vigilant against potential phishing attempts and other cyber threats.

Cybercriminals are exploiting ChatGPT's Custom GPTs feature to trick users into visiting harmful websites. These sites use ClickFix lures to deliver Remote Access Trojans (RATs), which can take control of victims' devices. This tactic was observed by Huntress in late September 2026 and represents a concerning trend where trusted AI platforms are manipulated to spread malware. Users who interact with these malicious GPTs may unknowingly expose their systems to significant risks. This incident serves as a reminder for individuals and organizations to be cautious when engaging with AI-driven tools and to verify the legitimacy of any offerings before clicking links.

Security firms have detected ongoing exploitation of two vulnerabilities in NetScaler, identified as CVE-2026-88771 and CVE-2026-88772. These vulnerabilities have been particularly targeted at government and financial organizations over the past few weeks. The active exploitation of these zero-day vulnerabilities poses significant risks, as attackers could potentially gain unauthorized access to sensitive data and systems. Organizations using affected NetScaler products need to take immediate action to safeguard their networks. It’s crucial for IT departments to stay vigilant and implement necessary security measures to mitigate these risks.

A recent study by Swimlane indicates that while artificial intelligence is helping Security Operations Center (SOC) teams by automating repetitive tasks, there are concerns among analysts about the potential negative impact on their career growth. Many SOC professionals feel that reliance on AI could limit their opportunities to develop essential skills, which are critical for advancing in their roles. This situation raises questions about the balance between efficiency and the need for continuous learning in cybersecurity. As organizations increasingly adopt AI tools, it’s important for them to consider how to support their teams in maintaining and enhancing their skill sets. The study suggests that while AI can improve productivity, it shouldn't replace the foundational knowledge and experience that SOC analysts need to thrive.

As businesses increasingly rely on web browsers for their applications, the risks associated with browser-based attacks are growing. A recent article outlines six dangerous attack techniques that security teams need to be aware of in 2026. These attacks typically start and remain within the browser, making them particularly challenging to detect and mitigate. This trend emphasizes the importance of robust browser security measures for organizations, as attackers are exploiting vulnerabilities in this critical area. Companies need to prioritize user training and implement advanced security solutions to protect against these evolving threats.

Bitget, a cryptocurrency exchange, reported a significant security breach where attackers stole $387.5 million by exploiting a zero-day vulnerability in third-party security products. This incident raises serious concerns about the reliability of third-party security solutions, especially in the cryptocurrency sector where security is paramount. The breach underscores the importance of continuous monitoring and updating of security systems to prevent similar attacks. Users and investors need to be aware of the potential risks associated with using exchanges that may be vulnerable to such exploits. This incident serves as a stark reminder of the evolving tactics employed by cybercriminals and the need for robust security measures in digital finance.

The Water Information Sharing and Analysis Center (WaterISAC) is closely monitoring various cybersecurity threats facing the water sector following a series of attacks over the summer. Key vulnerabilities include internet-exposed technology, programmable logic controllers (PLCs), and the involvement of external integrators, which could compromise internal protections. These factors raise concerns about the security of water systems that are critical for public health and safety. As cyberattacks become more sophisticated, it is vital for organizations in the water sector to enhance their defenses and ensure that their systems are protected against potential intrusions. This ongoing vigilance is crucial to prevent disruptions in water services and maintain the integrity of vital infrastructure.