MITRE releases a shared fraud-cyber framework built from real attack data

Help Net Security

April 13, 2026 at 5:00 AM

Overview

MITRE has introduced a new framework called the Fight Fraud Framework (F3) to combat financial fraud, which has surged in the U.S. from $4.2 billion in losses in 2020 to $16.6 billion in 2024. Historically, fraud investigators and cybersecurity analysts have worked in silos, using different tools and approaches to tackle fraud, which has contributed to the growing issue. The F3 aims to bridge this gap by providing a common structure that allows both teams to better understand and describe fraud behaviors. This initiative is crucial as it seeks to unify efforts against financial fraud, making it easier for organizations to respond effectively. With financial fraud on the rise, the framework could help reduce losses and improve collaboration among teams tasked with preventing these crimes.

Key Takeaways

Timeline: Newly disclosed

Original Article Summary

Financial fraud losses in the United States reached $16.6 billion in 2024, up from $4.2 billion in 2020. Behind those numbers is a structural problem: the teams responsible for stopping fraud, fraud investigators and cybersecurity analysts, have historically operated separately, using different tools, different terminology, and different mental models of how attacks unfold. The MITRE Fight Fraud Framework, known as F3, is a behavior-based model designed to give both teams a common structure for describing, … More → The post MITRE releases a shared fraud-cyber framework built from real attack data appeared first on Help Net Security.

Impact

Not specified

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Newly disclosed

Remediation

Not specified

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

Iran-Linked Hackers Target US Aviation with Phishing and SEO Poisoning Campaign

Infosecurity Magazine

Iranian hackers, known as Nimbus Manticore, have launched a campaign targeting U.S. aviation through phishing attacks and SEO poisoning. They are distributing a malicious backdoor called MiniFast, which is designed to exploit vulnerabilities in systems related to aviation. This campaign poses a significant risk to the aviation sector, as it could potentially allow attackers to gain unauthorized access to sensitive information and disrupt operations. The use of AI to create the MiniFast backdoor indicates a sophisticated approach to cyberattacks, raising concerns about the evolving tactics of state-sponsored hacking groups. Companies in the aviation industry need to be vigilant and enhance their cybersecurity measures to protect against such threats.

May 26, 2026

CISA orders feds to patch actively exploited Drupal vulnerability

BleepingComputer

The Cybersecurity and Infrastructure Security Agency (CISA) has mandated that U.S. government agencies address a critical SQL injection vulnerability in the Drupal content management system by Wednesday evening. This vulnerability, which has been flagged as actively exploited, poses a significant risk to the security of servers running Drupal. Government organizations must act swiftly to protect their systems from potential attacks that could exploit this weakness. The urgency of this directive highlights the ongoing challenges faced by agencies in maintaining secure web platforms, especially as attackers increasingly target widely used software like Drupal. Ensuring that these systems are patched is essential to safeguard sensitive data and maintain operational integrity.

May 26, 2026

Anthropic’s restricted Claude Mythos model may be coming to Claude Code

BleepingComputer

Anthropic is reportedly getting ready to release its Mythos model, which was initially announced in April as a restricted version due to its potential security risks. This model poses significant threats to both private and public software, raising concerns among developers and users about its implications for security. The rollout of such a model could lead to vulnerabilities being exploited if not properly managed. As the technology moves closer to public availability, it’s crucial for stakeholders to understand the risks and prepare accordingly. The situation emphasizes the need for careful consideration in how AI models are deployed, especially those that can impact software security.

May 25, 2026

FBI Chief Kash Patel’s Clothing Store Hacked in ClickFix Infostealer Attack

Hackread – Cybersecurity News, Data Breaches, AI and More

FBI Chief Kash Patel's clothing store fell victim to a ClickFix infostealer attack, which specifically targeted macOS users. The hackers tricked these users into downloading malware that steals sensitive information. This incident raises concerns not only for Patel as a public figure but also for the broader implications of malware targeting retail platforms. Such attacks can lead to significant data breaches, impacting customer trust and potentially leading to financial losses. Users of the compromised store should be vigilant about their personal data and consider reviewing their security measures to prevent similar threats in the future.

May 25, 2026

Ghost CMS Vulnerability Exploited to Hack Over 700 Websites

SecurityWeek

A vulnerability in the Ghost Content Management System (CMS) has been exploited, leading to the hacking of over 700 websites, including those of prestigious institutions like Harvard and Oxford, as well as the search engine DuckDuckGo. This breach highlights the risks associated with using outdated or unpatched software, as attackers were able to take advantage of security flaws to gain unauthorized access. The incident raises concerns about the personal data and sensitive information that could be exposed on these compromised sites. Organizations using Ghost CMS need to ensure they are running the latest version and apply any available patches to protect their websites from similar attacks in the future.

May 25, 2026

Authorities seize 800 servers used for cyberattacks and disinformation

Help Net Security

Dutch authorities have arrested two men and confiscated 800 servers believed to be involved in cyberattacks and disinformation campaigns linked to Russian activities. The arrests took place in Amsterdam and The Hague, with the suspects facing charges for violating Dutch sanctions laws. These servers were reportedly used to undermine democratic processes and disrupt both public and economic systems. The operation is part of a broader effort to combat cyber threats that target national security and public trust. This incident underscores the ongoing battle against malicious cyber activities that seek to destabilize governments and influence public opinion.

May 25, 2026