Search: “360 Total Security”

6 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 55 Vulnerability 37 Ransomware 15 Data breach 13 Industry 9 Exploit / PoC 8 Policy & legal 8 Threat actor 6 Phishing & fraud 6 Advisory 1 AI tools & infra 1 AI research 1 Research 1 AI safety & security 1

SeverityAll critical 63 high 54 medium 29 low 14 info 2

Mustang Panda Upgrades CoolClient With a Kernel Rootkit

Mustang Panda's updated CoolClient backdoor deploys a signed kernel driver to hide processes, files and network activity in Asian intrusions.

Kaspersky analysis shows Mustang Panda (HoneyMyte) upgraded its CoolClient espionage backdoor with a signed kernel-mode driver installed as a Windows service, communicating via IOCTL requests to hide processes, files and registry entries. In a Myanmar campaign the actor deployed PlugX first, then CoolClient via a fake Windows Defender directory and Sangfor defender.exe DLL sideloading, with scheduled task and AutoRun persistence and UAC bypass. The updated variant was observed in intrusions across Pakistan, Mongolia and Myanmar, with victims also in Russia including confirmed government entities.

Security AffairsAug 16, 17:18 UTC · Aug 16, 2026Threat actor in the wild1

Threat actor abuses Genshin Impact Anti

Security AffairsAug 27, 07:06 UTC · Aug 27, 2022Threat actor

Cuba clamps down on social media and internet access as protests spread

The RecordDec 13, 00:00 UTC · Dec 13, 2022Threat actor

⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.

The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.

The Hacker NewsAug 28, 08:05 UTC · 20d agoThreat actor in the wildCVE-2026-194781

Can Enterprises execute a GRC Movement?

Security AffairsFeb 3, 17:10 UTC · Feb 3, 2019Threat actor

US-China AI Gap: 2025 Analysis of Model Performance, Investment, and Innovation

Recorded FutureAug 22, 00:00 UTC · Aug 22, 2025Threat actor