ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “sanctions”

61 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllPolicy & legal 28Industry 11Threat actor 11Data breach 3Exploit / PoC 3Phishing & fraud 2Tools 2Vulnerability 1Research 1Advisory 1
SeverityAllcritical 1high 11medium 10low 0info 41

Treasury sanctions alleged Iranian hackers as part of ‘economic D

US Treasury sanctioned four Iranians linked to MOIS-directed hacks that compromised and exfiltrated data from US critical infrastructure, energy, defense, and financial targets.

The Treasury Department designated four Iranian individuals over alleged hacking and cybertheft against US companies in energy, defense, healthcare, IT, and financial sectors since at least late 2023, as part of an 'economic D-Day' sanctions package. It is the second action in weeks against the group, following an indictment of cybercriminals affiliated with Tehran's Mabna Institute; leadership includes Behzad Mesri, first sanctioned in 2018, and the attacks are described as directed by the Ministry of Intelligence and Security (MOIS). Treasury also expanded secondary-sanction categories across digital assets, technology, gold, aviation, and shipping, and noted some group members pursued personal enrichment, including targeting Iranian companies.

CyberScoop · 22d agoPolicy & legal

U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches

U.S. Treasury sanctioned nearly 60 Iran-linked entities, including MOIS-affiliated Mabna Institute hackers behind breaches of U.S. critical infrastructure and millions in crypto theft.

The U.S. Treasury launched Operation Economic Outcast, designating nearly 60 Iran-linked entities, individuals, and vessels across nuclear, missile, oil, cyber, and digital asset networks. Five sanctioned individuals are members of the Tehran-based Mabna Institute indicted last week; three allegedly breached and exfiltrated data from U.S. energy, defense, healthcare, IT, and financial organizations since late 2023. TRM Labs traced roughly $16.8 million across 30 wallets tied to the members, and the State Department announced a reward of up to $10 million. The action follows Iranian hacking of FBI Director Kash Patel's email and attacks on over 30 U.S. water and wastewater utilities.

The Hacker News · 22d agoPolicy & legal in the wild

OFAC Sanctions Chinese Scam Platform Xinbi Guarantee

US Treasury's OFAC sanctioned Chinese scam-platform Xinbi Guarantee, which processed $24bn+, and froze $52.8m in linked cryptoassets.

OFAC sanctioned Xinbi Guarantee, a Chinese-language marketplace connecting Southeast Asian scam centers and transnational crime syndicates to merchants offering financial services, technology and crypto exchange. Treasury estimates over $24bn processed since 2022, while TRM Labs estimates over $36bn, with daily inflows nearly doubling between May and December 2025. Two supporting entities were also sanctioned: SafeW Technology (Singapore) and Anwen Technology (Cambodia, maker of XinbiPay). The US Secret Service and Elliptic froze $52.8m in linked cryptoassets, and the marketplace now appears offline with its Telegram channels deleted.

Infosecurity Magazine · 7d agoPolicy & legal1

US sanctions Iranian cyber actors as UK discloses power plant attack

US Treasury sanctioned six Iranian MOIS-linked hackers for breaching US agency and UN email accounts as the UK disclosed a four-day power plant shutdown.

The US Treasury sanctioned at least six Iranian nationals tied to a hacking team inside Iran's Ministry of Intelligence and Security (MOIS) active since 2023; four were indicted last week for breaching employee email accounts at the Department of Labor, the Federal Energy Regulatory Commission and United Nations organizations. Treasury said the group compromised energy, defense, healthcare, IT and financial sector targets, multiple US government offices in summer 2024, and stole cryptocurrency for personal gain. Separately, Iranian actors reportedly shut down a small British power plant for four days without grid impact, days after FBI and NSA warned of hackers targeting programmable logic controllers in energy, water and agriculture.

The Record · 23d agoThreat actor in the wild

Hackers target Ukrainian agency managing assets seized from sanctioned Russians

Ukraine's ARMA asset agency reported a cyberattack amid selecting a manager for seized IDS Ukraine assets linked to sanctioned Russians.

Ukraine's Asset Recovery and Management Agency (ARMA), which manages assets seized from criminals and sanctioned individuals, said Tuesday it had been targeted by a cyberattack, with the SBU investigating. The attack coincided with preparations to select a manager for seized corporate rights in IDS Ukraine, a major beverage producer seized in late 2022 from Russian shareholders including sanctioned billionaire Mikhail Fridman. ARMA reported other suspected interference since spring, including unauthorized access to an internal database of agency officials, but did not attribute the attack or release technical details. In April, ARMA employees were targeted in a cyberespionage campaign attributed to Russia-linked APT28, which failed to penetrate internal systems.

The Record · 29d agoData breach

Lawmakers call on Treasury to sanction hackers-for-hire

Bipartisan US lawmakers asked Treasury to sanction three India-based hack-for-hire firms accused of long-running espionage against Americans.

Sens. Ron Wyden and Sheldon Whitehouse and Rep. Pat Harrigan urged Treasury to add Sunkissed Organic Farms (formerly Appin), BellTroX, and CyberRoot to the Entity List. The letter says the mercenary groups conducted targeted espionage against US citizens, businesses, and lawyers for over fifteen years, allegedly including work for Qatar's government such as targeting opponents of Qatar's World Cup bid and Kristi Rogers, wife of Senate candidate Mike Rogers. Adding the firms to the Entity List would restrict their access to American software, cybersecurity tools, and cloud infrastructure. The lawmakers also accuse the groups of lawfare campaigns to censor investigative reporting on their hacking activities.

CyberScoop · 7d agoThreat actor in the wild

US Sanctions Mabna Institute Hackers for Iranian Cyber-Attacks

US sanctions individuals tied to Iranian hacking-for-hire group the Mabna Institute over cyber-attacks.

The United States has imposed sanctions on individuals connected to the Mabna Institute, an Iran-based hacking-for-hire group. The move targets the actors behind Iranian cyber-attack operations. Sanctions are a government enforcement action rather than a new technical threat.

Infosecurity Magazine · 23d agoPolicy & legal

Top 10 Best Cloud Access Security Broker (CASB) Solutions in 2026

2026 CASB guide ranks Netskope first for depth and Microsoft Defender for Cloud Apps for Microsoft estates, as standalone CASB fades into SSE.

Buyer's guide covers ten CASB products across four enforcement modes: API, forward proxy, reverse proxy and log-based discovery. Netskope leads on SaaS activity context depth, while Microsoft Defender for Cloud Apps wins on Microsoft 365 E5 estate economics. The guide argues standalone CASB purchases have largely disappeared into SSE platforms and increasingly overlap with SSPM.

Cyber Security News · 2d agoTools

Iranian banks' SSL certificates are being revoked due to OFAC sanctions

OFAC sanctions are reportedly causing Iranian banks' SSL certificates to be revoked, threatening secure HTTPS access to their services.

A Hacker News discussion highlights a report that Iranian banks' SSL/TLS certificates are being revoked as a consequence of OFAC sanctions. Certificate revocation would degrade or break trusted HTTPS connections to affected banking domains for users in Iran. The item is a headline-only discussion post with limited detail on which certificate authorities or banks are affected.

Hacker News · security · 2d agoPolicy & legalHN 23↑ · 6 comments

US disrupts Xinbi Guarantee marketplace fueling the cyber scam economy

US Treasury sanctions and DOJ seizures take down Xinbi Guarantee, a Telegram marketplace that processed $24B+ for cyber scams, freezing $52.8M.

The Treasury Department sanctioned the Chinese-language Telegram marketplace Xinbi Guarantee and two supporting firms, Anwen Technology (XinbiPay) and SafeW Technology, while the DOJ seized its Telegram channels and $52.8 million in USDT from 52 wallets. Blockchain intelligence firm Elliptic, which assisted the Secret Service, estimates Xinbi has processed at least $24 billion in transactions since 2022, making it the second-largest illicit online marketplace and a cornerstone of Southeast Asian cybercrime. Vendors sold money laundering, stolen personal data, deepfake technology, and other services for pig-butchering scams, with payments in Tether's USDT. The DOJ's Scam Center Task Force also dismantled 13 scam centers in Madagascar, arresting dozens of alleged leaders who were repatriated to China.

The Record · 7d agoPolicy & legal

Risky Bulletin: Dutch intel services to get extensive new powers

Netherlands proposed a bill granting AIVD and MIVD expanded warrantless tapping, faster hacking powers, and forced data disclosure, citing Russia, China, and Iran threats.

The Dutch government introduced a bill greatly expanding surveillance powers of intelligence agencies AIVD and MIVD, allowing up to one year of tapping without pre-approval and simplified hacking operations against 'foreign adversaries'. Agencies could compel Dutch companies or citizens to provide data under threat of charges, share data with the private sector, and oversight bodies would merge into a new CTT board. The bill follows similar overhauls in Ireland, Germany, and France after Russia's invasion of Ukraine. The newsletter also reports Moonwell hacked for $8.7M, a Cosmos EVM bug exploited for ~$3M, ShinyHunters listing McKesson with claimed hundreds of millions of records, and a pro-Kremlin DDoS claim against Norway's government network.

Risky Business News · 17d agoPolicy & legal

Norway announces investigations into telecom Telenor’s work with Myanmar junta

Norwegian police opened crimes-against-humanity and sanctions investigations into Telenor's data handovers to Myanmar's junta, raiding its Oslo headquarters.

Norway's National Criminal Investigation Service is investigating Telenor for complicity in crimes against humanity for repeatedly handing over historical customer traffic data to Myanmar's military regime between the February 2021 coup and the March 2022 subsidiary sale. The Police Security Service is separately probing sanctions violations because the sale to M1 Group included sanctioned surveillance equipment transferred without foreign ministry permission. The subsequent resale passed historical call data of over 18 million people to junta-linked owners, and a class action on behalf of 1,200 people alleges the data enabled arrests, torture, and at least one execution.

The Record · 1d agoPolicy & legal

U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto

US DOJ and Treasury disrupt Xinbi Guarantee Telegram scam marketplace, sanctioning it and freezing $52.8M in USDT across 52 wallets.

The DOJ seized Xinbi Guarantee's Telegram channels and cryptocurrency wallets while OFAC sanctioned the marketplace, freezing $52.8 million in USDT from 52 wallets and bringing the Scam Center Strike Force's total restrained funds to roughly $938 million. Elliptic, which worked with the Secret Service, estimates Xinbi has processed $30 billion in transactions since around 2022, serving pig-butchering scam operators and links to North Korean hackers, Jin Bei Group, and Prince Group TCO. The strike force dismantled 13 scam compounds in Madagascar, seizing over 3,200 devices and interviewing roughly 400 arrestees, with about 30 Chinese compound leaders repatriated to China. After Tether froze funds, Xinbi began converting remaining USDT into the USDD stablecoin.

The Hacker News · 7d agoPolicy & legal

Italian tech collective Autistici/Inventati shuts down after US terrorist designation

Italian privacy collective Autistici/Inventati shut down after a US State Department terrorist designation triggered its domain suspension and bank account closure.

The volunteer-run Italian collective Autistici/Inventati, founded in 2001, announced Sunday it would shut down after the State Department labeled it an extremist group on August 26, 2026. The designation led the Public Interest Registry to suspend the group's .org domain on August 28 and its bank, Banca Etica, to suspend its account. The collective hosted roughly 16,000 email addresses, 1,500 websites, 5,500 mailing lists, and about 10,000 blogs, including the Noblogs platform. European Digital Rights warned the move sets a dangerous precedent for non-commercial European hosts and digital sovereignty.

The Record · 8d agoPolicy & legal

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

North Korea's IT worker scheme (Famous Chollima/PurpleDelta) has expanded from IT into healthcare, sales, and financial services roles worldwide.

Huntress and Recorded Future documented DPRK-linked fraudulent workers landing remote jobs beyond IT, including at an Australian healthcare company, a financial services firm, and a sales hire with a stolen identity. The scheme, tracked as Famous Chollima, Jasper Sleet, Nickel Tapestry, PurpleDelta, UNC5267, and Wagemole, uses forged identity documents, VPNs, proxies, and laptop farms with PiKVM and capture cards to fund Pyongyang's weapons programs. Recorded Future found the PurpleDelta cluster applied to 1,100+ companies between late 2024 and early 2025 with 22 fabricated personas, some AI-generated, using ChatGPT and AI transcription during interviews. Analysts assess the activity is ongoing and likely to expand in scale and sophistication.

The Hacker News · 16d agoThreat actor in the wild

China's AI-Enabled APT Operations Are Getting Interesting

Bitdefender links seven RAT families, five previously undocumented, to China-nexus espionage actor SilkParasite using AI-assisted malware development against Central Asian governments.

A Bitdefender report attributes seven remote access tool families to a single actor dubbed SilkParasite, with medium confidence a China-nexus group targeting governments in Uzbekistan, Turkmenistan and Kazakhstan. The RATs are written in .NET, C++, Go and JavaScript, use C2 via Google Drive and protocols like HTTP, DNS and TCP, and employ modular plugin architectures with regular rotation of infrastructure, encryption material and persistence artifacts. Evidence of AI-assisted development includes leftover test functions, placeholder encryption keys, and GoginRAT and NomadRAT sharing a high-level architecture despite different languages, suggesting a specification implemented twice with AI. The newsletter also covers the US Operation Economic Outcast sanctioning six MOIS-linked Iranian hackers, including hands-on-keyboard operators who targeted US critical infrastructure.

Risky Business News · 21d agoThreat actor1

Risky Bulletin: Russia starts blocking DoH and DoT

Russian users report blocks on DoH and DoT servers, including Cloudflare 1.1.1.1 and Google 8.8.8.8, in an apparent censorship crackdown.

Russian internet users began reporting failures connecting to DNS-over-HTTPS and DNS-over-TLS servers, suggesting a government crackdown on the two privacy protocols. The blocks reportedly cover Cloudflare's 1.1.1.1 and Google's 8.8.8.8 resolvers; Roskomnadzor has not officially confirmed the action. The agency tested a similar block in March on Beeline's network and had named DoH for blocking as early as 2021. The bulletin also briefly notes state-sponsored phishing of EU officials, a DDoS against Norway's Digdir, the ReliaQuest/ShinyHunters dispute, and older ransomware and breach disclosures.

Risky Business News · 22d agoPolicy & legal1

EU chief wants joint response to cyberattacks, sabotage

EU Commission President von der Leyen proposed an Emergency Security Protocol letting any member state convene joint responses to cyberattacks and sabotage.

In her State of the Union address, Ursula von der Leyen proposed an Emergency Security Protocol, modeled on NATO Article 4, allowing a single EU member state to summon all 27 governments to coordinate responses to cyberattacks, sabotage, arson, and drone incursions. The proposal is part of a broader European security strategy that includes a European Security Council with partners such as the UK, Canada, Norway, and Ukraine, plus a European Instrument for Strategic Enablers supporting cyber and defense capabilities. She cited rising incidents in Denmark, Lithuania, Poland, and an attempted drone attack in Leipzig, but did not specify whether unanimous decision-making rules would change.

The Record · 23h agoPolicy & legal

Top 10 Best SaaS Security Posture Management (SSPM) Tools in 2026

Scorecard ranks 2026 SSPM platforms with AppOmni and Obsidian Security leading after CrowdStrike folded Adaptive Shield into its Falcon platform.

The editorial scorecard rates ten SaaS security posture management tools on app coverage (30%), misconfiguration depth, SaaS identity/OAuth risk, shadow-SaaS discovery, and value. AppOmni scores 9.0 for unmatched app coverage across enterprise SaaS suites, and Obsidian Security scores 8.9 for SaaS identity threat detection and ITDR workflows. CrowdStrike now delivers Adaptive Shield's SSPM natively within Falcon, and Zscaler's Canonic Security acquisition signals continued platform consolidation.

Cyber Security News · 1d agoIndustry

Group of Bipartisan Lawmakers Ask US Government to Ban Several Hack-for-Hire Firms

Bipartisan US lawmakers urged Commerce Secretary Lutnick to sanction three Indian hack-for-hire firms, including BellTroX, over espionage targeting US citizens.

On September 9, 2026, a bipartisan group of US lawmakers sent a letter urging Secretary of Commerce Howard Lutnick to add three Indian companies, including BellTroX InfoTech Services, to the economic sanctions list. The firms are accused of targeted espionage against US citizens, businesses, and their lawyers, as well as lawfare to censor investigative reporting by major American media. The request builds on Citizen Lab's 2020 discovery of the Dark Basin hack-for-hire operation, which targeted US nonprofits involved in #ExxonKnew and net neutrality advocacy and was linked to BellTroX and related entities.

Citizen Lab · 6d agoPolicy & legal1

North Korean IT Workers Use AI and Remote Desktop Tools to Fake Technical Interviews

Silent Push links a Discord recruitment scheme to North Korean IT workers using AI, remote desktop tools and on-camera proxies to pass technical interviews.

Silent Push assessed with moderate-to-high confidence that a representative known as Tec Guru, recruiting on-camera proxies via a Mouse Review Discord advertisement, is a North Korean IT worker. The scheme proposed a 65/35 revenue split with the hidden worker, live coaching through Google Meet, AI tools including ChatGPT to fill knowledge gaps, and remote access tools such as AnyDesk, TeamViewer, and Chrome Remote Desktop during coding exercises. Fraudulent hires can gain insider access enabling data theft, extortion, payroll fraud, and sanctions exposure; a July 31, 2026 multinational warning urged stronger identity checks and payment scrutiny.

Cyber Security News · 1h agoThreat actor

Coast Guard, FBI board US-bound foreign ships in order to probe for cyberattacks

US Coast Guard and FBI boarded two foreign tankers bound for the US after indications their vessel networks were compromised, investigating possible Iranian involvement.

The Coast Guard and FBI conducted joint offshore security boardings of two commercial ships in the Gulf of Mexico on August 21 and 24 to examine their operational and IT systems following indications both networks were compromised. The vessels reportedly carried oil and natural gas, and one was hacked in the Strait of Gibraltar and lost communications for over 30 hours. No operational disruptions, vessel instability, or environmental impacts have been reported, and authorities are investigating whether Iran or another group exploiting US-Iran tensions was behind the attacks.

CyberScoopupdated · 18h agofirst · 22h agoData breach in the wild 2 sources

US offers $10 million for info on Iranian leaders behind CyberAv3ngers water utility attacks

The US offered $10 million for information on six IRGC-CEC officials behind CyberAv3ngers' 2023 hacks of Unitronics PLCs at US water utilities.

The State Department named six Iranian security officials, including IRGC Cyber-Electronic Command head Hamid Reza Lashgarian, and offered up to $10 million for information on their whereabouts. CyberAv3ngers publicly claimed compromises of Israel-made Unitronics Vision PLCs in October 2023, forcing the Municipal Water Authority of Aliquippa, Pennsylvania, to take systems offline and switch to manual operations. The US had sanctioned the six men in February for targeting critical infrastructure, and CISA notified water operators using Unitronics devices while urging default-password changes. A watchdog also criticized the EPA for lacking a comprehensive water-sector cyber risk strategy.

The Record · 9d agoPolicy & legal in the wild 3 sources

North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters

Sekoia and Kudelski Security reclassify North Korea's Lazarus umbrella into six clusters spanning espionage, financial theft, and fake IT worker operations.

New research by Sekoia and Kudelski Security, published September 7, divides the former Lazarus umbrella into TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima, mostly under North Korea's military intelligence bureau (GRIB). The former APT38 likely split into CryptoCore and Jade Sleet, focused on cryptocurrency, Web3, and blockchain targets. Moonstone Sleet combines espionage with financially motivated operations, using custom malware alongside Qilin ransomware-as-a-service. Thousands of fake IT workers generate regime revenue and provide access, linked to incidents like the $62.5M Munchables protocol theft.

Infosecurity Magazine · 10d agoThreat actor

2026 Cyber Insurance Trends Report: What's Changed and What You Need to Know

Huntress survey: CIRCIA reporting mandates now live, BEC claims exceed ransomware, exfiltration-heavy attacks cost twice as much, premiums rising.

Huntress's 2026 cyber insurance trends report, based on its own survey, finds 79% of respondents carry cyber insurance while 58% report shrinking coverage over five years. New CIRCIA federal reporting mandates and EU NIS2 requirements are reshaping policies, business email compromise now drives more claims than ransomware, and data exfiltration has replaced encryption as the dominant ransomware tactic at roughly twice the cost. After three years of declining premiums, rates are climbing again, and most businesses now refuse to pay ransoms.

Huntress · 15d agoIndustry1

Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute

US prosecutors unsealed a superseding indictment charging 17 Iranians in the Mabna Institute's state-sponsored theft of 31.5 terabytes from universities and companies.

The superseding indictment unsealed in the Southern District of New York charges 17 people affiliated with Tehran's Mabna Institute, adding eight defendants to the 2018 indictment of nine. The institute allegedly compromised over 100,000 professor email accounts worldwide, including 8,000 accounts at 144 US universities, and stole at least 31.5 terabytes of academic journals, dissertations, and e-books. US universities spent approximately $3.4 billion procuring the stolen data, and victims also included at least five federal and state agencies, 42 US companies, and 11 foreign companies including HBO. The State Department's Rewards for Justice program is offering up to $10 million for information on four of the defendants.

CyberScoop · 29d agoPolicy & legal

America’s cyber strategy overlooks the infrastructure that actually keeps the military moving

Op-ed argues US cyber strategy underweights Iranian threats to ports, rail, utilities and other commercial infrastructure sustaining military operations.

The author, a former Navy intelligence officer, argues that a prolonged Iran conflict means sustained Iranian cyber operations targeting many smaller systems like water utilities, manufacturers and transportation providers. He cites mapping of 130 documented techniques across five Iranian threat groups and warns destructive attacks such as wipers and ransomware could hit the defense industrial base. The piece urges defensive wargames now and flags the pause in CMMC implementation as particularly concerning.

CyberScoop · 2h agoIndustry

CISA promotes a fresh way to deter cyberattackers: Lie to them

CISA issued first-time guidance advising critical infrastructure operators to deploy honeypots, honeytokens, and decoys to detect and distract intruders.

CISA published 'Using Cyber Decoys to Strengthen Detection and Response,' a 22-page guide marking the agency's first guidance on decoys such as honeypots and honeytokens. Acting executive director Chris Butera described decoys as a low-cost, high-fidelity way to detect adversaries already inside networks, complementing zero-trust and assume-compromise approaches. The guidance covers decoy principles, definitions, deployment scenarios, and is aimed especially at resource-constrained critical infrastructure sectors.

CyberScoop · 16h agoAdvisory

Virtual Event Today: Attack Surface Management Summit

SecurityWeek's 2026 Attack Surface Management Summit runs today as a virtual event covering asset discovery, SBOMs, red teaming, and pen-testing.

SecurityWeek is hosting its fully virtual 2026 Attack Surface Management Summit from 11AM-3PM, focused on continuous asset discovery, prioritization, and risk reduction. Sessions cover proving exploitability, SBOM and AIBOM software supply chain risk with Dr. Allan Friedman, demos from Wiz and Horizon3's NodeZero, and the roles of red teaming, bug bounty, and penetration testing in enterprise defense.

SecurityWeek · 22h agoIndustry

NCSC and Allies Warn of Iranian Spyware Campaign

NCSC, FBI and AIVD warn Iranian-backed actors deliver Chosen Brick spyware to regime critics via social engineering; stolen data has surfaced on pro-Iranian leak sites.

NCSC, the FBI and the Netherlands' AIVD published a joint advisory warning that a Tehran-backed campaign, active since at least 2025, targets dissidents, activists and journalists with Chosen Brick spyware. The malware persists via Windows registry keys, adds Microsoft Defender exclusions, uses Telegram for C2, and captures screens, audio, emails and Telegram or WhatsApp messages. Stolen data has surfaced on pro-Iranian leak sites in some cases, raising risks to victims' personal safety.

Infosecurity Magazineupdated · 5h agofirst · 1d agoThreat actor in the wild 7 sources

12 Best CASB Solutions Compared (2026): Features & Pricing

GBHackers' 2026 buyer's guide compares 12 CASB-capable vendors, arguing standalone CASB pricing has dissolved into per-user SSE subscriptions.

The article evaluates twelve CASB-capable platforms including Microsoft Defender for Cloud Apps, Palo Alto Networks' Prisma Access CASB, Netskope, iboss, Forcepoint ONE (Bitglass), Trend Micro Cloud App Security, and Skyhigh Security. It frames purchasing around SSE bundle economics, noting Defender for Cloud Apps ships inside Microsoft 365 E5 while Netskope, Zscaler, and Skyhigh price CASB into per-user SSE tiers. It also flags Saviynt, common on legacy roundups, as an IGA vendor rather than a true CASB.

GBHackersupdated · 4h agofirst · 1d agoIndustry 12 sources

What’s next for CISA’s CDM program that gives cybersecurity tools to federal agencies

CISA officials outline future plans for the CDM program, emphasizing speed, automation, unified data, and data-driven federal risk management.

Speaking at an Elastic Federal Cyber Defense Breakfast, CISA officials described next steps for the Continuous Diagnostics and Mitigation (CDM) program that supplies cybersecurity tools to federal agencies. Acting deputy program manager Richard Grabowski named velocity, unification, and data-driven risk management as core goals, including a three-year roadmap to expand SIEM-as-a-Service. Federal CISO Mike Duffy urged aggregating demand across agencies, buying outcomes rather than products, and designing acquisition for continuous improvement. CISA's Matt House tied the program's evolution to post-SolarWinds needs for a government-wide common operating picture.

CyberScoop · 1d agoPolicy & legal

Cisco warns customers of actively exploited zero-day in email gateways

Actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 allows unauthenticated root command execution; CISA added it to KEV.

Cisco disclosed CVE-2026-76461, a zero-day in AsyncOS for Cisco Secure Email Gateway that was exploited before disclosure and lets unauthenticated remote attackers execute commands with root privileges on cloud and on-premises instances. CISA promptly added the flaw to its Known Exploited Vulnerabilities catalog, and Cisco has directly contacted cloud customers with indicators of compromise while deploying mitigations. Rapid7 and VulnCheck warn compromised gateways could enable silent email monitoring and internal pivoting from on-premises deployments.

CyberScoopupdated · 23h agofirst · 1d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461

Exaforce extends its AI security tool to monitor more than just Claude

Exaforce AI Security extends beyond Claude to monitor OpenAI, Gemini, and Copilot agents using existing SOC telemetry, no new endpoint agents.

Exaforce expanded its June Claude Compliance API integration into Exaforce AI Security, adding monitoring for OpenAI, Gemini, Microsoft Copilot, and OAuth-connected AI apps. The tool inventories AI agents by correlating EDR, cloud, SaaS, and model-provider logs without new gateways or endpoint agents, and can respond by revoking sessions, deactivating API keys, isolating devices, or killing agent processes via existing controls. Analysts note the agentless approach lowers friction but lacks runtime inspection and inline blocking offered by competitors such as Palo Alto Prisma AIRS, SentinelOne Prompt AI Agent Security, and CrowdStrike Falcon Guardian. A March 2026 Cloud Security Alliance survey found 68% of organizations cannot distinguish human from AI-agent activity and 74% report AI agents receive excessive access.

CSO Online · 1d agoTools

Supreme Court denies Trump request to allow USPS mail ballot changes

Supreme Court denied the Trump administration's emergency request to implement USPS mail ballot changes before the 2026 midterms, calling it arbitrary and capricious.

The U.S. Supreme Court rejected 7-2 the Trump administration's petition to change how the U.S. Postal Service handles mail-in ballots for the 2026 midterm elections. Justice Ketanji Brown Jackson wrote the administration was unlikely to succeed, while Justice Brett Kavanaugh cited unreasonably short timelines for state election officials. The blocked executive order would have required USPS citizenship verification, barcode tracking of ballot envelopes, and DHS-compiled "State Citizenship Lists"; a whistleblower alleged a rushed effort to install three restrictive IT verification systems. Justices Alito and Thomas dissented, arguing states and organizations lacked standing.

CyberScoop · 2d agoPolicy & legal

Tajin Group: Guarantee Marketplace Vendor Involved in Phishing and Chinese Money Laundering Group

Recorded Future details Tajin Group, a Chinese-speaking vendor on Telegram guarantee marketplaces running phishing, carding, and money laundering operations targeting Chinese banks.

Insikt Group analyzed Tajin Group, a Chinese-speaking threat actor operating on Telegram-based guarantee marketplaces Dabai Guarantee and, since May 2026, Xinbi Guarantee. The group conducts phishing, payment card theft, and money laundering targeting mainland Chinese citizens and banks, testing stolen cards from twelve countries on platforms like CCAvenue and Geidea. Operators bought and sold at least 100 Telegram usernames and anonymous virtual numbers via Fragment Market to strengthen OPSEC, linking multiple usernames to single Telegram accounts. Recorded Future warns Tajin Group's TTPs are likely to be replicated by other vendors on Chinese-language guarantee marketplaces at global scale.

Recorded Future · 2d agoThreat actor

Five alleged leaders of Black Axe’s operations in South Africa extradited to US

US extradited five alleged Black Axe Cape Town leaders from South Africa to face romance-scam wire fraud and money laundering charges.

The Justice Department announced five alleged leaders of Black Axe's South African wing, all Nigerian nationals, were extradited to the US over romance and advance-fee scams run from at least 2011 until their 2021 arrests in South Africa. Prosecutors say the group used fake identities and threatened to expose victims' sensitive photos, with charges including wire fraud, money laundering, and aggravated identity theft carrying up to 62 years. The extradition follows recent multi-country stings arresting dozens of Black Axe members, including 34 arrests in Spain.

CyberScoopupdated · 2d agofirst · 2d agoPolicy & legal 3 sources

Cyberattack causes a flight delay? Airlines won’t owe you a hotel or meal

A new DOT rule exempts airlines from providing meal vouchers or hotels for cyberattack-caused delays if carriers comply with applicable cybersecurity regulations.

A Department of Transportation rule published in September 2026 adds "cybersecurity attacks" to a list of 10 "not controllable" flight disruption causes, creating a new delay tracking category and relieving compliant airlines of customer service obligations like meal vouchers and hotels. The rule stems from the FAA Reauthorization Act of 2024 and applies only when carriers demonstrate compliance with applicable cybersecurity regulations. Consumer groups reacted cautiously: FlyersRights criticized the lack of public comment, while the National Consumers League saw both certainty benefits and risks from ambiguous wording. The article cites prior aviation incidents including Scattered Spider's airline attacks and the 2024 Collins Aerospace hack that disrupted European flights.

CyberScoop · 5d agoPolicy & legal

GitLab’s critical flaw is already drawing internet-wide probes

GitLab patches two critical flaws (CVE-2026-85706 CVSS 10.0, CVE-2026-87719) as WatchTowr observes internet-wide probing of the unauthenticated file-read bug.

GitLab released emergency patches for two high-severity flaws in Community and Enterprise Editions, urging self-managed operators to upgrade immediately while saying its hosted and Dedicated offerings are fixed or unaffected. CVE-2026-85706 (CVSS 10.0) is a path traversal in the repository commits interface that lets unauthenticated attackers read any file on the server and affects releases 18.7 through 19.1.8 plus the 19.2 and 19.3 lines before patching. CVE-2026-87719 (CVSS 9.9, Enterprise Edition only) lets a logged-in Duo Chat user hide a command in a request that triggers Advanced Search settings and password disclosure. WatchTowr Labs reported it is already watching probes that can trigger the path traversal flaw in a single HTTP request, though CISA had not added either issue to the KEV list as of Friday afternoon.

CyberScoopupdated · 2d agofirst · 5d agoVulnerability in the wild 18 sourcesCVE-2026-85706CVE-2026-87719

In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review

SecurityWeek weekly roundup covers exploited WordPress Super Forms flaw CVE-2026-14894, a $10M bounty on an Iranian cyber official, InjectEave attacks, and more.

SecurityWeek's weekly roundup aggregates short items across the threat landscape, including Microsoft's report of invisible Unicode tag characters used in financial phishing lures at up to 2.37 million messages per day, and active exploitation of critical WordPress Super Forms plugin flaw CVE-2026-14894 to deploy PHP webshells. Policy items include a $10 million US bounty for IRGC-CEC Cyber Operations Command lead Amir Yaryab, a 16-month prison sentence for ex-AT&T employee Kenneth Carter over SIM swaps with nearly $600,000 in intended losses, and the US arraignment of Russian Sergei Anatolyevich Filimonov over credential harvesting. Technical items include InjectEave electromagnetic side-channel attacks tested on 11 devices, an FBI warning on OAuth consent phishing, and VulnCheck's finding that only 202 of 26,153 Anthropic Project Glasswing findings were fixed.

SecurityWeek · 5d agoIndustry in the wildCVE-2026-148942