ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Verizon”

26 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllData breach 352Ransomware 175Vulnerability 119Policy & legal 92Exploit / PoC 67Phishing & fraud 60Industry 58Threat actor 44Malware 42AI tools & infra 11Tools 5AI research 3Research 3Advisory 3
SeverityAllcritical 528high 290medium 73low 121info 26

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Supply Chain Attacks in 2026: Why Threat Intelligence Is the Only Early Warning System That Works

Cyble argues supply chain attacks are a primary breach vector, citing Verizon DBIR third-party figures and CISA SBOM guidance to pitch its TPRM platform.

Cyble's vendor blog frames third-party compromise as a first-order breach risk, citing Verizon's 2026 DBIR finding that third parties were involved in 48% of breaches, up 60% year over year. It recounts the Cl0p campaigns against Progress MOVEit Transfer (CVE-2023-34362), which affected over 2,700 organizations and 93 million people, and Fortra GoAnywhere (CVE-2023-0669) with roughly 130 claimed victims. It also highlights CISA and NSA's 2026 Minimum Elements for a Software Bill of Materials covering open-source, AI, and SaaS components. The piece concludes by promoting Cyble's Third-Party Risk Management platform.

Cyble · 13d agoIndustryCVE-2023-34362CVE-2023-0669

The 12 Best Managed Firewall Services, Compared and Priced

GBHackers compares 12 managed firewall service providers, naming Fortinet best value and Secureworks best detection while flagging recent ownership changes.

The buyer's guide evaluates 12 managed firewall/MSSP providers across cost tiers, contract terms, and service models. Fortinet is rated best value, Secureworks best detection, NTT Data best global reach, and Cato Networks best for organizations wanting to stop owning firewalls. The article highlights that Secureworks was acquired by Sophos for roughly $859 million in February 2025, the Trustwave-Cybereason merger was terminated in March 2025, LevelBlue is the rebranded AT&T Cybersecurity business, and Comcast Business absorbed Masergy.

GBHackers · 8d agoIndustry 2 sources

35 Actionable Password Statistics for Businesses in 2026 | Huntress

Huntress compiles 2026 password statistics showing 94% of 19 billion leaked passwords were reused and 37% of identity threats used stolen credentials.

Huntress published a compilation of password security statistics drawing on sources including Cybernews, Verizon's 2026 DBIR, IBM, and Bitwarden. Cybernews found 19 billion exposed passwords from roughly 200 incidents between April 2024 and April 2025, with only 6% unique and 94% reused across accounts. Huntress telemetry reports 37% of identity-based threats in 2026 involved stolen or suspicious credentials, while Verizon cites credential abuse in 39% of breaches. The piece argues weak and reused passwords remain a top entry point and recommends improved password hygiene.

Huntress · 6d agoIndustry

Keepnet launches free SMS/Call Reporter for iOS

Keepnet launched a free iOS app, SMS/Call Reporter, letting users one-tap report smishing and vishing into corporate incident response pipelines.

Keepnet released the free SMS/Call Reporter app for iOS, letting users report suspicious SMS and voice phishing with one tap. For enterprise customers, reports flow into Keepnet Incident Responder alongside email phishing reports. The company cites Verizon 2026 DBIR data showing mobile phishing simulations achieve a 40% higher median click rate than email, and FBI IC3 2025 counted $798 million in smishing and vishing losses. An Android version is planned.

Help Net Security · 14d agoTools

AT&T store worker gets 16 months inside for SIM-swap side hustle

Former AT&T store worker Kenneth Carter sentenced to 16 months for SIM-swapping customers for cybercriminals.

Kenneth Carter, 44, a former AT&T retail employee in Portland, Oregon, used his internal system access to perform SIM swaps on customers' phone numbers for cybercriminals. The swaps allowed criminals to intercept authentication codes and raid victims' bank accounts. Carter was sentenced to 16 months in federal prison.

DataBreaches.net · 3d agoPolicy & legal1· 1 read

Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones

Opinion piece argues attackers prioritize repeatable playbooks like ClickFix (47% of Microsoft-notified attacks) and living-off-the-land over novel techniques.

The column analyzes why commodity techniques scale: Microsoft observed ClickFix as the top initial access method at 47% of its notifications last year, while Bitdefender found 84% of 700,000 analyzed high-severity incidents involved binaries already present on machines. Verizon's DBIR shows vulnerability exploitation rising to 31% of initial access vectors, up from 20%, and ransomware leak-site rankings show Qilin (roughly 1,600 claimed victims) and The Gentlemen (121 claimed victims in June) competing on throughput. The author argues attackers behave like a generics business, standardizing repeatable procedures rather than investing in novel tradecraft.

The Hacker News · 15d agoIndustry

US Finance Under Phishing Pressure: What the SOC Data Reveals?

ANY.RUN SOC telemetry shows escalating phishing campaigns against US finance, including Vercel-hosted RMM attacks abusing legitimate services.

ANY.RUN analyzed SOC telemetry data on phishing targeting the US financial sector, concluding that the scale and security impact should not be understated. The analysis highlights modern campaigns such as Vercel-hosted attacks that deliver remote monitoring and management (RMM) tools. It notes that attackers increasingly abuse legitimate services and everyday workflow tools to deliver phishing, making detection harder for SOC teams.

ANY.RUN · 21d agoPhishing & fraud in the wild

NIS2 compliance: Fixing IAM and access control before the 2026 audit

EU NIS2 enforcement deadlines approach; organizations are urged to prioritize service account inventory, lifecycle offboarding, and phishing-resistant MFA before audits.

EU member states are moving from NIS2 transposition into enforcement, with fines up to 10 million euros or 2% of global turnover for essential entities and personal liability for management bodies. The article argues access management is the fastest high-ROI starting point, estimating 2-4 weeks to enforce fine-grained password policy, vault shared credentials, and deploy phishing-resistant MFA versus 6-12 months for supply chain risk management. It flags three common pre-audit failures: unmanaged service accounts and API keys, dormant accounts from broken offboarding, and SMS OTP instead of phishing-resistant MFA under NIST SP 800-63B. The piece promotes Passwork as a single control plane for credential storage, RBAC, and WebAuthn.

Help Net Security · 15d agoIndustry

Sequoia doubles down on Cymphony as AI agents create new enterprise security risks

Cymphony emerges with $30M from Sequoia and SMBC to give security teams unified visibility into AI agent and non-human identities.

Cymphony, a New York- and Tel Aviv-based startup, raised a $25 million Series A co-led by Sequoia and SMBC Fin Atlas Beyond Fund, valuing it above $100 million. Its platform builds a "workforce graph" unifying identity, data, and activity signals for employees, AI agents, and other non-human identities. The company says it found roughly 85,000 files exposed to AI tools at one US public company and reached seven-figure ARR in its first year of sales with customers including KKR and Syngenta. Sequoia previously led its undisclosed seed round, betting on Israeli Talpiot program alumni founders.

TechCrunch · Security · 7d agoIndustry

Getting a stranger’s phone kicked off the cellular network costs a few dollars

Researchers show attackers can remotely block strangers' phones and alarm gateways on US cellular networks by abusing lost/stolen IMEI reporting for $2.50-$4 per device.

Researchers from Michigan State University and three partner schools found six weaknesses in the lost/stolen device reporting ecosystem spanning devices, carrier systems, and cross-carrier block-list sharing. They demonstrated blocking unopened Samsung Galaxy Z Fold 7 phones and home alarm gateways on three major US carriers, with each block costing $2.50-$4 and taking roughly 20-80 seconds. The attacks exploit thin identity and ownership checks in prepaid accounts, IMEI leakage from vulnerable cellular chipsets used by two vendors with over 40% global market share, and pre-release IMEI databases purchasable for $600. Victims receive no notification, and restoring service requires proving device ownership to the carrier.

Help Net Security · 5d agoResearch

Scytale expands vendor risk management with AI-powered TPRM tools

Scytale launched AI-powered third-party risk management in its Vendors module, automating vendor discovery, risk scoring, and continuous vendor posture monitoring.

Scytale added AI-driven TPRM capabilities to its Vendors module, combining automatic vendor discovery from SSO providers and integrations with AI enrichment and dynamic risk scoring. The platform now continuously monitors vendors for breaches, data exposures, and vulnerabilities via third-party intelligence APIs, with proactive email notifications and auto-generated audit-ready security reports. It integrates with cross-framework control mapping for SOC 2, ISO 27001, GDPR, HIPAA, and SOX ITGC. Scytale cites Verizon's 2026 DBIR, which found 48% of breaches involved a third party, up 60% year over year.

Help Net Security · 6d agoTools

The true cost of a ransomware attack, with and without BCDR

Ransomware's true cost averages $5.08 million per incident versus a $139,875 median ransom, and mature BCDR strategies with immutable backups cut downtime and recovery expenses.

IBM's Cost of a Data Breach Report 2025 puts the average ransomware incident at $5.08 million, far above the $139,875 median ransom payment cited in Verizon's 2026 DBIR. Datto's State of BCDR Report 2025 found 60% of organizations believed they could recover within a day, but only 35% actually did. The Datto-sponsored piece argues mature BCDR with immutable WORM backups shortens downtime, citing a Techify case that restored 19 TB and returned a client to operations in under two hours without paying a ransom. It also flags compliance deadlines such as GDPR's 72-hour breach notification and the SEC's four-business-day disclosure rule.

BleepingComputer · 4h agoIndustry

Hackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America

Unit 42 says Latin American attackers used LLMs to automate post-exploitation in campaigns hitting Mexican government, water utilities, and Brazilian financial firms.

Unit 42 identified two campaigns in Latin America whose operators used commercial LLMs (Claude, GPT-4.1) behind a self-hosted NextChat interface to generate and debug post-exploitation scripts. Cluster CL-CRI-1131 compromised a transportation organization, Mexican federal ministries, and water utilities in Mexico and Ecuador, using native Windows tools and Volume Shadow Copies to dump the SAM registry hive and NTDS.dit. Cluster CL-CRI-1163 targeted Brazilian financial organizations with job-themed phishing, custom RATs, and a Go-based reverse SOCKS5 tunneling utility called SockTz, with nine versions deployed within roughly two hours. Trend Micro tracks related AI-augmented activity as SHADOW-AETHER-040 and SHADOW-AETHER-064.

GBHackersupdated · 6d agofirst · 6d agoThreat actor in the wild 2 sources1

CISA review makes the case for eliminating vulnerability classes

CISA's FY2024-2025 vulnerability review urges eliminating recurring vulnerability classes, finding 41.5% of 2025 KEV entries map to persistent 'stubborn weaknesses'.

CISA's Vulnerability Review for fiscal years 2024 and 2025 found most compromises stemmed from opportunistic exploitation of known, exposed vulnerabilities rather than nation-state zero-days or advanced tradecraft. The review found 41.5% of 2025 KEV catalog entries map to 'stubborn weaknesses' - injection flaws, improper input validation, memory-safety failures, path traversal and broken access control - recurring on the CWE Top 25 since 2019. CISA advocates Secure by Design practices, vulnerability class elimination, and buyer-driven 'Secure by Demand' contract requirements, while warning that AI-enabled vulnerability discovery will soon accelerate exploitation.

Help Net Security · 15d agoPolicy & legal

Silver Fox Targets Japanese Manufacturer with 3

Chinese group Silver Fox used new vulnerable drivers and DLL side-loading to deploy ValleyRAT at a Japanese industrial manufacturer.

Cato Networks detailed a Silver Fox campaign against a Japanese industrial manufacturing organization combining new vulnerable-driver abuse (BootRepair.sys and EnPortv.sys alongside wsftprm.sys), DLL side-loading via Zeon Corporation PDF binaries, and NTDLL unhooking to deliver ValleyRAT (Winos 4.0), a Gh0st RAT variant. The chain starts with an invoice-themed phishing lure hosting attacker-controlled content on legitimate QQ and Tencent Cloud services. Shellcode is injected into svchost.exe via thread-context hijacking, and a dual watchdog design pairs payload monitoring with a scheduled-task batch script for persistence. A separate 180-day VirusTotal retrohunt found 146 Atlas RAT samples across six PDB builds, though the Silver Fox link remains circumstantial.

The Hacker News · 20d agoThreat actor in the wild

CBTS brings continuous penetration testing to enterprise security

CBTS launched Penetration Testing as a Service built on Horizon3.ai's NodeZero, combining autonomous pentesting with expert review for continuous validation.

CBTS announced PTaaS, a service that runs recurring autonomous penetration tests powered by Horizon3.ai's NodeZero across cloud, SaaS, identity, and AI environments, with CBTS experts reviewing findings for exploitability and remediation guidance. The service supports daily-to-quarterly cadences and aims to support Continuous Threat Exposure Management (CTEM) programs. It cites Verizon's 2026 DBIR finding that re-exploitation likelihood drops roughly 30 days after last observed exploitation.

Help Net Security · Aug 12, 2026Tools

The 12 Best Managed XDR Services, Compared and Priced

A comparison of twelve managed XDR providers covering pricing models, telemetry breadth, and distinguishing genuine MXDR from rebranded MDR services.

The article compares twelve managed XDR providers including Bitdefender, CrowdStrike, Palo Alto Unit 42, Trend Micro, Fortinet, Secureworks Taegis, Stellar Cyber, Ontinue, and ReliaQuest, highlighting pricing models and telemetry breadth. It explains that genuine MXDR must actively monitor identity, cloud, and email telemetry rather than merely ingest it, and typically costs 30-60% more than endpoint-only MDR. It also notes Sophos completed its approximately $859 million acquisition of Secureworks in February 2025.

GBHackers · 7d agoIndustry 3 sources2

Android car head units infected with proxy botnet malware through built-in software updaters

Kaspersky found malware delivered via car head unit updaters, attributed to the MoYu Group's BADBOX operation, recruiting devices into a proxy botnet.

Kaspersky discovered malware delivered through the built-in TWCore system updater in Android-based car head units running DoFun infotainment firmware, turning devices into ad-fraud tools and nodes in a proxy botnet. The three-stage infection chain (JarService dropper, loader, and final payload supporting nine commands) installs the zhima reverse-proxy module, which Nokia's Deepfield team independently found on TV set-top boxes. Kaspersky attributes the operation with high confidence to the MoYu Group, linked to the BADBOX supply-chain botnet first identified by HUMAN Security in 2023. DoFun closed the gap after Kaspersky's responsible disclosure.

Help Net Security · 23d agoMalware in the wild

ICE Wants to Know Everyone Who Bought a Certain Green Beanie From REI in the Last 2 Years

DHS subpoenaed REI for all Minneapolis-area customers who bought a specific green beanie since 2024, part of an investigation into 39 ICE protest defendants.

Court filings allege Homeland Security Investigations agents subpoenaed REI in March for transaction records of all persons in the greater Minneapolis–St. Paul area who purchased a specific dark green beanie since 2024. The subpoena was one of 92 sent in a federal case against 39 people, including journalists, who attended an ICE protest at a church. Companies responded differently: T-Mobile handed over six months of a defendant's call and text logs, Google refused a request for YouTube viewers, Reddit withdrew after a First Amendment objection, and Meta pushed back on at least one summons. The 1509 customs summonses require no judicial oversight, and the total number issued under the Trump administration is unknown.

WIRED · Security · 12d agoPolicy & legal

Telus Warns Customers of Account Breaches

Telus warns customers that attackers used compromised credentials to access accounts and personal data between February 2025 and June 2026.

Telus, one of Canada's largest telecom providers, is notifying customers that attackers accessed consumer telecom accounts using compromised credentials between February 2025 and June 2026. Exposed data includes names, account numbers, phone numbers, billing addresses, email addresses, partial payment card numbers, subscription details, and payment history. The stolen information was used to push customers toward competitors and to make unauthorized service changes; the number of affected accounts is undisclosed. Telus reset credentials, added enhanced monitoring, notified Vancouver police, and offered identity theft protection; the incident may be credential stuffing and follows a ShinyHunters-claimed breach of subsidiary Telus Digital.

SecurityWeek · 2d agoData breach in the wild

Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

Unit 42 documents two AI-assisted intrusion campaigns against Latin American government, utility, and financial organizations using LLM-orchestrated tooling.

Palo Alto Networks Unit 42 tracks two ongoing intrusion clusters, CL-CRI-1131 (Mexican transportation, federal ministries, municipal water utilities) and CL-CRI-1163 (Brazilian financial sector), both using living-off-the-land techniques, SOCKS5 relays, and custom RATs. The attackers appear to orchestrate operations via commercial LLMs like Claude and GPT-4.1, evidenced by iterative batch scripts and AI-generated tunneling tool naming. The Mexican campaign (also reported as Operation Escaneo by CloudSEK) exfiltrated sensitive data via dynamic-DNS infrastructure with rotated multi-SAN TLS certificates between February and June 2026. This signals broader adoption of AI-enhanced operations by diverse threat groups in the region.

Palo Alto Unit 42 · 13d agoThreat actor in the wild1