Search: “MITRE”

284 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 393 Ransomware 355 Malware 161 Industry 99 Threat actor 99 Exploit / PoC 95 Data breach 61 Policy & legal 52 AI safety & security 32 Phishing & fraud 28 Tools 19 AI research 19 Research 16 AI tools & infra 13

SeverityAll critical 611 high 380 medium 284 low 110 info 75

China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies

NSA, CISA, and FBI warn DeepSeek, Alibaba, and other Chinese AI firms ran industrial-scale distillation of U.S. frontier models, threatening U.S. AI leadership.

A joint NSA, CISA, and FBI Cybersecurity Advisory (AA26-251A) says China-based firms DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens from U.S. frontier models including Claude, GPT, Gemini, and Grok, likely with Chinese government knowledge. Campaigns running since at least late 2024 used native APIs, cloud providers, third-party aggregators, gray-market proxy "transfer stations", and shared premium subscriptions to bypass geographic restrictions, evade safeguards, and violate providers' terms of use. The agencies recommend detecting anomalous prompts, accounts, and usage patterns; subtly altering responses to suspected distillers; and cross-organization intelligence sharing. They also call DeepSeek's publicly cited $5.6M training cost misleading because it excludes data acquired through distillation.

CISA AdvisoriesSep 8, 12:00 UTC · 8d agoAdvisory in the wild1

The Role of Analytic Frameworks in Security Intelligence

Recorded FutureJan 9, 00:00 UTC · Jan 9, 2026Vulnerability1

Threat Roundup for November 3 to November 10

Cisco TalosNov 9, 18:32 UTC · Nov 9, 2023Vulnerability

Threat Roundup for October 27 to November 3

Cisco TalosNov 3, 21:15 UTC · Nov 3, 2023Vulnerability

Threat Roundup for September 22 to September 29

Cisco TalosSep 29, 16:40 UTC · Sep 29, 2023Vulnerability

Threat Roundup for June 30 to July 7

Cisco TalosJul 7, 21:26 UTC · Jul 7, 2023Vulnerability

Threat Roundup (Feb. 24

Cisco TalosMar 3, 20:00 UTC · Mar 3, 2023Vulnerability

Threat Round up for January 13 to January 20

Cisco TalosJan 20, 21:38 UTC · Jan 20, 2023Vulnerability

Server-side attacks, C&C in public clouds and other MDR cases we observed

Kaspersky SecurelistNov 2, 08:00 UTC · Nov 2, 2022Vulnerability

Threat Roundup for May 27 to June 3

Cisco TalosJun 3, 19:07 UTC · Jun 3, 2022Vulnerability

Threat Roundup for May 20 to May 27

Cisco TalosMay 27, 20:38 UTC · May 27, 2022Vulnerability1

Threat Roundup for April 1 to April 8

Cisco TalosApr 8, 21:48 UTC · Apr 8, 2022Vulnerability

Threat Roundup for March 25 to April 1

Cisco TalosApr 1, 19:59 UTC · Apr 1, 2022Vulnerability

Threat Roundup for March 18 to March 25

Cisco TalosMar 25, 19:01 UTC · Mar 25, 2022Vulnerability1

Threat Roundup for February 25 to March 4

Cisco TalosMar 2, 15:45 UTC · Mar 2, 2022Vulnerability

Threat Roundup for February 4 to February 11

Cisco TalosFeb 11, 19:28 UTC · Feb 11, 2022Vulnerability

Threat Roundup for January 7 to January 14

Cisco TalosJan 14, 22:20 UTC · Jan 14, 2022Vulnerability

Threat Roundup for December 31 to January 7

Cisco TalosJan 7, 21:41 UTC · Jan 7, 2022Vulnerability

Threat Roundup for September 10 to September 17

Cisco TalosSep 17, 20:28 UTC · Sep 17, 2021Vulnerability

Threat Roundup for August 6 to August 13

Cisco TalosAug 13, 17:12 UTC · Aug 13, 2021Vulnerability

Stellar Cyber XDR Kill Chain allows security analyst teams to disrupt cyberattacks

Help Net SecurityJul 21, 00:00 UTC · Jul 21, 2021Malware

Threat Roundup for July 2 to July 9

Cisco TalosJul 9, 18:51 UTC · Jul 9, 2021Vulnerability

Over 30K VoIP devices identifiable worldwide, some with suspected flaws

Security AffairsMay 14, 06:33 UTC · May 14, 2021Vulnerability

Threat Roundup for December 4 to December 11

Cisco TalosDec 11, 20:41 UTC · Dec 11, 2020Vulnerability

Uptycs enhances detection and investigation for on-premises and cloud workloads

Help Net SecurityNov 13, 00:00 UTC · Nov 13, 2020Vulnerability

Threat Roundup for October 16 to October 23

Cisco TalosOct 23, 22:09 UTC · Oct 23, 2020Vulnerability1

Threat Roundup for August 28 to September 4

Cisco TalosSep 4, 22:15 UTC · Sep 4, 2020Vulnerability

Threat Roundup for July 31 to August 7

Cisco TalosAug 7, 22:10 UTC · Aug 7, 2020Vulnerability

Open source tool Infection Monkey allows security pros to test their network like never before

Help Net SecurityAug 7, 00:00 UTC · Aug 7, 2020Vulnerability

Threat Roundup for July 3 to July 10

Cisco TalosJul 10, 17:43 UTC · Jul 10, 2020Vulnerability

Threat Roundup for June 5 to June 12

Cisco TalosJun 12, 22:57 UTC · Jun 12, 2020Vulnerability

Experts disclose security flaws in Oracle's iPlanet Web Server

Security AffairsMay 11, 14:20 UTC · May 11, 2020Vulnerability CVE-2020-9315 CVE-2020-9314 CVE-2012-0516

Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware

Attackers abuse Windows VSS shadow copies to delete recovery points before ransomware and to extract NTDS.dit/SAM credentials, demanding context-aware detection.

Threat actors are weaponizing the Volume Shadow Copy Service (VSS) for two purposes: destroying local recovery points via vssadmin.exe, wmic.exe, diskshadow.exe, wbadmin.exe, and bcdedit.exe before encryption, and accessing static copies of locked files such as NTDS.dit and SAM for credential theft. Ransomware families tied to shadow-copy removal include Akira, Black Basta, BlackCat, Conti, LockBit, Qilin, RansomHub, REvil, Ryuk, and WannaCry. Huntress's analysis of the Nightmare-Eclipse tool showed the BlueHammer technique chaining a Windows Defender timing issue with a VSS snapshot to dump the SAM database and decrypt NT hashes. Defenders should correlate VSS operations with parent process, hive access, and subsequent encryption activity, and maintain immutable off-host backups.

GBHackersSep 15, 05:51 UTC · 1d agoResearch in the wild1