ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “detection engineering”

8,048 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 1841Vulnerability 1485Ransomware 1240Phishing & fraud 652Exploit / PoC 556Data breach 541Threat actor 483Industry 412Policy & legal 352AI safety & security 118AI tools & infra 89Research 80Tools 71Advisory 62
SeverityAllcritical 3008high 2162medium 1938low 616info 368

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point revealed BTR Reforged, a technique weaponizing Microsoft Defender's built-in BTR.sys driver to delete security software at boot without exploiting any vulnerability.

Check Point Research disclosed BTR Reforged, a technique that abuses BTR.sys, a legitimately signed Windows Defender boot-time remediation driver, to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2 without exploiting a software flaw. The BTR_CLI proof-of-concept tool, presented at Black Hat USA 2026 and DEF CON 34, installs the driver via direct registry writes and executes deletions during the boot-time 'golden window' before Defender's user-mode services start, demonstrated by deleting the full Defender stack on a patched Windows 11 machine. Exploitation requires SeLoadDriverPrivilege; Microsoft confirmed it does not meet criteria for immediate servicing and no patch is planned. No evidence of real-world abuse was found, and related indicators of compromise via Sysmon events were published.

The Hacker News · 26d agoToolsCVE-2021-240921

Scam Attacks Taking Advantage of the Popularity of the Generative AI Wave

Unit 42 finds about 225 generative AI-themed domains registered daily since ChatGPT's launch, with nearly 29 percent suspicious, fueling scams and PUP delivery.

Palo Alto Networks analyzed new domain registrations containing generative AI keywords such as chatgpt, prompt, and sora since ChatGPT's November 2022 launch, observing around 225 GenAI-related registrations per day. About 28.75 percent of these domains are suspicious, a rate 22 times higher than for general new domains, with registration spikes aligning with milestones like Bing ChatGPT integration, the GPT-4 release, new GPTs, and OpenAI's Sora announcement. Over 72 percent of the domains use gpt or chatgpt keywords, and gpt domains show a 76 percent suspicious rate. Case studies cover PUP delivery, spam distribution, and monetized domain parking, with 35 percent of traffic to these domains directed at suspicious ones.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud in the wild1

338 Million Attack Simulations Reveal The State Of Enterprise Defense

Picus Labs' Blue Report 2026, from 338 million attack simulations, finds defenses strong at the perimeter but blocking only 37% of post-compromise actions.

Picus Labs' fourth annual Blue Report analyzed over 338 million attack simulations from production environments in H1 2026. Average prevention effectiveness rose from 62% to 69%, but only 37% of attacker actions were blocked after compromise, with reconnaissance and credential theft largely missed. IOC-based malware download prevention fell to 50% from 71% in 2024, and Mimikatz credential dumping from LSASS memory was blocked 94% of the time versus 17% from other memory locations and 3% from registry.

Help Net Security · Aug 12, 2026Research

Top 10 Best Ransomware Protection Solutions in 2026

A 2026 buyer's guide ranks ten ransomware protection tools by kill-chain role as extortion shifts from encryption to data theft.

The roundup organizes defenses across the ransomware kill chain: prevention-grade EPP/EDR platforms, containment layers, rollback specialists, and immutable recovery. Recommended products include CrowdStrike, Microsoft Defender, Sophos, SentinelOne, Bitdefender, Trend Micro, Halcyon, Huntress, and Malwarebytes. It stresses that many crews now extort on stolen data without encrypting, making exfiltration detection and response speed as important as rollback.

Cyber Security News · 6d agoIndustry1

AI agents help compress ransomware intrusion to under 10 hours, raising stakes for CISOs

Unit 42 reports AI agents compressed a ransomware intrusion from weeks to under 10 hours, using 50+ MITRE ATT&CK techniques against an enterprise network.

Palo Alto Networks Unit 42 investigated a ransomware incident where AI agents moved through an enterprise network in under 10 hours, work that would have taken human operators roughly two weeks. The attacker entered via a public-facing API endpoint, used automated reconnaissance to map microservices, searched source-code repositories for credentials, and accessed a secrets-management system. They hijacked enterprise code workflows to exfiltrate cloud access keys, attempted Terraform backdoors (blocked by branch protections), and used stolen credentials to access the victim's own AI services as attack infrastructure. Over 50 MITRE ATT&CK techniques were observed; the actor confirmed using frontier AI models and agentic frameworks during negotiations.

CSO Online · 13d agoThreat actor in the wild

ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Response

ANY.RUN integrates its interactive sandbox, IOC lookups, and STIX/TAXII threat feeds natively into SentinelOne for faster automated malware triage.

ANY.RUN and SentinelOne launched connectors that embed interactive sandbox analysis and threat intelligence into the SentinelOne console via Singularity Hyperautomation. Suspicious files and URLs from alerts are automatically submitted to the ANY.RUN sandbox, with behavioral verdicts and risk scores returned into alert notes. On-demand IOC lookups draw on sandbox history from 16,000 organizations and 700,000 analysts. A separate STIX/TAXII feed streams verified malicious IPs, domains, and URLs through the SentinelOne Marketplace TAXII Connect app.

ANY.RUN · 18h agoTools

Smishing Triad Hackers Use JWR Phishing Kit to Steal Cards, OTPs and Bank Credentials

Group-IB attributes large-scale smishing using the JWR real-time phishing kit to the Smishing Triad's Outsider cluster, harvesting card data, OTPs, and bank credentials.

Group-IB attributes a large-scale SMS phishing campaign to Outsider, an operator sub-cluster within the Smishing Triad phishing-as-a-service ecosystem, using a kit dubbed JWR. The Vue 2-based platform maintains real-time WebSocket communication with operators, enabling them to adapt pages live and harvest roughly 70 PII fields, card data, PINs, OTPs, identity document images, and digital wallet credentials via a dedicated PayPal sub-funnel. Unit 42 previously tied 194,345 malicious domains across 136,933 root domains to the broader operation since January 2024. Defenders can hunt for /api/open/ endpoints, /webSocket/QT/ paths, JWR-prefixed storage artifacts, and a hard-coded WebSocket token.

GBHackersupdated · 11h agofirst · 13h agoPhishing & fraud in the wild 2 sources

Hackers Deploy Agentic AI to Automate Exploitation and Mass Credential Harvesting

Google GTIG documents a financially motivated actor using a multi-agent AI framework to automate credential harvesting, compromising over 23,800 secrets within hours.

Google Threat Intelligence Group (GTIG) documented a financially motivated actor that compromised an unnamed organization's cloud infrastructure and used a multi-agent AI framework to automate vulnerability scanning, credential harvesting, troubleshooting, and IP rotation. The operation went from planning to mass credential compromise in under six hours, harvesting more than 23,800 secrets including cloud and AI-service API keys via an exposed C2 dashboard called 'Recon'. The actor directed specialized agents using an AI coding chatbot and Markdown instruction files such as AGENTS.KNOWLEDGE.md and agentic_vuln_research.md. Google has not observed fully autonomous zero-day exploitation; the shift automates labor-intensive tasks like reconnaissance, account validation, and infrastructure management, sharply shrinking detection windows.

GBHackers · 1d agoThreat actor in the wild1