Nimbus Manticore Malware Campaign Puts Defense and Telecom on Alert

 

Nimbus Manticore Intensifies Attacks on Defense and Telecom Sectors With New Malware

The Iranian state-aligned threat actor Nimbus Manticore has escalated its cyber-espionage operations against defense manufacturing, telecommunications, and aviation sectors across Western Europe. Leveraging new malware variants and novel evasion techniques, this advanced persistent threat (APT) group is sharpening its tradecraft to infiltrate high-value targets.

The Hidden Payload: PUP Ads Used for Silent Malware Drops

 

Hackers Exploit PUP Advertisements to Silently Drop Windows Malware

Cybersecurity investigators have uncovered a stealthy campaign in which threat actors are abusing seemingly harmless potentially unwanted program (PUP) advertisements to deliver Windows malware.

MURKY PANDA Cyber Espionage: A New Threat to Government and Professional Services

 

MURKY PANDA: Threat Actor Targeting Government and Professional Services

A sophisticated China-linked threat actor known as MURKY PANDA has emerged as a significant cybersecurity concern, conducting widespread cyberespionage operations against government, technology, academic, legal, and professional services entities across North America since late 2024.

Credential Theft Alert: Microsoft 365 Users Targeted by Multi-Stage Redirect Scams

 

New Phishing Campaign Exploits Link Wrapping to Target Microsoft 365 Users

Cybercriminals are leveraging trusted security tools like Proofpoint and Intermedia’s link wrapping services in a sophisticated phishing campaign aimed at stealing Microsoft 365 credentials.

According to researchers from the Cloudflare Email Security team, attackers are now abusing legitimate email security features to bypass detection and lure users to credential-harvesting pages using a multi-layered redirection technique.

Ingram Micro Faces 3.5TB Data Leak Threat from SafePay Ransomware Group

 

Ingram Micro Faces 3.5TB Data Leak Threat from SafePay Ransomware Group

Some regional websites still recovering as threat actors set August 1 deadline

Cybercriminals behind the recent ransomware attack on Ingram Micro have set a deadline to leak 3.5 terabytes of stolen company data, according to a post published by the SafePay ransomware group on July 29. The attackers say they will release the trove on August 1, escalating the pressure on the global IT distributor in a classic double extortion move.

Golden dMSA Attack Targets Windows Server 2025: Persistent Cross-Domain Threat

 

Golden dMSA: Critical Windows Server 2025 Flaw Enables Cross-Domain Persistence & Enterprise-Wide Exploits

A newly uncovered vulnerability in Windows Server 2025 is raising alarm across the cybersecurity community. Dubbed Golden dMSA, the flaw allows attackers to generate valid passwords for all Delegated Managed Service Accounts (dMSAs) and Group Managed Service Accounts (gMSAs)—opening the door to persistent, cross-domain access across an entire Active Directory (AD) forest.

Critical Bug in ‘mcp-remote’ Allows Remote Code Execution

 

                 

Critical mcp-remote Vulnerability (CVE-2025-6514) Enables Remote Code Execution on Client Systems

Cybersecurity researchers have disclosed a critical remote code execution (RCE) vulnerability in the popular open-source project mcp-remote, tracked as CVE-2025-6514 with a CVSS score of 9.6. This vulnerability allows attackers to execute arbitrary operating system commands when a vulnerable MCP client connects to a malicious or untrusted remote MCP server.