ServicesBlogPricingContactContact Now

Grivyonx Intelligence Hub

Cyber Security News and Analysis - Page 7

Zero-days, ransomware, data breaches and active exploitation, explained with practical defence advice.

Cyber Security

Teen Arrested in Spain Over KillSec Ransomware Allegations

Spanish law enforcement announced the arrest of a 16‑year‑old suspected of being the operator behind the KillSec ransomware syndicate. The teenager was detained alongside two other individuals during a coordinated raid on September 30, during which authorities also seized the group’s leak website and associated servers. KillSec has been linked to a series of data‑theft extortion campaigns, threatening to publish stolen corporate information unless victims paid a ransom. The operation marks a rare case where a minor is alleged to have led a sophisticated ransomware outfit.

By Gourav Rajput

Cyber Security

Warlock Ransomware Strikes Spanish and Portuguese Enterprises

A Chinese‑linked threat group, active for about a year, has begun using Warlock ransomware to target large organisations in Spain and Portugal. The actor blends typical cybercrime motives with state‑associated techniques, creating a hybrid threat that challenges traditional defence models. This article breaks down the group's behaviour, its impact on Iberian businesses, and practical steps organisations can take to bolster resilience.

By Gourav Rajput

Cyber Security

Modernizing Software Supply Chains in Financial Services

Financial institutions face a persistent standoff between security mandates and engineering realities. Every vulnerability remediation request collides with platform upgrade costs, regression testing burdens, and rigid change-freeze calendars. The result? Exceptions, compensating controls, and perpetually deferred fix dates that leave critical assets exposed. Breaking this cycle requires a fundamental shift: treating the software supply chain as a first-class production system rather than an afterthought. By embedding automated policy enforcement, continuous SBOM generation, and real-time provenance verification into the delivery pipeline, firms can eliminate entire vulnerability classes without grinding development to a halt.

By Gourav Rajput

Cyber Security

CISA Flags Critical Cisco SD-WAN Flaw Under Active Attack

The U.S. Cybersecurity and Infrastructure Security Agency has added a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities catalog. Tracked as CVE-2026-76504 with a CVSS score of 9.8, the flaw allows unauthenticated remote attackers to compromise affected systems. Federal agencies now face a mandatory remediation deadline as threat actors actively exploit this weakness in the wild.

By Gourav Rajput

Cyber Security

Apple CoreGraphics PoC Reveals New Threat Vector

Researchers have published a proof‑of‑concept for CVE‑2026‑86950, an Apple CoreGraphics vulnerability allegedly leveraged in targeted attacks. A malicious PDF with a crafted embedded font triggers crashes on unpatched iPhones and Macs, indicating a stealthy delivery method.

By Gourav Rajput

Cyber Security

Bitget Deciphers $387M Heist Linked to Third-Party Security Flaw

A major cryptocurrency exchange, Bitget, has confirmed that its $387.5 million theft originated from a zero-day vulnerability in third-party security products. Investigation by SlowMist revealed malicious activity tied to this flaw, highlighting growing risks in decentralized finance ecosystems.

By Gourav Rajput

Cyber Security

MetaMask Security Breach Sparks Ethereum Validator Exodus

MetaMask has confirmed an ongoing security incident impacting part of its infrastructure, prompting affected Ethereum validators to exit the network. The wallet provider assures users that no immediate threat to individual wallets has been identified while remediation efforts continue.

By Gourav Rajput

Cyber Security

Malicious Custom GPTs Weaponized for RAT Delivery via ClickFix Tactics

A new wave of attacks leverages OpenAI's Custom GPT feature to distribute remote access trojans through deceptive ClickFix-style lures. By abusing legitimate OpenAI and Google domains, threat actors create convincing traps that bypass traditional security controls and exploit user trust in AI platforms. Security researchers have identified campaigns where malicious GPTs prompt users to execute PowerShell commands under the guise of fixing technical issues, ultimately deploying malware that grants attackers full system control. This evolution in social engineering demonstrates how generative AI tools are being repurposed as delivery mechanisms for sophisticated payloads.

By Gourav Rajput

Cyber Security

Zimbra Flaw Leads to Web Shell Infiltration

Threat actors have weaponized a patched Zimbra Collaboration Suite flaw to install web shells and harvest authentication secrets. Microsoft’s security team identified the exploit as CVE‑2026‑73570, a critical OS command injection that enables remote code execution.

By Gourav Rajput

Cyber Security

MSP360 Abused in Dual-RMM Phishing to Deploy ScreenConnect

Attackers are exploiting the legitimate MSP360 Remote Monitoring and Management tool to gain unauthorized access through deceptive phishing emails. By masquerading as meeting invitations, PDF documents, and software updates, malicious actors trick users into executing a seemingly benign installer that opens a backdoor for further compromise, including the deployment of secondary remote management solutions like ScreenConnect. This dual‑RMM approach allows attackers to maintain persistence and move laterally within targeted networks.

By Gourav Rajput

Cyber Security

Cisco SD-WAN Manager Critical Flaw Under Active Attack

Cisco has disclosed that threat actors are actively exploiting a critical authentication bypass vulnerability in Catalyst SD-WAN Manager. Tracked as CVE-2024-76504, the flaw allows unauthenticated remote attackers to assume administrative privileges via the management API. With no available workaround, organizations must apply patches immediately to prevent full compromise of their SD-WAN infrastructure.

By Gourav Rajput

Cyber Security

ChatGPT Custom GPTs Weaponized for ClickFix Malware Delivery

Security researchers at Huntress have uncovered a novel campaign where threat actors weaponize ChatGPT Custom GPTs as lures to redirect victims to malicious infrastructure employing ClickFix tactics. This attack chain ultimately deploys a Remote Access Trojan, marking a significant escalation in the abuse of trusted AI platforms for initial access.

By Gourav Rajput

Cyber Security

Browser-Based Attack Techniques Dominating 2026 Threat Landscape

As business operations consolidate entirely within browser environments, threat actors have shifted their focus to exploit this universal attack surface. The browser has become the new endpoint, hosting the entire attack chain from initial compromise to data exfiltration without ever touching traditional network defenses. Security teams must understand six evolving techniques that will define browser-based threats in 2026, ranging from AI-enhanced session manipulation to sophisticated extension supply chain compromises.

By Gourav Rajput

Cyber Security

OpenAI Thwarts Sneaky Model‑Distillation Attack

OpenAI recently dismantled a sophisticated, multi‑stage campaign aimed at siphoning the internal reasoning of its proprietary models through a technique known as model distillation. The operation, which spanned several months, involved a network of actors attempting to reverse‑engineer protected AI logic. The discovery underscores the growing arms race between model creators and those seeking to extract valuable intellectual property from black‑box systems. In response, OpenAI has tightened its protective layers, introduced anomaly detection mechanisms, and shared actionable guidance for the broader research community. The company’s proactive stance not only safeguards its own models but also contributes to the collective resilience of the AI ecosystem, setting a benchmark for defensive strategies in an increasingly contested digital landscape.

By Gourav Rajput

Cyber Security

OpenSSL Patches Critical DTLS Flaw Exposing Heap Memory

The OpenSSL Project has released emergency patches addressing a high-severity flaw in the DTLS protocol implementation. Tracked as a critical logic error during handshake retransmission, the bug allows unencrypted heap memory disclosure to peer endpoints or triggers denial-of-service crashes. Organizations relying on UDP-secured services — from VPNs and VoIP to IoT fleets — must prioritize immediate upgrades to mitigate active exploitation risks.

By Gourav Rajput

Cyber Security

South Africa Air Traffic Control Cyberattack Sparks Global Aviation Security Alarm

A sophisticated ransomware intrusion into South Africa's air traffic management systems has triggered an international scramble to contain the breach and assess operational risks. The incident marks a dangerous escalation in threats targeting aviation's digital backbone, with attackers deploying a full ransomware toolkit directly onto operational networks. As investigators race to determine the attack's scope and attribution, the breach serves as a stark warning that the sky is no longer the limit for cybercriminals targeting critical transportation infrastructure.

By Gourav Rajput