Signed CrossWeb EX Ran the Lazarus FlashHole Implant
Lazarus used CrossWeb EX as a cybersecurity loader in FlashHole. Inventory the bank plugins your endpoints still trust, then cut the exclusions.
October 2026
Your Driver Blocklist Is Hunting the Wrong Thing
Rethink cybersecurity hunts around mute hosts and sensor death. Four checks you can run this week.
Your Ads Delivered the Implant
Cybersecurity teams still treat ads as noise. Candiru used them as zero-click delivery. Fix the browser path.
Your Developers Installed the Implant
Npm hid Windows shellcode in an image decoder. If your cybersecurity program trusts package installs, check the lockfiles first.
One Support Flaw. Whole Fleet Access.
Armory Castle used a BeyondTrust zero-day to own helpdesk hosts. See how that breaks cybersecurity isolation, and what to lock tonight.
Credential Theft Opened Government Linux to Custom Web Shells
AI-powered espionage is dropping web shells on government Linux. See how credential theft outran your cybersecurity stack, then tighten the blast radius.
Five Hundred Firewalls, Zero Disk Artifacts
PEERSTITCH hid in FortiGate RAM across 500+ firewalls. Disk-based cybersecurity hunts will miss it. Audit your edge boxes this week.
AI Reached ICS Controls 16 Minutes After Perimeter Breach
AI crossed OT in 16 minutes while UAT-6275 mapped water plants. Your cybersecurity window just shrank. See what to lock down first.
You Shipped the Laptop to a Stranger
Texas laptop farms turned remote hires into North Korean access. See where cybersecurity onboarding actually fails, then audit the endpoints.
The Guilty Plea Doesn’t Slow Your Fraud Queue
Guilty pleas don't drain the mule pipeline. See the cybersecurity work your fraud queue still isn't doing after a dump.