security

Axios npm Hijack 2026: Everything You Need to Know – IOCs, Impact & RemediationOn March 31, 2026, a threat actor hijacked the npm account of the lead Axios maintainer and published two malicious versions of one of the world’s most popular JavaScript libraries – Axios (~100M weekly downloads). The malicious versions contained a hidden dependency […]

The beginning of 2026 has brought a wave of zero-day vulnerabilities affecting Microsoft products, including the actively exploited Windows Desktop Window Manager flaw (CVE-2026-20805), the Microsoft Office zero-day (CVE-2026-21509) that prompted an out-of-band fix, and the Windows Notepad RCE bug (CVE-2026-20841). Microsoft’s March Patch Tuesday release keeps defenders busy again, this time shifting attention to […]

Alleged Crypto Leads, Android Spyware, Mossad Leak, Binance Data, Nakamura ListingSOCRadar’s Dark Web Team identified several new underground posts this week, including a global “crypto leads” dataset advertised for sale, an Android spyware listing, and politically framed claims of a Mossad-related database leak. Additional posts promoted an alleged Binance user dataset with PII and login […]

BOSTON, MA — March 12, 2026 — SOC Prime today announced the release of DetectFlow Enterprise, a solution that brings real-time threat detection to the ingestion layer, turning data pipelines into detection pipelines. Running tens of thousands of Sigma detections on live Kafka streams with millisecond MTTD using Apache Flink, DetectFlow Enterprise enables security teams […]

Inside Handala’s Hack on the FBI Director The digital battlefield is heating up, and this time, the crosshairs have landed on one of the highest-ranking law enforcement officials in the United States. In a brazen move that blends cyber espionage with psychological warfare, the hacktivist group known as “Handala” recently breached the personal email account […]

Security teams are no longer short on data. They are drowning in it. Cloud control plane logs, endpoint telemetry, identity events, SaaS audit trails, application logs, and network signals keep expanding, while the SOC is still expected to deliver faster detection and cleaner investigations. That is why SIEM vs log management is not just a […]

How Are You Blocking Open Source Reconnaissance Tools?Today, a large portion of internet traffic is generated by automated systems that continuously scan and interact with internet-facing infrastructure. These systems are known as reconnaissance tools, or benign scanners, and are designed to map the internet for legitimate purposes, such as security research, vulnerability discovery, and service […]

Steady cadence of Android zero-days marked as exploited in the wild makes its path to 2026. Following CVE-2025-Adresse geschuetzt-2025-48572, two Android Framework bugs Google flagged for active exploitation, defenders keep seeing the same familiar pattern. Mobile-chain vulnerabilities can move fast from limited attacks to real enterprise risk when patching lags.  In March 2026, that […] […]

Romania Under DDoS Attacks: Weekly DDoS Threat Intelligence AnalysisAnalysis Period: March 17 – 23, 2026Between March 17 and 23, 2026, SOCRadar identified an extensive coordinated DDoS campaign conducted by the pro-Russian threat actor NoName057(16) using their DDoSia attack tool. The campaign resulted in 13,716 recorded attack entries, targeting 148 unique domains and 134 unique IP […]

Since January 2026, CERT-UA has been tracking a series of intrusions attributed to UAC-0252 and built around SHADOWSNIFF and SALATSTEALER infostealers. The campaigns rely on well-crafted phishing lures, payload staging on legitimate infrastructure, and user-driven execution of disguised EXE files. Detect UAC-0252 Attacks Covered in CERT-UA#Adresse geschuetzt Q2 2025 research by […] The post UAC-0252 […]