soc

BitLocker is designed to protect data at rest even when a device is lost, stolen, or powered off, which is why a bypass against that trust model draws immediate attention. The CVE-2026-45585 vulnerability, publicly referred to as YellowKey, is a Windows security feature bypass flaw that Microsoft says can let an attacker with physical access […]

Dark Web Profile: CoinbaseCartel CoinbaseCartel is a financially motivated threat actor that emerged on the Dark Web in September 2025. Unlike traditional ransomware groups, the group does not encrypt victim systems. Instead, it relies exclusively on data theft, threatening to publish exfiltrated data on its dark web leak site unless victims pay a ransom. This […]

CVE-2026-20223: Cisco Secure Workload Auth Bypass Grants Site Admin Access Cisco has patched a maximum-severity vulnerability in Cisco Secure Workload (CSW) Cluster Software tracked as CVE-2026-20223. The issue is an authentication and access-control bypass affecting internal REST API endpoints, and it can allow a remote, unauthenticated attacker to obtain Site Admin privileges. Site Admin is […]

How Dark Data Leaves Security Teams One Step Behind Cyber Threat Intelligence has come a long way. In the past, real-time threat feeds, dark web monitoring, and indicator-sharing platforms were reserved for governments and Fortune 500 companies. Today, 90% of organizations have dedicated CTI resources, according to the 2026 SANS CTI Survey. The tools are […]

CVE-2024-12802: SonicWall SSL-VPN MFA Bypass Persists on Gen6 CVE-2024-12802 is an authentication bypass that can result in an SSL-VPN MFA bypass affecting SonicWall SonicOS / SonicWall SSL-VPN when the VPN is integrated with Microsoft Active Directory (AD) in certain configurations. The issue matters because defenders may think they are protected after upgrading firmware, yet Gen6 […]

Verizon 2026 DBIR: 10 Takeaways You Should Know Verizon’s 2026 Data Breach Investigations Report (DBIR) analyzes more than 31,000 security incidents and 22,000 confirmed breaches across organizations in 145 countries, the largest breach dataset the report has ever examined. This 19th edition marks a clear inflection point: vulnerability exploitation has overtaken credential abuse as the […]

TeamPCP GitHub Breach: Internal GitHub Repositories Allegedly Accessed TeamPCP is back in the headlines, and this time the target is not a plugin, a CI/CD pipeline, or an open-source package. The group is claiming access to GitHub itself, one of the most critical pieces of infrastructure in the global software development ecosystem. This is a […]

B1ack’s Stash Releases 4.6 Million Stolen Credit Cards for Free A notorious Dark Web carding marketplace is making headlines again. B1ack’s Stash, one of the most active illicit card shops on the Dark Web, has announced the free release of approximately 4.6 million stolen credit card records, this time framing it as a response to […]

EDR Terminator Sale, Alleged Adobe Business Leak, Serbia MUP Data Offer, and Argentina BCRA IOMA GDEBA Claims SOCRadar Dark Web Team identified several new underground posts, including a listing advertising a kernel-level “EDR/XDR terminator” package, a separate claim of an 832.87GB “Adobe Business” data collection, and two government-focused datasets involving Serbia’s Ministry of Interior (MUP) […]

A vulnerability affecting Cisco Catalyst SD-WAN Controller has drawn urgent attention after Cisco, Rapid7, and CISA confirmed active exploitation. CVE-2026-20182 is a critical authentication bypass flaw in Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager that carries a CVSS 10.0 score and can let an unauthenticated remote attacker gain administrative privileges on an affected […]