Under-resourced organizations including K-12 schools, municipalities, counties, and nonprofits face significant cybersecurity challenges with limited budgets and staff expertise. A dedicated research hub now provides free, practical cybersecurity guidance specifically designed for organizations without dedicated security teams.

Salt Typhoon and Volt Typhoon, two sophisticated state-sponsored threat actors, have demonstrated the ability to compromise critical infrastructure networks and exfiltrate sensitive data in approximately 39 seconds. These campaigns target power grids, telecommunications networks, and water systems with precision and speed.

A sophisticated malware campaign leveraging Quasar Linux has emerged with specific targeting of software developers and DevOps personnel. The threat employs the GoGra variant alongside components including QLNX, NoVoice, and Snow to establish persistence while evading traditional security controls.

Autodownload phishing represents a critical shift in email-based attack methodology. Rather than relying on user clicks, attackers exploit default browser behaviors to automatically download malicious payloads when emails are previewed or opened. This technique bypasses traditional email filtering, user awareness training, and click-based detection systems.

Credit union fraud has shifted from external attacks to credential-based compromise. Fraudsters gain access through employee credentials, shared accounts, and weak authentication controls to manipulate lending systems and steal member data.

Security researchers have identified a critical vulnerability in Microsoft Edge where passwords are stored in process memory, making them accessible to attackers with local system access or malware execution capabilities. This exposure is particularly concerning for energy and utilities organizations, where credential compromise could facilitate lateral movement and data theft.