Threat Intelligence Center

Security researchers have identified a coordinated malware campaign attributed to Dropping Elephant targeting energy sector organizations. The attack chain leverages a China-themed loader mechanism that deploys APPWIZ.cpl and Donut malware to establish persistence and execute secondary payloads. The tradecraft involves editor.

Lorem Ipsum malware represents a watershed moment in cyber attack methodology. Chinese threat groups, North Korean operators, and the Silent Ransom Group have shifted away from social engineering tactics that depend on human error and deception.

Threat researchers have identified a sophisticated campaign where DragonForce actors mask malicious communications through Microsoft Teams relays, using the platform's legitimate infrastructure to hide command-and-control traffic. The attack chain involves ABYSSWORKER and Backdoor.Turn malware variants, along with the vboxrt.

Cisco has released security patches addressing CVE-2026-20262, a critical vulnerability in its SD-WAN infrastructure that security researchers have confirmed is under active exploitation. This flaw affects enterprise organizations relying on Cisco SD-WAN for network connectivity and branch office management.

Security researchers have disclosed two critical vulnerabilities in Microsoft 365 Copilot that could allow attackers to steal sensitive data from enterprise environments. CVE-2025-32711 and CVE-2026-42824 enable one-click exploitation to access emails, files, and multi-factor authentication codes without user awareness.

Over the past three years, adoption of framing protection security headers—including X-Frame-Options and Content-Security-Policy directives—has remained inconsistent across regulated industries. Phishing actors have adapted their tactics to exploit this inconsistency, using clickjacking and frame-injection techniques to bypass authentication flows and credential capture mechanisms.