The DataSafe Radar Intrusion Desk is the part of the DataSafe Radar newsroom that covers attacks, malware, scams and the groups behind them. It is a newsroom desk, not a single person. Sections: Cyber Attacks, Malware & Ransomware. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 12 articles so far. See the editorial policy or report an error.
Researchers confirm NSO Group’s spyware infected devices of prominent Serbian critics, marking the second known case this year as parliamentary votes approach.
Attackers stole VPN login details from a deceptive site while still providing the genuine, signed WatchGuard installer to avoid suspicion.
Researchers found a shared backend called ROMULUS that lets criminals reuse ClickFix tricks to install various malware on victim computers.
Analysis shows a significant portion of internet routing remains open to forged-origin attacks that bypass standard validation checks.
Rapid7 researchers won a major cybersecurity award for uncovering stealthy sleeper cells embedded deep inside global telecommunications infrastructure.
Investigators tracked how hackers used generative AI to modify code and maintain access to European and Ukrainian government networks despite detection.
Attackers used AI-assisted code to infiltrate government Linux systems, stealing credentials and exfiltrating database contents during a long-running campaign.
Attackers used a memory-only implant to hijack FortiGate processes after stealing credentials from a breached FortiManager, exposing over 500 firewalls.
Citizen Lab researchers found that mercenary spyware is silently installing on devices through digital advertisements, requiring no user interaction to compromise phones.
Attackers tricked admins into handing over VPN login details on a spoofed site before serving the legitimate WatchGuard installer, leaving accounts exposed.
Threat actors used stolen maintainer credentials to inject malicious workflows that exfiltrate CI/CD secrets and hardcoded keys from source code history.
Malware creators are using new techniques to bypass automated security tools that rely on artificial intelligence for detection.