logo

Picus Security Articles

ID: afa77780-d5ec-57b6-9e0a-6b27d6387cb9

STIX ID: identity--afa77780-d5ec-57b6-9e0a-6b27d6387cb9

Feed Type: rss

Earliest post: 2024-06-04

Latest post: 2026-08-12

Articles from Picus Security covering automated penetration testing, breach and attack simulation, exposure validation, CTEM, vulnerability exploitation, ransomware, APT groups, and MITRE ATT&CK mapping.

01/01/2020
08/16/2026
Title Date Published ↓Describes IncidentAuthorVisible
Dragon Breath (APT-Q-27): RONINGLOADER and Gh0st RAT Explained2026-08-12True[email protected] (Umut Bayram)True
Gunra Ransomware: Multithreaded ChaCha20 Encryption Explained2026-08-11True[email protected] (Umut Bayram)True
Dropping Elephant (Patchwork): Espionage APT Tactics and Tools2026-08-06True[email protected] (Umut Bayram)True
Meeting Singapore's 2026 CCoP Requirements With Picus2026-08-04True[email protected] (Umut Bayram)True
Minnesota Water Systems Attacks: Internet-Exposed PLCs Under Attack2026-08-03True[email protected] (Umut Bayram)True
Machine-Speed Attacks: Lessons From the Hugging Face Intrusion2026-07-30True[email protected] (Umut Bayram)True
HOLLOWGRAPH Backdoor Turns Microsoft 365 Calendars Into a C2 Channel2026-07-29True[email protected] (Umut Bayram)True
CVE-2026-31635 (DirtyDecrypt) Linux Kernel Privilege Escalation Explained2026-07-29True[email protected] (Umut Bayram)True
INC Ransomware Explained: How It Attacks Healthcare and Education2026-07-29True[email protected] (Umut Bayram)True
Astaroth (Guildma) Uses Steganography and Ngrok for C2 Resilience2026-07-28True[email protected] (Umut Bayram)True
FrigidStealer Explained: macOS Infostealer and Gatekeeper Bypass2026-07-27True[email protected] (Umut Bayram)True
Vidar Malware: How the Multithreaded Windows Stealer Works2026-07-27True[email protected] (Umut Bayram)True
The Day an AI Cheated on Its Exam by Hacking Another Company2026-07-23True[email protected] (Umut Bayram)True
CVE-2026-63030 and CVE-2026-60137 (wp2shell): WordPress RCE Explained2026-07-20True[email protected] (Umut Bayram)True
UNC2891 Bank Heist Explained: CAKETAP Rootkit and Raspberry Pi Attack2026-05-22True[email protected] (Umut Bayram)True
DeepLoad Malware Explained: ClickFix Delivery and Password Stealing2026-05-22True[email protected] (Umut Bayram)True
Fragnesia CVE-2026-46300: Linux Kernel LPE Vulnerability Explained2026-05-21True[email protected] (Umut Bayram)True
What Is an Insider Threat?2026-05-21True[email protected] (Umut Bayram)True
Revisiting Voldemort, HealthKick, and GOVERSHELL: A Technical Retrospective2026-05-20True[email protected] (Umut Bayram)True
Dirty Frag LPE: CVE-2026-43284 and CVE-2026-43500 Deep Dive2026-05-20True[email protected] (Umut Bayram)True
NGINX Rift: CVE-2026-42945 Critical Heap Buffer Overflow Vulnerability Explained2026-05-14TrueHuseyin Can YUCEELTrue
CVE-2026-21509: APT28 Exploits Microsoft Office Zero-day Vulnerability2026-02-04TrueHuseyin Can YUCEELTrue
Is Babuk Back? Uncovering the Truth Behind Babuk Locker 2.02026-02-03True[email protected] (Umut Bayram)True
MITRE ATT&CK T1078 Valid Accounts Explained2026-02-03True[email protected] (Sıla Özeren Hacıoğlu)True
How NetSupport RAT Abuses Legitimate Remote Admin Tool2026-01-29True[email protected] (Umut Bayram)True
HardBit 4.0 Ransomware Analysis2025-12-20TruePicus LabsTrue
Omnissa Workspace One CVE-2025-25231 Path Traversal Exploit2025-12-19True[email protected] (Sıla Özeren Hacıoğlu)True
Olymp Loader: Emerging Malware-as-a-Service Threat in 20252025-11-25True[email protected] (Sıla Özeren Hacıoğlu)True
APT41 Cyber Attacks: History, Operations, and Full TTP Analysis2025-11-24True[email protected] (Sıla Özeren Hacıoğlu)True
Fog Ransomware 2025: Deep Dive into TTPs2025-11-24True[email protected] (Sıla Özeren Hacıoğlu)True
Inside Sandworm: Decade of Cyber Sabotage and Espionage Activity2025-11-19True[email protected] (Sıla Özeren Hacıoğlu)True
FortiWeb CVE-2025-64446 Vulnerability: Path Traversal Leads to Remote Code Execution2025-11-17TrueHuseyin Can YUCEELTrue
DEV-1084 and MERCURY: Inside Iran’s DarkBit Ransomware Operations2025-11-12TruePicus LabsTrue
MalKamak APT’s ShellClient RAT: Inside Operation GhostShell2025-11-11TruePicus LabsTrue
CVE-2025-59287 Explained: WSUS Unauthenticated RCE Vulnerability2025-10-25TruePicus LabsTrue
Predatory Sparrow: Inside the Cyber Warfare Targeting Iran's Critical Infrastructure2025-10-25TruePicus LabsTrue
FIN7 Cybercrime Group: Evolution from POS Attacks to Ransomware-as-a-Service (RaaS) Operations2025-10-24TruePicus LabsTrue
XWorm Rises Again: Dissecting the Modular Malware's V6 Resurrection2025-10-23TruePicus LabsTrue
Earth Krahang APT Group: Global Government Cyberespionage Campaigns (2022–2024) and TTP Analysis2025-10-23True[email protected] (Sıla Özeren Hacıoğlu)True
Storm-2603 Ransomware Campaign Targets Microsoft SharePoint in 2025: Activity and TTP Analysis2025-10-22TrueHuseyin Can YUCEELTrue
WARMCOOKIE: A Technical Deep Dive into a Persistent Backdoor's Evolution2025-10-22True[email protected] (Sıla Özeren Hacıoğlu)True
New Rust Malware "ChaosBot" Leverages Discord for Stealthy Command and Control2025-10-21True[email protected] (Sıla Özeren Hacıoğlu)True
BRICKSTORM Malware: UNC5221 Targets Tech and Legal Sectors in the United States2025-09-25TrueHuseyin Can YUCEELTrue
Malicious Listeners in Ivanti EPMM: How CVE-2025-4427 and CVE-2025-4428 Created Backdoors2025-09-19TrueHuseyin Can YUCEELTrue
Explaining the AI-Assisted Koske Linux Cryptomining Malware Hidden in JPEGs2025-08-29True[email protected] (Sıla Özeren Hacıoğlu)True
CISA Alert AA25-239A: Analysis, Simulation, and Mitigation of Chinese APTs2025-08-28True[email protected] (Sıla Özeren Hacıoğlu)True
Breaking Down Mustang Panda’s Windows Endpoint Campaign2025-08-26True[email protected] (Sıla Özeren Hacıoğlu)True
RingReaper Linux Malware: EDR Evasion Tactics and Technical Analysis2025-08-14True[email protected] (Sıla Özeren Hacıoğlu)True
Raspberry Robin Malware in 2025: From USB Worm to Elite Initial Access Broker2025-08-13True[email protected] (Sıla Özeren Hacıoğlu)True
UNC3886 Tactics, Techniques, and Procedures: Full Technical Breakdown2025-08-12True[email protected] (Sıla Özeren Hacıoğlu)True

1–50 of 69

Built by the dogesec team. Copyright 2026.