Daily Cybersecurity
Threat Intelligence

MediaArena malvertising: why a quarantine isn’t the end of the incident

This article explains that Microsoft Defender's quarantine of BrowserModifier:Win32/MediaArena should not be considered the end of an incident, as the malware establishes persistence within seconds. SOC data shows that by the time quarantine occurs, the payload is already active, requiring further investigation.

MediaArena malvertising: why a quarantine isn’t the end of the incident

The article warns that Microsoft Defender's quarantine of MediaArena malvertising might be too late. The malware establishes persistence within seconds before quarantine, so the incident is still active.

Toy Ghouls’ new toy: the GenieLocker ransomware

The article introduces GenieLocker, a new ransomware family used by the Toy Ghouls group. It targets organizations in the Russian manufacturing sector, using custom builds for Windows and Linux.

Toy Ghouls’ new toy: the GenieLocker ransomware

The GenieLocker ransomware, attributed to the financially motivated Toy Ghouls group (also known as Bearlyfy, Labubu, and Laboo.boo), has been active since March 2026, targeting organizations in the Russian Federation, particularly in the manufacturing sector. This ransomware represents a significant upgrade in the group’s toolkit, as it is a custom-designed encryption Trojan available in PE builds for Windows and ELF builds for Linux and ESXi systems.

Toy Ghouls’ new toy: the GenieLocker ransomware

Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation

Russian hackers linked to the group Laundry Bear (also known as TA488) are exploiting a Microsoft Outlook Web Access (OWA) vulnerability, CVE-2026-42897 (CVSS 8.1), to maintain persistent mailbox access even after credential rotation. The attacks, active since July 2026, target U.S. and European government agencies, as well as telecommunications, financial, hospitality, and aerospace sectors.