⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
A cybercrime group known as xplogs22 has been targeting Russia and CIS countries with phishing emails delivering XWorm malware, active since November 2023. Previously using Formbook and Snake Keylogger, the group switched to XWorm around July 2025.
This ThreatsDay bulletin covers a range of recent cyber threats including phishing that delivers XWorm and LunaSpy malware, as well as the Toy Ghouls group deploying custom GenieLocker ransomware against Russian sectors. It highlights that many attacks still rely on common weaknesses like reused credentials and abused trust.
This weekly roundup highlights how attackers exploit trust in familiar screens like login pages and install guides. It covers reused credentials, exposed systems, and exploit paths that should have been harder to breach.
<img width="400" height="234" src="https://socprime.com/wp-content/uploads/CVE-2026-20316-400x234.
Cisco released emergency hotfixes for an actively exploited vulnerability (CVE-2026-20316) in Secure Firewall Management Center (FMC) Software, caused by hard-coded credentials. The flaw allows unauthenticated remote attackers to access sensitive data and can be chained with other weaknesses for privilege escalation.
Cisco has released emergency hot fixes for an actively exploited vulnerability impacting Cisco Secure Firewall Management Center (FMC) Software. The issue is caused by static credentials for a low-privileged account and allows an unauthenticated remote attacker to sign in to an affected appliance and access sensitive information.