Backups Are Dead Without Isolation & AI Tools Are the New Wild West

Intelligence

FBI issues advisory on Luna Moth increase in callback phishing

The FBI is warning about 'callback phishing' campaigns run by the Luna Moth group. This is advanced social engineering where victims are tricked into installing legitimate remote-access tools, then hit for a fee. It's a shift from obvious email malware to more sophisticated trust exploitation that can bypass standard email security.

Tools

New Nuclei templates for scanning WSO2 API Manager vulnerabilities

A new pull request adds Nuclei scanning templates for a high-severity vulnerability in the WSO2 API Manager. This is direct, tactical automation for defenders: if you run these stacks, you can now incorporate this scan into your pipeline at speed.

Nuclei template repository receives major vulnerability scanning updates

Another batch of Nuclei templates has been updated to improve scanning for a range of vulnerabilities. This is the community-driven work that keeps offensive tooling in lockstep with the threat landscape. Good for red teams and proactive defenders building automated pipelines.

Threat Intel

Qilin ransomware expands with new Linux encryptor

The Qilin ransomware gang has expanded operations with a new encryptor targeting Linux systems. This is a move to hit critical cloud infrastructure, databases, and hypervisors that often run Linux, broadening the blast radius well beyond Windows endpoints.

Trend

Ransomware campaigns now prioritize destroying cloud backups

Analysis shows ransomware groups are systematically targeting and encrypting cloud backups before hitting production systems. This is a kill-switch tactic designed to eliminate recovery options. If your restore strategy isn't immutable and isolated, you're a primary target.

Vulnerability

Critical vulnerability found in a popular AI coding assistant

Researchers have discovered a critical security flaw in a widely used AI-powered coding assistant. The vulnerability could allow attackers to execute malicious code or steal sensitive data from developer machines. It's another example of how tools meant to boost productivity are becoming a prime attack surface.