Loading story…
A roundup of recent developments in information security and detection engineering highlights both evolving cyber threats and the community's response through updated detection rules. Notable news includes AI-powered cyber attacks targeting Russian arms firms, concerns over open-source software supply chain risks raised by U.S. Senate leadership, and the increasing use of automated data analysis in government enforcement. These stories underscore the growing sophistication of threat actors and the need for vigilance in both public and private sector cybersecurity.
In parallel, detection engineering teams released 19 new and 87 updated rules across major platforms such as Sigma, Splunk, YARA, KQL, Elastic, and Sublime Security. Key improvements include expanded phishing detections for services like Monday.com and SendGrid, enhanced rules for defense evasion using Windows processes, and refined cloud threat detection for AWS and Azure environments. These updates aim to improve threat coverage and operational efficiency in response to the latest attack techniques and adversary behaviors.
See real exploitation activity before you spend the cycle.
10 events from the most recent confirmed update back to the earliest known activity.
Russian arms firms were targeted in cyber attacks described as AI-powered and attributed to Paper Werewolf (GOFFEE). The reporting presents this as a current campaign development disclosed in the December 19-21, 2025 roundup.
Following its 2022 ransomware incident, Osaka General Medical Center implemented major IT security improvements. The response was highlighted as a significant post-incident remediation step.
A fraudulent e-apostille website in Bangladesh exposed sensitive data belonging to more than 1,100 citizens. The report identifies the site as the source of the data exposure.
A U.S. shareholder lawsuit was filed against Coupang in connection with a major data leak in South Korea. The filing marked an escalation from the underlying breach to investor litigation.
The U.S. Department of Justice charged 54 individuals allegedly tied to the Tren de Aragua gang for ATM jackpotting attacks using Ploutus malware. The roundup identifies this as a newly reported law enforcement action.
Former Michigan coach Matt Weiss was implicated in hacking incidents involving exploitation of a flaw in the University of Michigan's account recovery system. The roundup reports the implication but does not provide a specific incident date.
Pro-Russian hackers, including the DDoSia group, launched more than 1,200 DDoS attacks against Belgian critical infrastructure. Belgian defenses reportedly repelled all of the attacks.
Between December 15 and December 22, 2025, nine major GitHub repositories were updated with 19 new and 87 modified detection rules across Sigma, Splunk, YARA, KQL, Elastic, and Sublime Security. The changes expanded coverage for phishing, defense evasion, cloud threats, Linux and Windows activity, and malware including the XZ backdoor and GrimResource.
Osaka General Medical Center in Japan was hit by a ransomware attack in 2022. The incident later prompted the hospital to overhaul its IT security measures.
The threat group Paper Werewolf, also known as GOFFEE, was described as having been active since 2022. Later reporting linked it to AI-assisted cyber attacks against Russian arms firms.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Detection engineering communities have released a series of updates and insights aimed at improving threat detection capabilities across multiple platforms. Notable highlights include the integration of chaos engineering principles into incident response playbooks, the use of AI to generate and translate detection rules, and the expansion of community-driven detection content for PowerShell execution, lateral movement, and service installations. These efforts are designed to help security teams stay ahead of evolving attacker techniques and streamline the process of operationalizing threat intelligence. In parallel, major detection rule repositories such as Sigma, Splunk, and YARA have seen significant activity, with dozens of new and updated rules targeting recent exploits and vulnerabilities. Key updates include new Sigma rules for Commvault RCE and GoAnywhere MFT attacks, Splunk content for Oracle E-Business Suite exploitation, and YARA rules for WSUS RCE and WinRAR path traversal. Cloud detection coverage has also been enhanced, with new rules for AWS and Azure environments, and credential dumping detections have been refined to monitor additional processes and command-line flags. These developments collectively strengthen the detection engineering landscape and provide security teams with actionable tools to address current threats.
Jun 29, 2026
Detection engineering teams released several new and updated detection rules across multiple platforms, including YARA, KQL, Fibratus, and Elastic, to address emerging threats. Notable additions include YARA rules for identifying VMware ESXi exploit payloads and the CoralWave loader, which masquerades as a Lenovo DLL to deploy Remcos RAT. Updates to Fibratus rules enhance detection of credential access, MS Office attack chains, and defense evasion techniques, while Elastic introduced a higher-order rule to correlate multiple EDR alerts from the same process tree, improving the identification of related malicious activities. In parallel, recent malware and threat intelligence newsletters highlighted a range of active campaigns and vulnerabilities, such as DNS poisoning by Evasive Panda APT to deliver MgBot, supply chain attacks involving EmEditor and Trust Wallet, and the spread of the RondoDoX botnet exploiting React2Shell. Other reports covered the evolution of APTs like HoneyMyte and Mustang Panda, major data breaches, and the exploitation of critical vulnerabilities like MongoBleed. These updates underscore the rapidly evolving threat landscape and the need for continuous improvement in detection capabilities.
Jun 29, 2026
Several cybersecurity news outlets and newsletters provided updates on recent developments in detection engineering, vulnerability disclosures, and threat intelligence. Notable highlights include the release of new detection rules for phishing, malware, and defense evasion tactics, as well as coverage of significant vulnerabilities such as a Windows Kernel elevation of privilege (CVE-2025-62215), Cisco ASA/FTD VPN bugs, and Citrix NetScaler issues. Additionally, there is discussion of the use of AI agents in security operations and the challenges of integrating such technologies into existing workflows. The updates also mention the addition of a large corpus of breached data to Have I Been Pwned, the emergence of new Android spyware targeting Samsung devices, and the ongoing evolution of detection rules across platforms like Elastic, Splunk, Sigma, and YARA. These weekly digests aim to keep security professionals informed about the latest threats, detection strategies, and operational changes in the cybersecurity landscape.
Jun 29, 2026