CybelAngel

In our explainer on why threat actors moved part of their business to Telegram, we covered the structural story: what changed in 2024, why it created an intelligence gap for security teams, and what’s moved to these channels in general (stolen credentials, compromised session tokens, malware configuration files). It’s worth a read if you’re just […]

The post

On August 10, the FBI, CISA, NSA, U.S. Secret Service, and South Korea’s National Police Agency published a joint advisory on Gunra ransomware. Here are the eight things you need to know. 1. Gunra is built on leaked Conti source code and has been running since April 2025 Gunra first appeared in April 2025 as […]

The post

This guide covers how Qilin operates, what its attacks look like from initial access to data leak, and what security teams need to detect it early. What is Qilin ransomware? Qilin, also known as Agenda ransomware, is a cybercriminal group that operates under a ransomware-as-a-service model. It launched as Agenda in August 2022 and rebranded […]

The post

What if proving you are not a robot meant handing an attacker your saved passwords? It started as a routine check for one of our analysts, who was investigating a domain after a defacement attack simply to verify whether the website’s content had been altered. However, instead of the page in question, a browser window […]

The post

Here are the main stories you missed last week. 1. N-able: A “god mode” authentication bypass in N-central gave attackers administrative control of every endpoint an MSP manages The headline: N-able disclosed active exploitation of CVE-2026-18577 on August 2, an authentication bypass vulnerability in N-central that allows any unauthenticated attacker to gain full administrati...