SOC status: Operational/Continuous monitoring active
Acronis MDR / XDR available +230 5254 7558
Home/Threat Intelligence
Intelligence hub
Advisories, research and playbooks from the Cybernalyst analysis team. Written for the people who have to act on them, not for a newsletter.
A NetScaler bug that Citrix documented as a crash in June turned out to be unauthenticated remote code execution as root. Exploitation began days after a public write-up, and CISA…
Read advisoryTwo INTERPOL publications this month bear directly on Mauritian businesses. Reported losses across the continent more than doubled to USD 484 million, and an eight-month operation against West African BEC…
Read advisoryA path traversal in the vCenter syslog server went from vendor advisory to mass exploitation in five days. Researchers counted 361 victim addresses across 47 countries, and the implant left…
Read advisoryA six-agency advisory documents Gunra actors deleting backup and archive data on backup infrastructure at both the production data centre and the disaster recovery centre. The same administrative credentials reached…
Read advisoryOperators spoof your help-desk number, call employees on personal phones, and tell them to enrol a passkey immediately. The page is a reverse proxy. Once inside they register their own…
Read advisoryUnit 42 profiled a ransomware-as-a-service operation that claimed around 580 victims across 77 countries in under a year. The growth driver is commercial rather than technical — a 90% affiliate…
Read advisoryAttackers ask Microsoft for a device code, send it to your user, and the user types it into the genuine login page. No password prompt, no MFA challenge, no phishing…
Read advisoryTwo chained flaws gave unauthenticated root on SonicWall's SMA1000 VPN appliances three weeks before a patch existed. Attackers took user credentials and TOTP seeds, which means patching alone does not…
Read advisoryAttackers are chaining a missing-authentication bug, a deserialisation bug and a spoofing bug against on-premises SharePoint, then stealing IIS machine keys so they can forge their own payloads afterwards. One…
Read advisoryGN 117 of 2026 turns a loose expectation under the Data Protection Act 2017 into an enforceable appointment and notification duty. The DPO must be independent, report to the highest…
Read advisorySophos surveyed 2,158 organisations that were actually hit by ransomware. Four in five attacks started with an identity, 97% of credential-driven breaches had MFA enabled, and two thirds of encrypted…
Read advisoryVeeam Backup & Replication took seven critical vulnerabilities in March and another remote code execution flaw in June. Every one of them needs only a low-privilege authenticated domain account —…
Read advisoryManaged clients receive advisories with client-specific exposure detail, ahead of publication, with remediation already scheduled.
Request an assessment