RH-ISAC Supports Launch of National Strategy to Prevent Scams

Fraud and scams are no longer isolated incidents—they’re a national crisis. Every day, criminals steal an estimated $430 million from Americans, exploiting digital platforms, financial systems, and communication networks. These scams fund transnational criminal organizations and erode trust in our economy and institutions. To address this growing threat, the Aspen Institute Financial Security Program has released the proposed National Strategy to…

Read More

CISA and NCSC Release Directives to Address Multiple Cisco Platforms Exploited by Threat Actors

Context CISA has released Emergency Directive 25-03 in response to an advanced threat actor actively exploiting zero-day vulnerabilities in Cisco Adaptive Security Appliances (ASA) devices. This alert comes as the United Kingdom National Cyber Security Centre releases a parallel advisory warning of active exploitation. This persistent threat utilizes new malware strains, RayInitiator and LINE VIPER, to maintain control and…

Read More

Hunting Malware That Hides: 5 Case Studies with 7 Downloadable YARA Rules

Security teams don’t just need alerts, they need answers. At Stairwell, we’ve seen how easily malware evades detection when defenders rely solely on behavior, logs, or static IOCs. Some threats hide inside image files. Others remain dormant for months. Many are missed not because they’re advanced, but because no one was looking in the right…

Read More

Salesloft Drift AI Abused for Further Attacks on Salesforce Environments for Major Cyber Security Firms

Executive Summary A widespread, opportunistic data theft campaign against Salesforce, attributed to the group UNC6395, has expanded in scope beyond initial reports. The attacks leverage compromised OAuth tokens from Salesloft Drift, an AI chat agent, to gain unauthorized access to customer instances of various services, including Salesforce and Google Workspace. Cybersecurity firms Zscaler and Palo Alto Networks have publicly confirmed impact,…

Read More

Colt Technology Services Attack Claimed by Warlock Ransomware, Data Up for Sale

Executive Summary UK-based telecom provider Colt Technology Services has been battling a cyberattack since August 12, 2025, which disrupted several of its support and online platforms for days. Initially described as a “technical issue,” the company later confirmed it was a cyber incident and that customer data was stolen. The WarLock ransomware group has claimed responsibility,…

Read More