TL;DR WatchGuard Red Cell researcher Euler Neto investigated three malware campaigns involving VBScript (VBS), revealing how cybercriminals combine phishing, obfuscated scripts, and legitimate Windows components to deliver malicious payloads while evading detection. The research examines Overlord…
Introduction This post is a first-hand experience of all the phishing attempts against me after my data was exposed in four of the recent Trezor-related breaches. All four of these breaches were of Trezor third-party vendors, not Trezor themselves. The post is written as a personal narrative…
72,000 CVEs are projected to be published in 2026, while the median time from vulnerability disclosure to in-the-wild weaponization has fallen to well under 24 hours. Those two figures capture a growing challenge for defenders: more vulnerabilities to manage and less time to respond. Marc and Corey…
Cybersecurity technology continues to improve, but one of the biggest security challenges facing organizations remains surprisingly familiar: human behavior. WatchGuard’s 2026 Cyber Hygiene Report, based on responses from employees at small and midsized businesses across the United States, Europe…
WatchGuard telemetry identified a campaign associated to TimbreStealer, which is known to target companies based in Mexico. This research, conducted by Euler Neto and Cristóbal Tárraga, describes behaviors similar to those observed in a previous campaign documented by Cisco Talos in 2024, which uses…
Most organizations are still focused on stopping attackers at the perimeter. But that’s not how modern attacks are working anymore. In Episode 364 of the 443 Podcast, three stories stood out not as isolated incidents, but as signals of a broader shift in how attackers operate: A potential US ban on…
In Episode 363 of The 443 Podcast, Corey Nachreiner speaks with Kristen Yang, Cybersecurity Analyst & Investigations Lead, about the threats security teams should be paying closest attention to right now. The conversation reinforces an uncomfortable truth for defenders: many successful attacks still…
WatchGuard telemetry identified some malicious files being downloaded by victims, and almost all of them originated in Venezuela, indicating a possible malicious campaign targeting companies in this country. The malicious files are distributed via phishing emails that have a SVG file with a filename…
Three stories, one theme: control planes, supply chains, and human workflows remain high-leverage targets. This Secplicity blog follows the sequence and details covered by Marc Laliberte and Corey Nachreiner in The443 Podcast Episode 360. 1) Cisco Catalyst SD-WAN 0-Day (CVSS 10): What happened Cisco…
Introduction At the turn of the year, we were alerted to a doppelganger domain impersonating WatchGuard’s Mobile VPN with SSL, delivering a malicious spoofed client to steal credentials. Navigating directly to the doppelganger domain resulted in a benign informational WatchGuard VPN page. However…