On April 27, 2026, a ransomware written in Golang was submitted to VirusTotal that appended the '.sorry' string to the encrypted filenames. Upon initial review, this was not the same as the 2018 Sorry ransomware, which was built using the open-source HiddenTear encryptor. This was novel, and that…
A newly disclosed Windows zero-day, dubbed RedSun, is the latest reminder that attackers do not need to break in if they can simply escalate. Discussed in Episode 367 of The 443 podcast, this vulnerability highlights how trusted system processes can be manipulated to gain full system-level access…
WatchGuard telemetry identified two different phishing campaigns targeting Greek, Spanish, Slovenian, Bosnian and Latin and Central American companies, that use different techniques to delivery FormBook malware. FormBook is a data-stealing malware that targets Windows systems, primarily distributed…
Artificial intelligence is no longer just a productivity multiplier. It is becoming a force multiplier for cybersecurity, and potentially for cyber risk. In Episode 366 of The 443, Marc Laliberte and Corey Nachreiner discuss three developments that together paint a clear picture of where the…
When a high-profile code leak hits the internet, the first reaction is usually fascination. Developers want to inspect it. Researchers want to understand how it works. Security teams want to know whether the exposure creates downstream risk. But threat actors often move faster than all three. That…
Most organizations are still focused on stopping attackers at the perimeter. But that’s not how modern attacks are working anymore. In Episode 364 of the 443 Podcast, three stories stood out not as isolated incidents, but as signals of a broader shift in how attackers operate: A potential US ban on…
The Green Blood Group was both the group name and the encryptor name of this operation. The group, or threat actor, operated for about a month, between January 2026 and February 2026. Although it's likely operations began shortly before that, possibly towards the end of 2025. During that time, at…
WatchGuard telemetry identified some malicious files being downloaded by victims, and almost all of them originated in Venezuela, indicating a possible malicious campaign targeting companies in this country. The malicious files are distributed via phishing emails that have a SVG file with a filename…
In Episode 362 on The 443 Podcast , Marc and Corey unpack three stories that point to a hard truth for defenders: cyber threats are becoming more disruptive, more deceptive, and more scalable. From a major attack affecting medical technology giant Stryker, to a once-legitimate Chrome extension…
The cybersecurity landscape is shifting quickly. In Episode 361 of The443 Podcast, Marc Laliberte and Corey Nachreiner discuss three emerging issues shaping modern security: A critical authentication bypass in a popular JSON Web Token (JWT) library An autonomous AI bot exploiting GitHub repositories…