--- title: Morphisec Cybersecurity Blog | Morphisec Labs description: Cybersecurity trends and news, with info about Morphisec, breach prevention, and zero trust endpoint, server, and workload security. --- Recent Webinar: Building an Adaptive Cyber Resilient Cloud ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa) ![close](https://www.morphisec.com/hubfs/close.svg) ![search_icon](https://www.morphisec.com/hubfs/search_icon.svg) [![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com) ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360) [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3) [![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com) ![search_icon](https://www.morphisec.com/hubfs/search_icon.svg) - ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360) - [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3) # BLOGS By Morphisec Labs Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security ## [New Babuk Ransomware Found in Major Attack](https://1534169.hs-sites.com/babuk-ransomware-variant-major-attack) Posted by [Morphisec Labs](https://1534169.hs-sites.com/author/morphisec-labs) on December 7, 2022 [![2022 2023 Babuk Cyber Attack](https://www.morphisec.com/hubfs/2022%202023%20Babuk%20Cyber%20Attack.jpg) ](https://1534169.hs-sites.com/babuk-ransomware-variant-major-attack) During November, Morphisec identified a brand-new variant of [Babuk ransomware](https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk) while investigating a customer's prevention event. Babuk was first discovered at the beginning of 2021, when it began targeting businesses to steal and encrypt data in... [Read More **](https://1534169.hs-sites.com/babuk-ransomware-variant-major-attack) ## [Watch Out for the New NFT-001](https://1534169.hs-sites.com/nft-malware-new-evasion-abilities) Posted by [Morphisec Labs](https://1534169.hs-sites.com/author/morphisec-labs) on September 22, 2022 [![](https://blog.morphisec.com/hubfs/ThreatLabsBlog_NFT-001_Update.png) ](https://1534169.hs-sites.com/nft-malware-new-evasion-abilities) A non-fungible token (NFT) is a record on a blockchain associated with a digital or physical asset—usually a digital file such as a photo, video, or audio. An NFT’s ownership is recorded in the blockchain, and it can be sold and traded. NFTs differ[...](http://%20from%20cryptocurrencies/) [Read More **](https://1534169.hs-sites.com/nft-malware-new-evasion-abilities) ## [Your Guide to Top Infostealers in 2022](https://1534169.hs-sites.com/infostealer-comparison) Posted by [Morphisec Labs](https://1534169.hs-sites.com/author/morphisec-labs) on July 6, 2022 [![](https://blog.morphisec.com/hubfs/shutterstock_1092152978.jpg) ](https://1534169.hs-sites.com/infostealer-comparison) To help protect the public, Morphisec Labs constantly monitors, investigates, and assesses the latest threats to help organizations avoid serious consequences. In recent months, threats involving infostealers have escalated. This report analyzes six... [Read More **](https://1534169.hs-sites.com/infostealer-comparison) ## [New Core Impact Backdoor Delivered Via VMWare Vulnerability](https://1534169.hs-sites.com/vmware-identity-manager-attack-backdoor) Posted by [Morphisec Labs](https://1534169.hs-sites.com/author/morphisec-labs) on April 25, 2022 [![](https://blog.morphisec.com/hubfs/Morphisec_BlogTemplate_VMWare_Backdoor.png) ](https://1534169.hs-sites.com/vmware-identity-manager-attack-backdoor) Morphisec is a world leader in preventing evasive polymorphic threats launched from zero-day exploits. On April 14 and 15, Morphisec identified exploitation attempts for a week-old VMware Workspace ONE Access (formerly VMware Identity Manager)... [Read More **](https://1534169.hs-sites.com/vmware-identity-manager-attack-backdoor) ## [Log4j Exploit Hits Again: Vulnerable Unifi Network Application (Ubiquiti) at Risk](https://1534169.hs-sites.com/log4j-exploit-targets-vulnerable-unifi-network-applications) Posted by [Morphisec Labs](https://1534169.hs-sites.com/author/morphisec-labs) on January 28, 2022 [![](https://blog.morphisec.com/hubfs/Log4j%20Exploit%20-%20Vulnerable%20Unifi%20Network%20Application%20%28Ubiquiti%29%20at%20Risk.png) ](https://1534169.hs-sites.com/log4j-exploit-targets-vulnerable-unifi-network-applications) As a continuation to our previously published [blog post on VMWare Horizon being targeted through the Log4j vulnerability](https://1534169.hs-sites.com/log4j-exploit-hits-again-vulnerable-vmware-horizon-servers-at-risk), we have now identified Unifi Network applications being targeted in a similar way on a number of occasions. Based on... [Read More **](https://1534169.hs-sites.com/log4j-exploit-targets-vulnerable-unifi-network-applications) ## [ProxyShell Exchange Exploitation Now Leads To An Increasing Amount Of Cobaltstrike Backdoors](https://1534169.hs-sites.com/proxyshell-exchange-exploitation-now-leads-to-an-increasing-amount-of-cobaltstrike-backdoors) Posted by [Morphisec Labs](https://1534169.hs-sites.com/author/morphisec-labs) on August 27, 2021 [![](https://blog.morphisec.com/hubfs/Morphisec%20Prevents%20and%20Detects%20Cobaltstrike-1.png) ](https://1534169.hs-sites.com/proxyshell-exchange-exploitation-now-leads-to-an-increasing-amount-of-cobaltstrike-backdoors) On approximately August 21, 2021, security researchers, cybersecurity leaders, and eventually the CISA began voicing concerns about the inevitable threat of LockFile ransomware attacks on a wide variety of ill-informed and unprepared victims. Threat... [Read More **](https://1534169.hs-sites.com/proxyshell-exchange-exploitation-now-leads-to-an-increasing-amount-of-cobaltstrike-backdoors) ## [Real-Time Prevention of the Kaseya VSA Supply Chain REvil Ransomware Attack](https://1534169.hs-sites.com/real-time-prevention-of-the-kaseya-vsa-supply-chain-revil-ransomware-attack) Posted by [Morphisec Labs](https://1534169.hs-sites.com/author/morphisec-labs) on July 5, 2021 [![](https://blog.morphisec.com/hubfs/Morphisec%20Keep%20blocks%20Kaseya%20Attack.png) ](https://1534169.hs-sites.com/real-time-prevention-of-the-kaseya-vsa-supply-chain-revil-ransomware-attack) On July 2, 2021, our Cloud Workload Protection Platform, [Morphisec Keep](https://www.morphisec.com/products/morphisec-keep-server-protection), successfully identified and prevented a REvil ransomware infection in customer domains. This attack was automatically blocked in real time due to Morphisec's proactive... [Read More **](https://1534169.hs-sites.com/real-time-prevention-of-the-kaseya-vsa-supply-chain-revil-ransomware-attack) ## [NanoCore RAT Under the Microscope](https://1534169.hs-sites.com/nanocore-under-the-microscope) Posted by [Morphisec Labs](https://1534169.hs-sites.com/author/morphisec-labs) on October 16, 2019 [![NanoCore RAT](https://www.morphisec.com/hubfs/Blog_images/1-Q3-2019/nano/nanocore2.png) ](https://1534169.hs-sites.com/nanocore-under-the-microscope) In this blog, we will present some findings on how **NanoCore RAT 1.2.2.0** is actively being delivered in new and different ways that we discovered at Morphisec Labs in the last couple of months. Specifically, we will focus on the sophisticated... [Read More **](https://1534169.hs-sites.com/nanocore-under-the-microscope) ## [Morphisec vs. the Microsoft CTF Exploit: Twenty Year Old Design Flaw](https://1534169.hs-sites.com/morphisec-vs.-the-microsoft-ctf-exploit-twenty-year-old-design-flaw-no-match-for-morphisec) Posted by [Morphisec Labs](https://1534169.hs-sites.com/author/morphisec-labs) on August 16, 2019 [![blogpost-image-microsoft-ctf](https://www.morphisec.com/hubfs/Blog_images/1-Q3-2019/blogpost-image-microsoft-ctf.png) ](https://1534169.hs-sites.com/morphisec-vs.-the-microsoft-ctf-exploit-twenty-year-old-design-flaw-no-match-for-morphisec) This week, headlines blew up with warnings of a design flaw in the CTF subsystem (msctf) of the Windows Text Services Framework that affects all current Windows systems and those going back as far as twenty years. [Read More **](https://1534169.hs-sites.com/morphisec-vs.-the-microsoft-ctf-exploit-twenty-year-old-design-flaw-no-match-for-morphisec) ## [New Global Cyber Attack on Point of Sale Systems](https://1534169.hs-sites.com/new-global-attack-on-point-of-sale-systems) Posted by [Morphisec Labs](https://1534169.hs-sites.com/author/morphisec-labs) on February 27, 2019 [![POS Attack](https://www.morphisec.com/hubfs/Blog_images/1-Q1-2019/bloglisting-img-POS-attack.png) ](https://1534169.hs-sites.com/new-global-attack-on-point-of-sale-systems) *This post was authored by**[Michael Gorelik](https://twitter.com/smgoreli) **and**[Alon Groisman](https://twitter.com/alongros)***. Over the past 8-10 weeks, Morphisec has been tracking multiple sophisticated attacks targeting Point of Sale thin clients globally. [Read More **](https://1534169.hs-sites.com/new-global-attack-on-point-of-sale-systems) ## [New Campaign Delivers Orcus RAT](https://1534169.hs-sites.com/new-campaign-delivering-orcus-rat) Posted by [Morphisec Labs](https://1534169.hs-sites.com/author/morphisec-labs) on January 30, 2019 [![Orcus RAT Campaign](https://www.morphisec.com/hubfs/Orcus-RAT-listing.png) ](https://1534169.hs-sites.com/new-campaign-delivering-orcus-rat) *This post was authored by **[Michael Gorelik](https://twitter.com/smgoreli)**, **[Alon Groisman](https://twitter.com/alongros)** and **Bruno Braga***. A new, highly sophisticated campaign that delivers the **Orcus Remote Access Trojan** is hitting victims in ongoing, targeted attacks. Morphisec identified the campaign after... [Read More **](https://1534169.hs-sites.com/new-campaign-delivering-orcus-rat) ## [Threat Alert: Adobe Flash Zero-Day CVE-2018-15982](https://1534169.hs-sites.com/threat-alert-adobe-flash-zero-day-cve-2018-15982) Posted by [Morphisec Labs](https://1534169.hs-sites.com/author/morphisec-labs) on December 5, 2018 [![Flash-zeroday-12-2018](https://www.morphisec.com/hubfs/Blog_images/18-Q4/Flash-zeroday-12-2018.png) ](https://1534169.hs-sites.com/threat-alert-adobe-flash-zero-day-cve-2018-15982) Today Adobe disclosed a new Flash zero-day, releasing a patch for the critical vulnerability in an out-of-band update. Successful exploitation gives attackers the ability to execute arbitrary code on the targeted machine, and eventually assume full... [Read More **](https://1534169.hs-sites.com/threat-alert-adobe-flash-zero-day-cve-2018-15982) ## [Threat Alert: Memory Corruption Vulnerability CVE-2017-11826](https://1534169.hs-sites.com/threat-alert-memory-corruption-vulnerability-cve-2017-11826) Posted by [Morphisec Labs](https://1534169.hs-sites.com/author/morphisec-labs) on December 13, 2017 [![cyber-threat-prplstamp-173977816.jpg](https://cdn2.hubspot.net/hubfs/1534169/Blog_images/17-05/cyber-threat-prplstamp-173977816.jpg) ](https://1534169.hs-sites.com/threat-alert-memory-corruption-vulnerability-cve-2017-11826) Two days ago, researchers at TarLogic published a [proof-of-concept](https://www.tarlogic.com/en/blog/exploiting-word-cve-2017-11826/) APT that leverages CVE-2017-11826, a Microsoft Office 0-day vulnerability existing in all Office versions.  [Microsoft](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11826) issued a patch for the vulnerability in October, however many... [Read More **](https://1534169.hs-sites.com/threat-alert-memory-corruption-vulnerability-cve-2017-11826) [ All posts ](https://1534169.hs-sites.com/all) ### Subscribe to our blog Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates. [![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4) ### Search Our Site ### Recent Posts ### Posts by Tag - [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense) - [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research) - [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news) - [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs) - [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news) - [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management) - [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth) - [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware) - [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security) - [Gartner (10)](https://1534169.hs-sites.com/topic/gartner) - [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem) - [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft) - [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks) - [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity) - [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense) - [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity) - [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security) - [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence) - [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity) - [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware) - [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management) - [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers) [See all](https://1534169.hs-sites.com/author/morphisec-labs#) - [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec) - [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec) - [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw) © 2026 Morphisec Ltd. | All rights reserved ![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png)