Experienced a breach?
Contact us
Experienced a breach?
CONTACT US
Resource Type
Blog
Threat Reports and Advisories
Guides and tools
Datasheet
Webinars
Topics
Cloud
Incident Response
OT Security
Malware
Vulnerabilities
Attack Techniques
Detection
State Actors
Research
Forensics
Email
Cyber Crime
Ransomware
Mitigation and Response
Managed Detection and Response
Tabletop War Games
Threat Intelligence
Security Mitigation
VMware Security
Artificial intelligence (AI)
Threat Research
Threat Reports and Advisories Attack Techniques Incident Response
php2shell: Two Critical PHP Vulnerabilities Expose Web Servers to Remote Code Execution
Organizations should immediately patch vulnerable PHP installations, investigate for potential compromise, and restrict access to systems that cannot be updated promptly.
Omer Kidron, Roey Bartov
22.10.2026
13 min
Threat Reports and Advisories Attack Techniques Incident Response
Actively Exploited NetScaler Vulnerabilities
Organizations should patch all customer-managed NetScaler ADC and Gateway appliances immediately, investigate for pre-patch compromise, and restrict the appliances' access to sensitive internal systems.
Omer Kidron, Roey Bartov, Josh Geise, Avishay Asido
28.09.2026
11 min
Blog Threat Reports and Advisories Attack Techniques Ransomware Threat Research
Fire Ant Evolves: From Hypervisors to Trusted Infrastructure
First reported in 2025, Fire Ant remained active into 2026. Explore how the threat actor expanded beyond hypervisors into trusted infrastructure, compromising routers, authentication systems, and Linux management hosts to maintain covert access, collect credentials and traffic, and reach connected high-value environments.
Sygnia Team
27.08.2026
35 min
Threat Reports and Advisories Attack Techniques Detection Incident Response Malware Threat Research
Shai-Hulud Returns: When Software Trust Becomes the Attack Surface
The August 2026 Shai-Hulud campaign was more than another npm compromise, it reflected the evolution of software supply chain attacks, where build pipelines and trust mechanisms have become high-value targets.
Omer Kidron, Enterprise Security Expert
Lahav Meir, Senior Enterprise Security Expert
5.08.2026
11 min
Threat Reports and Advisories Attack Techniques Detection
The Mythos Effect: Preparing for AI-Accelerated Exploitation
How Vulnerability Management Programs Must Evolve
The Mythos Effect: Preparing for AI-Accelerated Exploitation
17.04.2026
12 min
Threat Reports and Advisories Attack Techniques Incident Response
Lessons from the Stryker Incident
The Stryker incident demonstrates how attackers can leverage Microsoft Entra ID and Intune as destructive control planes, wiping devices and disrupting operations without deploying malware. This advisory outlines the key tactics observed and provides practical steps to reduce risk and strengthen resilience.
Omer Kidron
22.03.2026
3 min
Threat Reports and Advisories Mitigation and Response
Supply Chain Attacks in Q4 2025: From Isolated Incidents to Systemic Failure Modes 
Supply chain attacks had become a systemic failure mode rather than isolated incidents. Recent campaigns showed attackers exploiting implicit trust in developer tooling, identities, and software distribution to gain quiet, high leverage access downstream, often bypassing multiple defenses at once and exposing the growing risk of trust debt across the software supply chain.
Omer Kidron
27.01.2026
10 min
Threat Reports and Advisories
F5 Breach: Practical Recommendations for Protecting Your Edge Devices and Reducing Supply Chain Risk
A nation‑state actor infiltrated F5’s BIG‑IP development systems, stealing proprietary code and vulnerability data. While no backdoor was found, CISA warned that the stolen intelligence could speed up exploitation of F5 BIG-IP devices and products - placing edge appliances at immediate risk.
Omer Kidron
17.10.2025
5 min
Threat Reports and Advisories Mitigation and Response
16 Minutes to Impact: npm Supply Chain Abuse Deploys crypto-draining malware
A targeted supply chain compromise of an open-source node package manager (npm) resulted in malicious updates to widely used packages, enabling cryptocurrency theft through traffic interception and transaction manipulation of browser-based crypto wallets.
Matan Naftali
11.09.2025
11 min
Threat Reports and Advisories Mitigation and Response
On-Premises SharePoint Server “ToolShell” Backdoor – Advisory for Mitigation and Response
Organizations Urged to Address Critical Security Flaws to Prevent Unauthorized Access to On-Premises SharePoint Servers.
Omer Kidron, Eldad Hoshen, Bettina Cuevas
24.07.2025
6 min
Blog Threat Reports and Advisories Attack Techniques Ransomware Threat Research
Fire Ant: A Deep-Dive into Hypervisor-Level Espionage
Sygnia investigated Fire Ant, a stealthy cyber-espionage campaign targeting VMware ESXi, vCenter, and network appliances. The attackers used hypervisor-level techniques to evade detection and maintain persistent access.
Sygnia Team
24.07.2025
18 min
Threat Reports and Advisories Attack Techniques Cloud Forensics
Oracle Cloud Federated SSO Incident
A reported breach in Oracle Cloud’s authentication system may impact thousands of organizations. While Oracle disputes the claim, intelligence suggests potential exposure. This advisory outlines key actions to assess risk, secure identities, and mitigate threats.
Liran Farazis, Matan Naftali
24.03.2025
7 min
Solutions
Blog Threat Reports and Advisories Attack Techniques Forensics Incident Response Ransomware Threat Research
Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation
Sygnia details Weaver Ant, a China-nexus threat actor infiltrating a major telecom provider. Using web shells and tunneling, the attackers maintained persistence and facilitated cyber espionage. This blog explores their tactics and provides key defense strategies against state-sponsored threats.
Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation
24.03.2025
18 min
Threat Reports and Advisories Attack Techniques Ransomware Security Mitigation Threat Intelligence VMware Security
Breaking the Virtual Barrier: From Web-Shell to Ransomware
VMware VM escape vulnerabilities are being actively exploited, allowing attackers to take control of virtualization layers and deploy ransomware. This advisory explores a real-world attack scenario, defender visibility, and mitigation strategies to enhance security.
Nital Ruzin, Enterprise Security Expert
19.03.2025
17 min
Threat Reports and Advisories
2025 Annual Threat Report
Based on our frontline incident response work throughout 2024, Sygnia’s Threat Report brings you strategies to enhance ransomware readiness, improve identity governance, and secure critical infrastructure. 
2025 Annual Threat Report
3.02.2025
1 min
Blog Threat Reports and Advisories Attack Techniques Detection Mitigation and Response Ransomware
China-Nexus Threat Group ‘Velvet Ant’ Exploits Cisco Zero-Day (CVE-2024-20399) to Compromise Nexus Switch Devices – Advisory for Mitigation and Response
Learn about the forensic investigation by Sygnia, the cyber espionage operation by Velvet Ant, and best practices for safeguarding your network against sophisticated threats.
Sygnia Team
1.07.2024
7 min
Threat Reports and Advisories Attack Techniques Detection Research
Defending Your Network Edge Against the Next Zero-Day Exploit
Learn how to break the endless cycle of vulnerable network edge devices, by combining immediate actions with strategic initiatives to transition from conventional methods to a Zero Trust approach.
Rob Kehl, Haim Nachmias, Omer Kidron
9.04.2024
13 min
Threat Reports and Advisories Attack Techniques Detection Research
XZ Utils Backdoor – Advisory for Mitigation and Response
Organizations Urged to Address Newly Discovered Security Flaw to Prevent Unauthorized Access to Linux Machines.
Lahav Meir, Omer Kidron
2.04.2024
7 min
subsctibe decor
Want to get in touch?
Contact us