Experienced a breach?
Contact us
Experienced a breach?
CONTACT US
Resource Type
Blog
Threat Reports and Advisories
Guides and tools
Datasheet
Webinars
Topics
Cloud
Incident Response
OT Security
Malware
Vulnerabilities
Attack Techniques
Detection
State Actors
Research
Forensics
Email
Cyber Crime
Ransomware
Mitigation and Response
Managed Detection and Response
Tabletop War Games
Threat Intelligence
Security Mitigation
VMware Security
Artificial intelligence (AI)
Threat Research
Threat Reports and Advisories Attack Techniques Incident Response
php2shell: Two Critical PHP Vulnerabilities Expose Web Servers to Remote Code Execution
Organizations should immediately patch vulnerable PHP installations, investigate for potential compromise, and restrict access to systems that cannot be updated promptly.
Omer Kidron, Roey Bartov
22.10.2026
13 min
Threat Reports and Advisories Attack Techniques Incident Response
Actively Exploited NetScaler Vulnerabilities
Organizations should patch all customer-managed NetScaler ADC and Gateway appliances immediately, investigate for pre-patch compromise, and restrict the appliances' access to sensitive internal systems.
Omer Kidron, Roey Bartov, Josh Geise, Avishay Asido
28.09.2026
11 min
Blog Threat Reports and Advisories Attack Techniques Ransomware Threat Research
Fire Ant Evolves: From Hypervisors to Trusted Infrastructure
First reported in 2025, Fire Ant remained active into 2026. Explore how the threat actor expanded beyond hypervisors into trusted infrastructure, compromising routers, authentication systems, and Linux management hosts to maintain covert access, collect credentials and traffic, and reach connected high-value environments.
Sygnia Team
27.08.2026
35 min
Threat Reports and Advisories Attack Techniques Detection Incident Response Malware Threat Research
Shai-Hulud Returns: When Software Trust Becomes the Attack Surface
The August 2026 Shai-Hulud campaign was more than another npm compromise, it reflected the evolution of software supply chain attacks, where build pipelines and trust mechanisms have become high-value targets.
Omer Kidron, Enterprise Security Expert
Lahav Meir, Senior Enterprise Security Expert
5.08.2026
11 min
Blog Attack Techniques Cyber Crime Detection Ransomware
Velvet Ant’s Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected
Discover the detailed forensic investigation by Sygnia into the sophisticated cyber attack by Velvet Ant on a major organization.
Chen Tiktin
8.06.2026
21 min
Threat Reports and Advisories Attack Techniques Detection
The Mythos Effect: Preparing for AI-Accelerated Exploitation
How Vulnerability Management Programs Must Evolve
The Mythos Effect: Preparing for AI-Accelerated Exploitation
17.04.2026
12 min
Threat Reports and Advisories Attack Techniques Incident Response
Lessons from the Stryker Incident
The Stryker incident demonstrates how attackers can leverage Microsoft Entra ID and Intune as destructive control planes, wiping devices and disrupting operations without deploying malware. This advisory outlines the key tactics observed and provides practical steps to reduce risk and strengthen resilience.
Omer Kidron
22.03.2026
3 min
Blog Threat Reports and Advisories Attack Techniques Ransomware Threat Research
Fire Ant: A Deep-Dive into Hypervisor-Level Espionage
Sygnia investigated Fire Ant, a stealthy cyber-espionage campaign targeting VMware ESXi, vCenter, and network appliances. The attackers used hypervisor-level techniques to evade detection and maintain persistent access.
Sygnia Team
24.07.2025
18 min
Threat Reports and Advisories Attack Techniques Cloud Forensics
Oracle Cloud Federated SSO Incident
A reported breach in Oracle Cloud’s authentication system may impact thousands of organizations. While Oracle disputes the claim, intelligence suggests potential exposure. This advisory outlines key actions to assess risk, secure identities, and mitigate threats.
Liran Farazis, Matan Naftali
24.03.2025
7 min
Blog Threat Reports and Advisories Attack Techniques Forensics Incident Response Ransomware Threat Research
Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation
Sygnia details Weaver Ant, a China-nexus threat actor infiltrating a major telecom provider. Using web shells and tunneling, the attackers maintained persistence and facilitated cyber espionage. This blog explores their tactics and provides key defense strategies against state-sponsored threats.
Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation
24.03.2025
18 min
Threat Reports and Advisories Attack Techniques Ransomware Security Mitigation Threat Intelligence VMware Security
Breaking the Virtual Barrier: From Web-Shell to Ransomware
VMware VM escape vulnerabilities are being actively exploited, allowing attackers to take control of virtualization layers and deploy ransomware. This advisory explores a real-world attack scenario, defender visibility, and mitigation strategies to enhance security.
Nital Ruzin, Enterprise Security Expert
19.03.2025
17 min
Blog Attack Techniques Detection Forensics Incident Response Malware Managed Detection and Response Research
A Surge in Identity-based Attacks: Cybersecurity trends from Sygnia’s new 2025 Threat Report
Explore key cybersecurity trends for 2025, including ransomware evolution, supply chain vulnerabilities, and identity-based threats. Discover actionable strategies and expert insights to strengthen your organization’s resilience.
Sygnia Team
2.02.2025
5 min
Solutions
Webinars Attack Techniques Cyber Crime Ransomware
On-Demand Webinar – Is Your Business Ready for the Next Nation-State Level Cyber-Attack?
Gain valuable insights from cybersecurity experts on evolving tactics, real-world attack scenarios, and proactive defense strategies.
On-Demand Webinar – Is Your Business Ready for the Next Nation-State Level Cyber-Attack?
18.09.2024
1 min
Blog Attack Techniques Cyber Crime Detection Ransomware
China-Nexus Threat Group ‘Velvet Ant’ Leverages a Zero-Day to Deploy Malware on Cisco Nexus Switches
Sygnia uncovers the China-Nexus group ‘Velvet Ant’ leveraging a zero-day exploit (CVE-2024-20399) on Cisco Switch appliances, escalating evasion tactics to maintain long-term network persistence.
Sygnia Team
22.08.2024
9 min
Blog Threat Reports and Advisories Attack Techniques Detection Mitigation and Response Ransomware
China-Nexus Threat Group ‘Velvet Ant’ Exploits Cisco Zero-Day (CVE-2024-20399) to Compromise Nexus Switch Devices – Advisory for Mitigation and Response
Learn about the forensic investigation by Sygnia, the cyber espionage operation by Velvet Ant, and best practices for safeguarding your network against sophisticated threats.
Sygnia Team
1.07.2024
7 min
Blog Attack Techniques Cyber Crime Detection Ransomware
China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence
Discover the detailed forensic investigation by Sygnia into the sophisticated cyber attack by Velvet Ant on a major organization.
Sygnia Team
3.06.2024
22 min
Blog Attack Techniques Incident Response
Navigating the Digital Minefield
Part 1: A Thrilling Guide to Mastering Cyber Crisis Management. Explore real-world cyber crises reimagined as high-stakes dramas, from WannaCry to Target's breach.
Fred Metcalf
20.05.2024
7 min
Blog Attack Techniques Detection Ransomware
ESXi Ransomware Attacks: Evolution, Impact, and Defense Strategy
Understand how ransomware attacks unfold in virtualized environments, and how to defend against these attacks across each phase of the cyber-attack kill chain.
Nital Ruzin, Omer Kidron
15.05.2024
16 min
subsctibe decor
Want to get in touch?
Contact us