Una señal es cualquier evento operacional detectado en las últimas 24h–30d: CVEs en KEV explotados activamente, advisories de vendor, exposición cloud, ransomware y avisos regulatorios. Cada señal se prioriza por severidad, freshness y match con tu Digital Twin.
Para análisis editorial y noticias generales visita Noticias.
Sin señales activamente explotadas ni parches de emergencia.
Priority Command Strip
Discover muestra 8 señales operativas recientes. Sube a Consultant Pro o Professional Pro para abrir el feed completo, histórico ampliado y el catálogo KEV.
Filtered for operational relevance. Powered by a curated catalog of vulnerability, CERT, vendor and threat-intelligence sources.View methodology →
CVE con evidencia de explotación. Revisar exposición del perímetro.
Akira ransomware affiliates were seen using a new technique to evade endpoint detection and response (EDR), where they rebooted a compromised Windows system into Safe Mode with Networking enabled. According to Huntress, the technique successfully took both its agent and Microsoft Defender’s real-time protection offline. This, the researchers said, gave the attacker a window to operate without endpoint defenses. The incident investigated by Huntress began on August 4 with a credential-spraying attack against an exposed SonicWall SSL VPN. About seven minutes after the failed login attempts began, an attacker successfully authenticated to an account that did not have multi-factor authentication (MFA) enabled, Huntress analyst James Northey said in a blog post. Two hours after authentication was managed, the operator reportedly accessed the domain controller over RDP, performed extensive Active Directory enumeration, and subsequently moved to an application server to archive mapped file shares with WinRAR. The stolen data was uploaded to an attacker-controlled S3 bucket using s5cmd, establishing the data-theft component of a double-extortion attack. Ultimately, AnyDesk was installed on the host machine for persistent remote access and to deliver the Akira ransomware payload. This is when the operator used “msconfig.exe” to force the machine into Safe Mode with Networking, instead of disabling EDR directly. Huntress says this is the first time it has observed Akira using the technique. Safe Mode is becoming a popular ransomware technique Safe Mode is normally a Windows troubleshooting environment that loads only essential drivers and services. That makes it useful to attackers because many third-party security products are excluded from the minimal startup configuration. Anticipating that AnyDesk itself might also be unavailable in Safe Mode, the attackers modified the Safe Boot registry configuration to ensure the remote-access service would start. The approach is not e Vendors: Microsoft, Google, AWS, Oracle, SonicWall, Atlassian, GitHub. DORA relevance: high.
Por qué importa
Explotación reportada sobre Microsoft / Google. Verificar exposición real en el inventario.
Acción recomendada
Avisa a los owners de los stacks Microsoft, Google, AWS, Oracle.
#StopRansomware: Gunra Ransomware DORA relevance: medium.
Por qué importa
CVE con evidencia de explotación. Revisar exposición del perímetro.
Acción recomendada
Revisa la fuente, confirma aplicabilidad y monitoriza guías posteriores.
An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine into Safe Mode with Networking. [...] Vendors: Microsoft, AWS, SonicWall. DORA relevance: medium.
Por qué importa
Explotación reportada sobre Microsoft / AWS. Verificar exposición real en el inventario.
Acción recomendada
Avisa a los owners de los stacks Microsoft, AWS, SonicWall.
Attackers continue to target critical infrastructure and government-linked organizations in the country, mirroring the increased activity across Latin America. DORA relevance: medium.
Por qué importa
CVE con evidencia de explotación. Revisar exposición del perímetro.
Acción recomendada
Revisa la fuente, confirma aplicabilidad y monitoriza guías posteriores.
The ransomware-as-a-service operation is finding success against critical infrastructure targets with leaked Conti code and old flaws in firewalls and VPN appliances. Vendors: Fortinet. DORA relevance: medium.
Por qué importa
Explotación reportada sobre Fortinet. Verificar exposición real en el inventario.
Acción recomendada
Avisa a los owners de los stacks Fortinet.
Disrupting IT systems that support industrial environments can be enough to interrupt production, even when ransomware operators do not gain direct access to industrial control systems (ICS), according to Dragos. The company identified 1,140 ransomware incidents involving industrial organizations in the second quarter of 2026, up 12% from 1,020 in Q1. The figures come from publicly disclosed victim data and posts made by ransomware groups on their data leak sites. Manufacturing accounted for 747 incidents, … More → The post Ransomware gangs don’t need control system access to disrupt industrial production appeared first on Help Net Security. CVEs: CVE-2026-18577. Vendors: Microsoft. DORA relevance: high.
Por qué importa
Explotación reportada sobre Microsoft. Verificar exposición real en el inventario.
Acción recomendada
Comprueba la exposición a CVE-2026-18577 en el inventario de activos y las herramientas de vulnerabilidades.
Cyber defenders need to shake off traditional best practices and switch from reactive patching to building inherently resilient systems in the face of AI-accelerated vulnerability discovery, according to a senior security manager at Microsoft. David Weston, group manager in the Windows team at Microsoft, told delegates at Black Hat USA that traditional approaches to vulnerability remediation fail to work in an era when AI tools are making vulnerability discovery and exploit development cheaper, faster, and more scalable. Weston’s keynote — entitled “The End of Rare: Defending When Offense Is Cheap” — challenged industry vulnerability best practices that Weston said where from a time when developing exploits and mounting attacks was time consuming and expensive. That’s no longer the case, he said. As evidence, Weston explained how the Microsoft Security Response Center (MSRC) is doubling the number of vulnerabilities it processes and patches every six weeks. “That is an incredible number,” he said. “We’re nine times the vulnerability volume that we were in March.” The accelerating pace of vulnerability discovery is “highly correlated” to rising use of increasingly capable AI tools, and presents a cross-industry problem, he said. “These are serious vulnerabilities, the kind that I used to take a year to bespoke craft,” Weston pointed out. “They’re being spit out at industrial speed, and it’s not [just] Windows. You look at Linux, you look at any other operating system out there, I think you’ll see a pretty strong correlation.” Microsoft’s MDASH, short for Multi-model Agentic Scanning Harness, found roughly 200 Linux kernel vulnerabilities in the company’s internal Azure Linux distribution that Microsoft is working with the community to fix. Microsoft also added a new module to MDASH to help its engineers triage vulnerabilities. The technology is capable of turning a static analysis result into proof-of-concept exploit code. “That’s worked much better than we ever thou Vendors: Microsoft, Google, Linux. DORA relevance: high.
Por qué importa
Explotación reportada sobre Microsoft / Google. Verificar exposición real en el inventario.
Acción recomendada
Avisa a los owners de los stacks Microsoft, Google, Linux.
Group-IB researchers discovered WindRelay, a new Android malware built to capture live payment card data over NFC (Near Field Communication) and relay it to attackers in real time. WindRelay is paired with the SpyNote remote access trojan, which gives attackers remote access to a victim’s device. Attack chain overview (Source: Group-IB) How the scam unfolds The scam starts with a phone call, in which the fraudster claims to be from the victim’s bank and says … More → The post New Android malware relays bank cards to fraudsters while victims still hold them appeared first on Help Net Security. CVEs: CVE-2026-20349, CVE-2026-68820. Vendors: Microsoft, Cisco, Google, Salesforce, ServiceNow. DORA relevance: high.
Por qué importa
CVE de alto impacto sobre Microsoft / Cisco. Planificar ventana de parche.
Acción recomendada
Comprueba la exposición a CVE-2026-20349, CVE-2026-68820 en el inventario de activos y las herramientas de vulnerabilidades.