Cybereason

Discover expert insights on the latest cybersecurity trends, challenges, and best practices shaping the industry today. September 22, 2026 | Brandy Wityak, Vinodpal Minhas Sign up to receive the latest security news and trends straight to your inbox from LevelBlue. The First 12 Hours of an Incident Matter More Than the Next 12 Days September 17, 2026 | Bread Fyan When organizations experience a cyberattack, executives often focus on recovery ...

Cybereason are pleased to announce the General Availability of Cybereason On-Prem v23.1. Cybereason On-Prem, (formerly known as Private Infrastructure Protection), brings state of the art Next Generation Antivirus and Endpoint Detection and Response security to organizations with off-line and private networks. Are you from one of the many organizations that are not able to fully adopt public cloud services?

Explore the latest trends, techniques, and procedures (TTPs) our incident response (IR) experts are actively facing with the TTP Briefing Q4 2025, a report built on frontline threat intelligence from our global incident response investigations, enriched by noteworthy detections from our SOC. The TTP Briefing is grounded in real-world investigations led by our global IR and SOC teams across industries and geographies.

In 2026, incident response (IR) will continue its shift away from traditional malware-centric investigations toward identity-driven intrusions, abuse of trusted cloud services, and low-signal, high-impact activity that blends seamlessly into normal business operations. Rather than relying on technical exploits, threat actors are prioritizing legitimate access, persistence, and operational efficiency, enabling them to evade users, security controls, and automated detection.

Flawless detection and protection against the industry’s most rigorous adversary emulation, proving Cybereason’s real-world effectiveness For the first time ever, the MITRE ATT&CK® Enterprise Evaluation addressed sophisticated, multi-platform threats from both financially motivated threat actors and state-sponsored intelligence groups. In this demanding evaluation, Cybereason excelled with 100% detection, 100% accuracy, and 100% SOC efficiency without configuration changes needed.

Cybereason is continuing to investigate. Check the Cybereason blog for additional updates. Critical vulnerability discovered on December 3, 2025 in React that could allow for unauthenticated remote code execution. Cybereason experts have dubbed this vulnerability as trivial to exploit. Issue allows the server to incorrectly trust user-supplied identifiers and fails to verify. Initial working proof of concept is public and attributed to Chinese threat actors.

Acquisition Bolsters LevelBlue’s Position as the World’s Largest Pure-Play MSSP; Adds Strategic Investment from SoftBank Corp., SoftBank Vision Fund 2, and Liberty Strategic Capital Dallas, TX, November 25, 2025 – LevelBlue, the world’s largest pure-play provider of managed security services, today announced it has completed its acquisition of Cybereason, a leading cybersecurity firm known for its advanced Extended Detection and Response (XDR) platform, elite threat intelligence, and digital...

Cybereason Threat Intelligence Team recently conducted an analysis of "The Gentlemen" ransomware group, which emerged around July 2025 as a ransomware threat actor group with relatively advanced methodologies. The Gentlemen group employs a dual-extortion strategy, not only encrypting sensitive files but also exfiltrating critical business data and threatening to publish it on dark web leak sites unless a ransom is paid.

La Jolla, California, November 13, 2025 – Cybereason, a leading global cybersecurity company, today announced the launch of a new Vulnerability Management product, a powerful capability seamlessly integrated into the Cybereason Endpoint Protection Platform (EPP). This new solution is designed to help organizations proactively reduce their attack surface and strengthen their security posture by providing continuous, automated assessment of software vulnerabilities.

The Tycoon 2FA phishing kit is a sophisticated Phishing-as-a-Service (PhaaS) platform that emerged in August 2023, designed to bypass two-factor authentication (2FA) and multi-factor authentication (MFA) protections, primarily targeting Microsoft 365 and Gmail accounts. Utilizing an Adversary-in-the-Middle (AiTM) approach, it employs a reverse proxy server to host deceptive phishing pages that mimic legitimate login interfaces, capturing user credentials and session cookies in real-time.