Since mid-2024, cybercriminals have leveraged a subscription-based phishing platform known as RaccoonO365 to harvest Microsoft 365 credentials at scale.
Emerging as an off-the-shelf service, RaccoonO365 requires minimal technical skill, allowing threat actors to deploy convincing phishing campaigns by impersonating official Microsoft communications.
These kits replicate Microsoft branding, email templates, and login portals to trick recipients into divulging usernames, passwords, and multi-factor authentication (MFA) codes.
As of September 2025, this operation has affected over 5,000 accounts across 94 countries, demonstrating the pervasive risk posed by commoditized social engineering tools.
In a coordinated legal action, Microsoft’s Digital Crimes Unit (DCU) secured a court order from the Southern District of New York to seize 338 domains facilitating the distribution of RaccoonO365, effectively dismantling the platform’s core infrastructure.
Microsoft analysts noted the rapid evolution of this service, which now boasts features that subvert MFA protections and automate credential harvesting at rates up to 9,000 targets per day.
The seized domains served as both phishing hosts and command-and-control interfaces for subscription management, crippling the ability of subscribers to launch fresh attacks.
Although not all stolen credentials resulted in direct network intrusions, the impact on high-value sectors, particularly healthcare, was severe.
At least 20 U.S. healthcare organizations reported delayed patient care, compromised lab results, and data breaches following successful RaccoonO365 phishing attempts.
Microsoft’s partnership with Health-ISAC underlined the public safety implications, as stolen credentials often served as initial access points for subsequent malware or ransomware deployments.
The DCU’s swift intervention illustrates the necessity of legal and technical countermeasures against low-barrier tools that empower malicious actors.
Microsoft analysts identified Joshua Ogundipe, a Nigeria-based developer, as the principal architect of RaccoonO365.
Through an operational security lapse revealing a cryptocurrency wallet, investigators traced over US$100,000 in subscription payments.
Ogundipe’s Telegram channel, with more than 850 members, advertised both standard phishing kits and a newly introduced “AI-MailCheck” service designed to refine spear-phishing efficacy.
This attribution underscores how streamlined criminal enterprises can scale with minimal overhead, challenging defenders to anticipate modular threat services.
Infection Mechanism Deep Dive
RaccoonO365’s infection mechanism revolves around dynamic form injection and transparent redirection tactics.
When a victim clicks a malicious link, the browser is redirected to a decoy login page that mirrors Microsoft’s official portal.
RaccoonO365 login page (Source – Microsoft)
A small JavaScript snippet, injected at runtime, captures input fields and forwards credentials to the attacker’s server:-
This code ensures seamless data exfiltration while redirecting users to the legitimate login page, minimizing suspicion.
Advanced operators employ session-token reuse and header manipulation to bypass MFA prompts.
RaccoonO365 advertising of a new AI-enabled service (Source – Microsoft)
Combined with automated email distribution and AI-driven content variation, this infection chain exemplifies modern phishing sophistication and underscores the critical importance of layered defenses and user awareness.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
The digital advertising ecosystem has become a prime hunting ground for cybercriminals, who are increasingly exploiting advertising technology companies to distribute malware and conduct malicious campaigns.
Rather than simply abusing legitimate platforms, threat actors are now operating as the platforms themselves, creating a sophisticated web of deception that leverages the inherent complexity and fragmentation of the adtech supply chain to avoid accountability.
Recent investigations have uncovered a massive operation involving Vane Viper, a threat actor that has appeared in approximately half of customer networks monitored by security researchers, generating about one trillion DNS queries over the past year.
This operation benefits from hundreds of thousands of compromised websites and strategically placed advertisements across gaming, shopping, and blog sites worldwide.
The actor’s infrastructure spans approximately 60,000 domains, representing only a fraction of the broader malicious ecosystem they control.
The sophistication of this campaign lies in its carefully constructed corporate structure designed for plausible deniability.
Corporate filings trace Vane Viper to AdTech Holding, a Cyprus-based company whose flagship subsidiary, PropellerAds, operates as both an advertising network and traffic broker.
Key company relationships (Source – Infoblox)
Infoblox researchers identified compelling evidence suggesting that PropellerAds has moved beyond merely turning a blind eye to criminal abuse of their platform, with indicators pointing to several ad-fraud campaigns originating directly from infrastructure attributed to the company.
The malvertising operation employs a complex traffic distribution system (TDS) that routes users through multiple layers of redirection before delivering malicious payloads.
This approach allows the actors to serve legitimate content to automated security tools while directing human users to malicious destinations.
The campaign’s reach extends beyond traditional malware distribution, encompassing fake shopping sites, fraudulent browser extensions, survey scams, and adult content designed to maximize profit from compromised traffic.
Push Notification Persistence Mechanism
The most insidious aspect of Vane Viper’s operation involves the abuse of browser push notifications to achieve persistent access to victim devices.
The campaign utilizes malicious service workers, JavaScript files that intercept network requests between web applications and servers, to manipulate browser behavior and maintain long-term access to compromised systems.
PropellerAds displaying where they sit in the digital advertising ecosystem (Source – Infoblox)
These service workers employ script chaining techniques to abuse push notifications, with the most concerning element being their use of the eval() function to execute arbitrary content fetched from remote URLs.
The remote URL is determined by hardcoded domains within the service worker, creating a dynamic command and control mechanism that can adapt to changing operational requirements.
Once users accept push notifications, their devices become part of a persistent malvertising network, enabling a continuous stream of malicious advertisements.
The operation demonstrates remarkable resilience through its domain management strategy, cycling through thousands of newly registered domains each month while maintaining key push notification domains for years.
Analysis reveals that most operational domains remain active for less than a month, with registration counts reaching 3,500 domains in peak months, while core infrastructure domains like omnatuor.com, propeller-tracking.com, and various push notification services including in-page-push.com and pushimg.com have maintained operations for over 1,200 days, ensuring operational continuity despite takedown attempts.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
The PureHVNC remote administration tool (RAT) has emerged as a sophisticated component of the Pure malware family, gaining prominence in mid-2025 amid an uptick in targeted intrusion campaigns.
Originating from underground forums and Telegram channels, PureHVNC is marketed by its author, known as PureCoder, alongside companion tools such as PureCrypter, PureLogs, and PureMiner.
Its adoption by cybercriminal customers reflects a growing demand for modular malware suites capable of stealthy full system control and data exfiltration.
Initial deployments have leveraged the ClickFix phishing technique, luring victims with counterfeit job offers to execute malicious scripts, setting the stage for multi-stage intrusions.
In one notable incident, attackers deployed a Rust Loader, followed by PureHVNC RAT and the Sliver command-and-control framework over an eight-day window.
Check Point analysts noted that during this campaign, PureHVNC communicated with its control server to retrieve three GitHub URLs hosting supporting modules, directly implicating the developer’s own GitHub accounts in the malware’s operational infrastructure.
These GitHub repositories contained browser driver executables and plugin files essential for TwitchBot and YouTubeBot functionalities, illustrating an unusual developer-sourced supply chain for malware support files.
Beyond its initial infiltration tactics, PureHVNC demonstrates advanced capabilities for persistence and privilege escalation.
Upon execution, the RAT registers itself via scheduled tasks named to mimic legitimate Google Updater services, ensuring resilience across reboots.
Infection chain (Source – Check Point)
If running without administrative privileges, it prompts a UAC elevation loop using PowerShell:-
Once elevated, the loader establishes a mutex (MistyRoseNavy) to prevent duplicate execution and creates a scheduled task with a one-minute repetition interval.
ClickFix Prompt (Source – Check Point)
This approach, combined with AMSI bypass via an LdrLoadDll hook, allows PureHVNC to remain undetected by real-time defenses while maintaining control of the endpoint.
Infection Mechanism
PureHVNC’s initial loader is a .NET assembly delivered by the Rust Loader shellcode. The loader decrypts its payload using ChaCha20-Poly1305, validates payload size against a 1 KB threshold, and allocates executable memory to host the decrypted .NET assembly.
The embedded assembly is then loaded and executed, initializing the RAT’s main loop. Communication is established over SSL streams, where the bot sends Gzip-compressed system information—including OS version, installed antivirus products, and metadata like campaign ID—to the C2 server.
Incoming commands are received as compressed buffers, decompressed, deserialized, and dispatched to plugin threads for execution.
By segmenting payload delivery and employing encryption and compression, PureHVNC evades static signature detection and complicates network-based discovery, underscoring its stealthy infection mechanism.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
Decades-old defense contractors are leaning into the Pentagon’s new focus on startups, entwining themselves with emerging companies that have the technologies or even the contracts they seek. “We're making bets in advance on specific capabilities and then going back to the market to say, ‘Who are the founders, and who are taking novel approaches to building something that is unique and different and can be applied within a military context?’” said Brian McCarthy, Booz Allen Hamilton’s managing partner of ventures.
The trend reflects the Pentagon’s new urgency to expand the military’s industrial base and bring in more tech companies. A series of recent directives from Defense Secretary Pete Hegseth and other administration officials have prodded the Pentagon to more aggressively pursue commercial technologies, enable lower-level commanders to make their own purchases, and to use simpler contracting methods that are friendlier to would-be contractors. Defense One’s Patrick Tucker has more, here.
Pentagon CTO wants AI on every desktop in 6 to 9 months. “We want to have an AI capability on every desktop—3 million desktops—in six or nine months,” Emil Michael, defense undersecretary for research and engineering, said at a Politico event on Tuesday. “We want to have it focus on applications for corporate use cases like efficiency, like you would use in your own company…for intelligence and for warfighting.”
Michael was handed oversight of the Pentagon’s main AI body—the Chief Digital and Artificial Intelligence Office—in August, after it was demoted from reporting to Deputy Defense Secretary Stephen Feinberg. (Michael was also appointed acting DIU chief after that office’s chief resigned a few weeks ago.)
CDAO will become a research body like the Defense Advanced Research Projects Agency and Missile Defense Agency, Michael said Tuesday. “To add AI to that portfolio means it gets a lot of muscle to it,” he said. “So I'm spending at least a third of my time—maybe half—rethinking how the AI-deployment strategy is going to be at DOD.” Nextgov’s Alexandra Kelley has more, here.
Nov. 10 is the start date for implementing the Defense Department’s new cyber and supply-chain security standard for the entire industrial base. That’s when Cybersecurity Maturity Model Certification 2.0 standard will begin to appear in DOD solicitations, almost six years after Pentagon leaders began talking about it. Washington Technology has a bit more, here.
And for your ears only, space policy and budget wonk Todd Harrison unpacked his latest report on “Golden Dome” during a discussion with James Lindsay of the Council on Foreign Relations on Tuesday. You can hear that via CFR, here.
Welcome to this Wednesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1939, the Soviets invaded Poland from the east—16 days after the Nazis invaded Poland from the west.
Around the world
Developing: The Trump administration could soon send the first batch of weapons for Ukraine that have been paid for by NATO allies,Reuters reported Tuesday.
The shipments fall under what’s called a Prioritized Ukraine Requirements List, or PURL. And so far, there are only two shipments cleared, which are worth about $500 million each and reportedly include air defense equipment to help Ukraine defend against the constant onslaught of Russian drones and missiles.
New: Taiwan showed off the first missile to be jointly manufactured with Anduril,Reuters reported Wednesday from Taipei. It’s called the Barracuda-500, which Anduril says has a range of more than 500 nautical miles and can carry a payload weighing more than 100 pounds. Reuters calls it “an autonomous, low-cost cruise missile.”
Bigger picture:“Taiwan has set a goal of spending 5% of its GDP on defence by 2030, up from a target of 3.3% next year, and is keen for greater international support aside from the United States,” Reuters adds.
There has been “a fundamental, though little-discussed, change in the administration’s national security focus,” veteran White House reporter David Sanger reported Wednesday for the New York Times. To build his case, he points to the administration’s lack of an updated national-security strategy, which Defense One’s Meghann Myers reported in mid-August.
At its core, the alleged shift concerns the administration’s draft NDS, which focuses on “defending the homeland” above any great-power threats from China or Russia.
“What’s now playing out is the administration’s interpretation of domestic defense,” which started in February with an increase in troops deployed to the southern border, followed by the creation of a militarized border zone in April, Myers reported in August. Less than two months later, Trump ordered the military to support immigration enforcement in Los Angeles—a move that a judge this month declared a violation of law. And just last month, Trump ordered the National Guard to Washington, D.C., ostensibly to “fight crime,” but they’ve since been relegated to spreading mulch and picking up trash around the city as residents have stayed home and businesses have suffered.
By the way, Senate Democrats want a congressional hearing on Trump’s deployment of the military to American cities like Washington, Los Angeles and Memphis. Dems on the Senate Armed Services Committee submitted their request to SASC Chairman Roger Wicker, R-Mississippi, Illinois Sen. Tammy Duckworth said Wednesday.
“The American people deserve clarity on the short- and long-term implications for national security and responsible stewardship of taxpayer dollars of this new focus on a mission usually reserved for law enforcement professionals,” the senators wrote to Wicker. They also note that “in many public statements since his confirmation, Secretary of Defense Pete Hegseth has regularly prioritized the southern border over the Indo-Pacific, despite a bipartisan consensus that U.S. defense policy should focus on the complex security challenges in that region.”
“We call on the Department to explain to Congress and the American people how it plans to resource, execute and justify such a campaign,” the senators write, “and how doing so will impact military readiness, the U.S. military’s execution of core missions of deterring and preparing for war, public trust in our military, implications for servicemembers and their families across the United States and the safety of the American people.”
In addition, the administration has also greenlit a campaign of naval-based attacks in the waters around Latin America. Trump claims he’s so far authorized the military to destroy three boats transporting alleged drug traffickers, though the administration has not offered evidence to back up its claims—and some of those claims took on a different, suspect form when shared with lawmakers—and Pentagon officials have declined to elaborate on the alleged third destroyed boat.
Second opinion: “No president can secretly wage war or carry out unjustified killings—that is authoritarianism, not democracy,” Democratic Sen. Jack Reed, the ranking member of the Armed Services Committee, said in a statement Monday. “These reckless, unauthorized operations not only put American lives at risk, they threaten to ignite a war with Venezuela that would drag our nation into a conflict we did not choose. The American people deserve to know what is being done in their name and why. Congress must demand answers, force transparency, and hold this administration accountable before it plunges us into another needless war,” he added.
Expert reax: Trump “likes shooting at targets that can’t shoot back,” Ivo Daalder, a former U.S. ambassador to NATO, told Sanger. Put simply, the president “sees the threat to the homeland as greater than the threat from China.”
For your radar: “The mystery now is whether Mr. Trump will take the next step,” Sanger writes. And that would include, as he threatened this week after the shooting that killed Charlie Kirk, “using the investigatory powers of the Justice Department, the F.B.I. and other agencies—to implicate nongovernmental organizations and political groups for supporting those he calls ‘leftist radicals,’ and leverage the findings to designate some of them as domestic terrorists.”
Indeed, Trump said Monday he wants to designate several U.S.-based groups as domestic terrorist organizations. “We have some pretty radical groups, and they got away with murder,” Trump told reporters Monday at the White House, without elaborating or fielding any questions for clarification. His Deputy chief of staff Stephen Miller has been pointing a finger at Democrats for several weeks, claiming in late August that it is “not a political party. It is a domestic extremist organization.”
Even “The threats of a crackdown have already taken a toll,” the Timesreported Tuesday, citing “A culture of fear among prominent Democratic donors and groups concerned about retribution.” Meanwhile, “Liberal foundation leaders have been in close touch with one another in recent days, beefing up security and discussing a letter of solidarity as they await any Trump administration action.”
Developing: House GOP lawmakers want $30 million for increased personal security, the Wall Street Journal reported Wednesday “as many lawmakers say they have canceled events or changed routines” after Kirk’s death last week in Utah.
One complication: “Party leaders such as [House Speaker Mike Johnson] currently have personal security details. That has fueled criticism from some colleagues that leaders don’t understand their fears,” the Journal writes.
“Somebody’s going to get killed” if lawmakers don’t get a larger ensemble of protective officers following closely while they travel, Tennessee GOP Rep. Tim Burchett said. “Leadership’s got their protective bubble around them. They’re not accosted when they cross the street, and there’s no Capitol Police to be seen. They don’t see that. And it’s falling on deaf ears,” he said.
For what it’s worth, Democratic Sen. Jon Fetterman was not terribly concerned about the issue when speaking to reporters Monday. “If somebody wants to take me out, it would be easy to just pop me,” the Pennsylvania lawmaker said. Read more, here.
And lastly, in case you missed it: “Since 1990, far-right extremists have committed far more ideologically motivated homicides than far-left or radical Islamist extremists,” according to a study published by researchers at the U.S. Justice Department’s National Institute of Justice in June 2024. The authors tallied 227 such far-right attacks that killed more than 520 people. “In this same period, far-left extremists committed 42 ideologically motivated attacks that took 78 lives,” the researchers said.
Trump’s Justice Department has removed the report from its website. Investigative reporter Jason Paladino noticed the omission and wrote about it on Friday. “Militant, nationalistic, white supremacist violent extremism has increased in the United States,” the authors warned in the report. “In fact, the number of far-right attacks continues to outpace all other types of terrorism and domestic violent extremism.”
Fortunately, the study was archived, and can be found (PDF) here.
A critical security flaw has been discovered in Greenshot, a popular open-source screenshot utility for Windows.
The vulnerability allows a local attacker to execute arbitrary code within the Greenshot process, potentially enabling them to bypass security measures and carry out further attacks.
A proof-of-concept (PoC) exploit has been released, demonstrating the severity of the issue. The vulnerability affects Greenshot version 1.3.300, released on August 20, 2025, and all earlier versions.
The flaw has been addressed in the newly released version 1.3.301, and all users are strongly urged to update their software immediately to protect against potential exploitation.
Windows Screenshot Utility Greenshot Vulnerability
The vulnerability lies in the way Greenshot handles inter-process communication. Specifically, it improperly processes data received via the Windows WM_COPYDATA message system.
The application uses BinaryFormatter.Deserialize to process incoming data without first validating its origin or integrity. This oversight means that any local process running with the same user privileges can send a specially crafted message to the Greenshot main window, triggering the vulnerability.
The core of the problem is a logical error in the code’s execution flow. The application deserializes the received data before it checks whether the communication channel is authorized.
Consequently, any malicious code, or “gadget chain,” embedded in the serialized payload executes automatically, regardless of whether the sender is trusted.
This allows an attacker to run their own code under the guise of the legitimate, digitally signed Greenshot application.
The impact of this vulnerability is significant, as it allows for arbitrary code execution within a trusted process. By running malicious payloads inside Greenshot.exe, an attacker can potentially evade application control policies like AppLocker or Windows Defender Application Control (WDAC).
These security systems often work by restricting which executables can run, but they may not monitor the internal behavior of already-trusted applications.
The release of a PoC demonstrates this, showing how a simple payload can launch the Windows Command Prompt (cmd[.]exe) directly from the Greenshot process.
For enterprises, this poses a serious risk. If an attacker gains an initial low-privilege foothold on a workstation, they could leverage the installed Greenshot application to execute code stealthily.
This technique, sometimes referred to as “living inside a trusted app,” can be used for persistence, lateral movement, or as a staging point for more advanced in-process attacks without raising immediate alarms.
No known workarounds exist to mitigate this flaw, making the update to version 1.3.301 the only effective solution.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
In the face of an ever-increasing volume of security alerts, a critical shortage of skilled cybersecurity professionals, and the growing sophistication of cyber threats, Security Operations Centers (SOCs) are often overwhelmed.
This is where Security Orchestration, Automation, and Response (SOAR) tools become a game-changer.
A SOAR platform centralizes security alerts, orchestrates security tools to work together seamlessly, automates repetitive and time-consuming tasks, and enables rapid incident response.
By acting as the connective tissue for an organization’s security stack, SOAR platforms transform reactive security teams into proactive, efficient, and data-driven defenders.
The market for SOAR tools is dynamic and competitive, with vendors offering a wide range of capabilities, from simple, low-code automation to comprehensive, AI-powered incident management.
Choosing the right SOAR platform is a crucial decision that can significantly impact a security team’s efficiency, effectiveness, and overall morale.
This article provides a comprehensive review of the Top 10 Best SOAR tools for 2025, highlighting their unique features, specifications, and ideal use cases to help you make an informed decision.
Why SOAR Is Essential For Modern Security Operations
The need for SOAR is driven by several key challenges in modern cybersecurity:
Alert Fatigue: SOC teams are inundated with thousands of alerts daily, many of which are false positives. SOAR automates the triage and enrichment of these alerts, allowing analysts to focus on real threats.
Tool Sprawl: Security teams often use dozens of disparate tools that don’t communicate with each other. SOAR acts as a central hub, orchestrating these tools to execute a unified response.
Skill Gap: With a shortage of cybersecurity professionals, organizations must find ways to maximize the productivity of their existing teams. SOAR automates manual tasks, freeing up analysts for complex investigations.
Slow Response Times: The longer an attacker is in a network, the more damage they can do. SOAR drastically reduces the Mean Time to Respond (MTTR) to incidents, minimizing the impact of a breach.
The following SOAR platforms are leading the way in helping organizations overcome these challenges and build a more resilient and efficient security posture.
Splunk SOAR is a top choice because it offers one of the most comprehensive and flexible platforms for building security automation workflows.
We chose it for its best-in-class visual playbook editor, which allows teams to build complex automations without extensive coding.
Its ability to integrate with over 700 security tools and platforms makes it a powerful central hub for any security operations team, especially those already heavily invested in the Splunk ecosystem.
Specifications:
Splunk SOAR provides a visual playbook editor for codeless automation, comprehensive case management, and a vast library of app integrations.
Key features include automated playbooks, real-time collaboration with a “war room,” a visual case wall, and performance metrics to measure ROI. It can be deployed both on-premises and in the cloud.
Reason to Buy:
If your organization is already a Splunk customer or needs a highly flexible and customizable SOAR platform with a strong focus on automation, Splunk SOAR is an excellent choice.
It is ideal for mature SOC teams that want to build complex, multi-step workflows and streamline their incident response processes.
Features:
Visual Playbook Editor: Drag-and-drop interface for building complex workflows without code.
Extensive Integrations: Connects with over 700 security tools, including threat intelligence feeds.
Case Management: Centralized case management for tracking, documenting, and analyzing incidents.
Automation: Automates repetitive tasks like alert triage, enrichment, and containment.
Reporting: Provides dashboards and reports to track key metrics like MTTR and analyst productivity.
Pros:
Highly flexible and customizable.
Deep integration with the Splunk platform.
Powerful visual playbook editor.
Large community and a wealth of resources.
Cons:
Can be complex to set up and manage.
Pricing can be high, especially for small teams.
Best For: Organizations with a mature SOC and an existing investment in Splunk that require a highly customizable and robust automation platform.
Palo Alto Networks Cortex XSOAR is a top contender because it tightly integrates security orchestration with threat intelligence, which is a critical differentiator.
We chose it for its open and extensible platform, which allows security teams to automate and orchestrate across Palo Alto Networks and over 700 third-party products.
The platform’s ability to provide a centralized hub for data visibility and action makes it a powerful tool for any SOC.
Specifications:
Cortex XSOAR provides a visual playbook editor, over 700 integrations, and a marketplace with hundreds of pre-built content packs.
It includes a collaborative “war room,” robust case management, and machine learning capabilities for guided automation and incident classification. It supports both cloud and on-premises deployments.
Reason to Buy:
If your organization needs a SOAR platform that provides a single, unified view of security operations, integrates deeply with threat intelligence, and offers a vast library of pre-built content, Cortex XSOAR is an excellent choice.
It is ideal for teams that want to streamline workflows and improve their incident response with a powerful, all-in-one solution.
Features:
Threat Intelligence Management: Integrates threat intelligence into playbooks for informed, automated responses.
Visual Playbook Editor: Drag-and-drop interface with thousands of automatable actions.
Collaborative War Room: Real-time collaboration for incident response.
Extensive Integrations: Connects with over 700 security and IT tools.
AI Assistance: Provides machine learning-powered guidance and incident classification.
Pros:
Tight integration with threat intelligence.
Wide range of pre-built content packs.
Excellent for centralizing security operations.
Strong support for a variety of use cases.
Cons:
Can be a complex platform to learn.
The full feature set can be expensive.
Best For: Organizations that need a comprehensive SOAR platform that tightly integrates with threat intelligence and offers a robust marketplace of pre-built content.
We chose IBM Security QRadar SOAR because it excels in highly regulated environments where compliance and a structured, auditable incident response process are paramount.
The platform’s dynamic playbooks and detailed audit trails make it a top choice for organizations in finance, healthcare, and critical infrastructure.
Its ability to create a clear record of every step of an incident response, from detection to resolution, provides a high level of accountability and visibility.
Specifications:
QRadar SOAR offers dynamic playbooks that adapt to the incident, comprehensive case management, and a breach response module for managing regulatory requirements.
It provides a visual workflow builder, over 300 integrations, and a dashboard for tracking key performance indicators (KPIs). It can be deployed both on-premises and in the cloud.
Reason to Buy:
If your organization operates in a highly regulated industry and needs a SOAR platform that provides robust process management, detailed audit trails, and a strong focus on compliance, IBM Security QRadar SOAR is an excellent choice.
It is ideal for teams that need to standardize their incident response processes and ensure they can meet strict regulatory requirements.
Features:
Dynamic Playbooks: Playbooks that adapt to the specific details of an incident.
Breach Response Module: Manages the entire breach response process, including regulatory notifications.
Comprehensive Audit Trails: Provides a detailed, auditable record of every action taken during an incident.
Case Management: Centralized case management with customizable fields and workflows.
Compliance Automation: Automates tasks related to regulatory compliance and reporting.
Pros:
Strong focus on compliance and process management.
Excellent for creating an auditable record of incident response.
Robust case management and collaboration features.
Deep integration with the IBM Security QRadar ecosystem.
Cons:
Can be a more complex and formal solution.
Requires a significant investment.
Best For: Organizations in regulated industries that need a SOAR platform with a strong focus on compliance, process management, and auditable incident response.
We chose Google Security Operations for its ability to provide a cloud-native, AI-powered SOAR solution that leverages Google’s immense scale and threat intelligence.
The platform’s ability to ingest and analyze vast amounts of data quickly, combined with its AI-powered features for case enrichment and playbook creation, makes it a formidable tool for any modern SOC.
Its intuitive user interface and streamlined analyst experience also help reduce the cognitive load on security teams.
Specifications:
Google Security Operations SOAR provides a visual playbook editor, threat-centric case management, and AI-powered investigation assistants.
It integrates with over 300 security and IT tools and provides a built-in “case wall” for team collaboration. Being a cloud-native platform, it offers high scalability and a serverless architecture.
Reason to Buy:
If your organization is a heavy user of Google Cloud and needs a cloud-native SOAR solution that leverages AI and Google’s threat intelligence, Google Security Operations is an excellent choice.
It is ideal for teams that want to streamline their incident response with a powerful, scalable, and easy-to-use platform.
Features:
Cloud-Native Platform: Leverages Google’s infrastructure for speed and scale.
AI-Powered Assistance: AI assistants for case summaries, recommendations, and playbook creation.
Thread-Centric Case Management: Streamlined incident investigation and response.
Visual Playbook Editor: Intuitive, low-code interface for building automations.
Integration: Connects with over 300 security and IT tools.
Pros:
Excellent scalability and performance.
Powerful AI and machine learning capabilities.
Intuitive and easy-to-use interface.
Deep integration with Google’s security ecosystem.
Cons:
Only available as a cloud-native solution.
Can be a significant investment.
Best For: Cloud-native organizations, especially those using Google Cloud, that need a scalable, AI-powered SOAR solution with an intuitive interface.
We chose Microsoft Sentinel because it provides a highly integrated and cost-effective SOAR solution for organizations that are already using Microsoft Azure and Microsoft 365.
The platform’s tight integration with Azure Logic Apps for playbook creation and its ability to ingest data from across the Microsoft ecosystem make it a powerful and efficient tool for security teams.
Its cloud-native architecture also provides excellent scalability and a pay-as-you-go pricing model.
Specifications:
Microsoft Sentinel’s SOAR capabilities are powered by Azure Logic Apps, which provide a visual playbook editor.
It offers automated incident handling, a wide range of connectors for third-party tools, and a centralized hub for data collection and analysis.
Being a cloud-native platform, it provides excellent scalability and a pay-as-you-go pricing model.
Reason to Buy:
If your organization is a Microsoft-centric environment, Microsoft Sentinel is an excellent choice for a SOAR solution.
It provides seamless integration with your existing tools, a familiar interface, and a cost-effective way to automate your security operations.
It is ideal for teams that want to streamline their incident response and improve their security posture within the Microsoft ecosystem.
Features:
Cloud-Native SIEM/SOAR: Scalable, cloud-native solution with both SIEM and SOAR capabilities.
Azure Logic Apps: Powers playbooks with a visual, no-code/low-code interface.
Extensive Integrations: Connects with a wide range of Microsoft and third-party tools.
Automated Incident Handling: Automatically triggers playbooks based on predefined criteria.
Centralized Data: Ingests data from across the Microsoft ecosystem for a unified view.
Pros:
Cost-effective for Microsoft-centric organizations.
Deep integration with Microsoft’s product suite.
Excellent scalability and a pay-as-you-go model.
Familiar interface for Microsoft users.
Cons:
Less comprehensive for non-Microsoft environments.
The full feature set may require expertise in Azure Logic Apps.
Best For: Organizations with a Microsoft-centric environment that need a cost-effective and highly integrated SIEM and SOAR solution.
ServiceNow Security Operations is a unique SOAR solution because it is built on the ServiceNow platform, which is widely used for IT service management.
We chose it for its ability to automate the entire security incident lifecycle, from detection to resolution, by leveraging the IT workflows and a shared configuration management database (CMDB).
This integration is crucial for organizations that want to break down silos between their security and IT teams and improve collaboration.
Specifications:
ServiceNow SecOps offers security incident response, vulnerability response, threat intelligence, and a SOAR module.
It provides a visual workflow builder, a centralized dashboard for tracking incidents, and a robust CMDB for asset management. It can be deployed both on-premises and in the cloud.
Reason to Buy:
If your organization is already a ServiceNow customer and needs to align its security operations with its IT service management processes, ServiceNow Security Operations is an excellent choice.
It is ideal for teams that want to automate tasks like patching and configuration changes and improve communication and collaboration between security and IT.
Features:
IT/Security Integration: Aligns security incident response with IT workflows.
Vulnerability Response: Prioritizes and automates the remediation of vulnerabilities.
Case Management: Centralized case management with a focus on collaboration and task assignment.
Workflow Automation: Automates repetitive tasks across security and IT teams.
CMDB Integration: Leverages the CMDB to prioritize incidents based on business impact.
Pros:
Deep integration with the ServiceNow platform.
Excellent for breaking down silos between security and IT.
Provides a holistic view of security and IT incidents.
Improves collaboration and communication.
Cons:
Primarily for existing ServiceNow customers.
Can be a complex solution to implement fully.
Best For: Organizations that are already using ServiceNow and need to bridge the gap between their security and IT operations.
We chose Sumo Logic Cloud SOAR for its focus on a cloud-native, AI-powered approach to SOAR.
The platform’s ability to leverage machine learning to distinguish real threats from false positives is a significant advantage for security teams struggling with alert fatigue.
Its “War Room” collaboration feature and open integrations framework also make it a powerful tool for a modern, distributed SOC.
Specifications:
Sumo Logic Cloud SOAR offers an open integrations framework, a visual playbook editor, and a “War Room” for real-time collaboration.
It provides a machine learning-powered engine for threat qualification and a customizable dashboard for tracking performance metrics. As a cloud-native solution, it offers high scalability.
Reason to Buy:
If your organization needs a cloud-native SOAR platform that provides powerful machine learning capabilities for threat qualification and a strong focus on team collaboration, Sumo Logic Cloud SOAR is an excellent choice.
It is ideal for teams that want to reduce alert fatigue and improve their incident response time with a modern, scalable solution.
Features:
Cloud-Native Platform: A highly scalable, cloud-native SOAR solution.
Machine Learning: Distinguishes real threats from false positives to reduce alert fatigue.
Collaborative War Room: Provides a centralized hub for team collaboration.
Visual Playbook Editor: Intuitive, drag-and-drop interface for building automations.
Open Integrations Framework: Connects with a wide range of security tools.
Pros:
Strong focus on machine learning and AI.
Excellent for reducing alert fatigue.
Provides a robust platform for team collaboration.
Highly scalable and easy to deploy.
Cons:
Not available for on-premises deployment.
May be a less known brand compared to competitors.
Best For: Organizations that need a cloud-native SOAR platform with a strong focus on machine learning and team collaboration.
We chose Tines because it is a best-of-breed security automation platform that simplifies the process of getting security tools to communicate with each other.
Its unique, low-code/no-code interface and seven core “agent types” make it incredibly easy for security professionals to build powerful workflows in minutes, not days.
Its ability to solve complex automation challenges with minimal effort makes it an excellent choice for teams that want to start automating quickly without a steep learning curve.
Specifications:
Tines provides a visual “Story” builder with a low-code/no-code interface. It offers over 1,000 integrations with various security and IT tools and a flexible, agent-based architecture.
It can be deployed both on-premises and in the cloud.
Reason to Buy:
If your organization’s primary goal is to automate repetitive security tasks and streamline workflows, Tines is an excellent choice.
It is ideal for teams that need to quickly build and deploy automations for a wide range of use cases, from phishing email triage to endpoint containment.
Features:
Low-Code/No-Code Interface: Visual builder that allows for rapid automation development.
Seven Core Agents: Simplifies automation with a small, powerful set of components.
Extensive Integrations: Connects with over 1,000 security and IT tools.
Story-Based Workflows: Workflows that can be built and deployed in minutes.
Agent-Based Architecture: Flexible and scalable architecture.
Pros:
Incredibly easy and fast to use.
Excellent for building quick automations.
Very flexible and can solve a wide range of problems.
Large number of integrations.
Cons:
Lacks traditional case management.
Requires a different approach than a traditional SOAR platform.
Best For: Security teams that need a powerful, low-code/no-code platform to build and deploy security automations quickly.
Swimlane is a top choice because it goes beyond traditional SOAR by focusing on a holistic approach to security automation.
We chose it for its ability to automate a wide range of workflows, from security incident response to IT operations and HR-related tasks.
The platform’s commitment to empowering security professionals and its flexible, codeless automation platform make it a powerful tool for a modern, high-performing SOC.
Specifications:
Swimlane offers a visual playbook builder, comprehensive case management, and a wide range of integrations.
It provides a centralized dashboard for tracking incidents and a low-code interface for building automations. It can be deployed both on-premises and in the cloud.
Reason to Buy:
If your organization needs a SOAR platform that can automate a wide range of workflows and is designed to improve the efficiency and well-being of your security team, Swimlane is an excellent choice.
It is ideal for teams that want to go beyond simple incident response automation and streamline their entire security operations.
Features:
Holistic Automation: Automates a wide range of workflows, including security, IT, and HR.
Visual Playbook Builder: Drag-and-drop interface for codeless automation.
Comprehensive Case Management: Centralized case management with a focus on collaboration.
Extensive Integrations: Connects with over 500 security and IT tools.
Metrics and Reporting: Provides dashboards and reports to track key metrics.
Pros:
Automates a wide range of workflows beyond security.
Strong focus on improving team efficiency.
Flexible and scalable platform.
Good case management and collaboration features.
Cons:
May be more than what some organizations need.
The focus on a wide range of workflows may make it less specialized.
Best For: Organizations that want to automate a wide range of security and IT workflows to improve the overall efficiency and morale of their security team.
We chose FortiSOAR because it provides a seamless and integrated SOAR solution for organizations that are already using Fortinet products.
The platform’s ability to leverage the Fortinet Security Fabric for a unified view of security, combined with its robust automation capabilities, makes it a powerful tool for a modern SOC.
Its visual playbook editor and comprehensive case management also make it a strong standalone solution.
Specifications:
FortiSOAR offers a visual playbook designer, comprehensive case management, and over 300 integrations with security and IT tools.
It provides a dashboard for tracking key metrics and a wide range of pre-built playbooks. It can be deployed both on-premises and in the cloud.
Reason to Buy:
If your organization is a Fortinet customer and needs a SOAR platform that integrates deeply with your existing security infrastructure, FortiSOAR is an excellent choice.
It is ideal for teams that want to streamline their incident response and improve their security posture within the Fortinet ecosystem.
Features:
Fortinet Security Fabric Integration: Tightly integrated with the Fortinet ecosystem.
Visual Playbook Designer: Drag-and-drop interface for building automations.
Comprehensive Case Management: Centralized case management with a focus on collaboration.
Extensive Integrations: Connects with over 300 security and IT tools.
Threat Intelligence: Integrates with FortiGuard Labs for threat intelligence.
Pros:
Excellent integration with the Fortinet ecosystem.
Robust automation and case management features.
Good for standardizing incident response processes.
Provides a unified view of security.
Cons:
Less comprehensive for non-Fortinet environments.
Can be more expensive.
Best For: Organizations with a Fortinet-centric environment that need a highly integrated and robust SOAR solution.
In 2025, a modern and effective SOC is one that has embraced the principles of security orchestration, automation, and response.
The SOAR tools reviewed in this article represent the best in the industry, each with unique strengths and a clear value proposition.
Whether you need a highly customizable platform like Splunk SOAR, a comprehensive solution with integrated threat intelligence like Palo Alto Networks Cortex XSOAR, or a low-code automation engine like Tines, the right tool for your organization is on this list.
By carefully evaluating your team’s needs, budget, and existing technology stack, you can select a SOAR platform that will not only improve your security posture but also empower your security team to do more with less.
A critical vulnerability has been discovered in WatchGuard’s Firebox firewalls, which could allow a remote, unauthenticated attacker to execute arbitrary code on affected devices.
The flaw, tracked as CVE-2025-9242, has been assigned a critical severity rating with a CVSS score of 9.3 out of 10. WatchGuard disclosed the issue in an advisory, WGSA-2025-00015, released on September 17, 2025, and has already provided patches to resolve the vulnerability.
The vulnerability is an out-of-bounds write issue within the iked process of WatchGuard’s Fireware OS. This process is responsible for handling Internet Key Exchange (IKE), a protocol used to set up secure VPN connections.
An attacker can exploit this flaw without needing any authentication, sending specially crafted data to a vulnerable device.
Successful exploitation allows the threat actor to execute arbitrary code, potentially leading to a complete compromise of the firewall, allowing them to intercept network traffic, pivot to internal networks, or disrupt security operations.
The critical nature of this flaw is reflected in its high CVSS 4.0 score, which indicates a high impact on confidentiality, integrity, and availability.
Affected Configurations and Versions
The vulnerability specifically affects Firebox devices running certain versions of Fireware OS when configured with specific VPN setups. The primary affected configurations are the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 with a dynamic gateway peer.
The advisory also warns of a specific edge case: a Firebox may remain vulnerable if it was previously configured with one of these vulnerable VPN types, even if those configurations have since been deleted, as long as a branch office VPN to a static gateway peer is still active.
The affected Fireware OS versions include 11.10.2 up to 11.12.4_Update1, versions 12.0 up to 12.11.3, and the recent 2025.1 release.
WatchGuard has released patched versions of Fireware OS to address CVE-2025-9242. Administrators are strongly urged to upgrade their devices to the appropriate resolved version as soon as possible.
The recommended versions are 2025.1.1, 12.11.4, 12.5.13 (for T15 & T35 models), and 12.3.1_Update3 for the FIPS-certified release. For organizations that cannot immediately apply the updates, a temporary workaround is available.
This involves implementing WatchGuard’s security best practices for securing branch office VPNs that use IPSec and IKEv2, specifically when configured with static gateway peers. However, applying the official patches is the most effective way to mitigate the risk posed by this critical vulnerability fully.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
In recent weeks, cybersecurity researchers have observed the emergence of XillenStealer, a Python-based information stealer publicly hosted on GitHub and rapidly adopted by threat actors.
First reported in mid-September 2025, the stealer leverages a user-friendly builder GUI to lower the bar for malicious deployment.
Operators can configure exfiltration channels, such as a Telegram bot, and enable modules targeting browsers, cryptocurrency wallets, gaming applications, and messaging platforms.
Delivered as a PyInstaller-packaged executable or run directly with Python, XillenStealer has quickly become a commodity tool in underground markets, underscoring the ongoing professionalization of cybercrime.
Following its initial appearance, Cyfirma analysts noted that the builder interface (builder.py) is protected by a SHA-256 password hash, granting access only to authorized operators.
This design choice not only streamlines stealer customization but also embeds basic access control to prevent casual misuse.
The stealer’s modular architecture allows operators to toggle specific data harvesting capabilities, such as browser cookies, login credentials, system profiling, and screenshot capture.
By integrating native Windows APIs and Python libraries like psutil, browser-cookie3, and pyTelegramBotAPI, XillenStealer assembles a comprehensive snapshot of the compromised host before packaging data for exfiltration.
Upon execution, XillenStealer performs extensive reconnaissance to fingerprint the environment.
It invokes functions such as checkvmsandbox() to detect virtualization or sandbox environments through MAC address prefixes and known process names, invoking the Windows API IsDebuggerPresent to thwart analysis.
Systems that pass these checks proceed to data collection routines, including getbrowserdata(), which decrypts stored credentials from Chromium-based browsers, and getwallets(), which locates and exfiltrates cryptocurrency wallet files.
Once data is consolidated into reports (both HTML and plain text), the stealer segments large archives and uploads them to the attacker’s Telegram chat using the configured bot token.
Infection Mechanism Deep Dive
XillenStealer’s infection mechanism hinges on its integrated builder and persistence setup.
Operators use the GUI to compile malicious payloads into standalone executables via PyInstaller and UPX compression.
XillenStealer (Source – Cyfirma)
After initial execution, the stealer invokes the installpersistence() function to ensure survival across reboots:-
This persistence mechanism ensures that the stealer automatically executes at every user logon, reinforcing stealth by masquerading as a benign maintenance task.
By combining builder-driven payload creation with robust persistence tactics, XillenStealer maintains long-term presence on compromised systems and continues to siphon valuable data until eradicated.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
Since early 2025, cybersecurity analysts have witnessed a marked evolution in the tactics and tooling of MuddyWater, the Iranian state-sponsored Advanced Persistent Threat (APT) group. Historically known for broad Remote Monitoring and Management (RMM) campaigns, MuddyWater has pivoted to highly targeted spearphishing operations and bespoke backdoors. This shift underscores the group’s growing sophistication and its […]
A new report from Entro Labs reveals that one in five exposed secrets in large organizations can be traced back to SharePoint. Rather than a flaw in SharePoint itself, the real culprit is a simple convenience feature: OneDrive’s default auto-sync. When OneDrive silently backs up key folders like Desktop and Documents to SharePoint Online, it […]
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
Yes
No
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)