Symantec Enterprise Cloud Insights: Type-Specific Updates

Symantec Enterprise Cloud Updates by Year and Month

123 Significant Changes from the Last 6 Months

Date Update Type Description View
07-05-2025 Symantec Blocks Malicious Campaign Exploiting Pahalgam Attack Targeting Indian Government Cybersecurity Threat actors are targeting Indian government personnel with phishing emails disguised as official communications, using decoy PDFs related to the Pahalgam attack to deliver malware. These malicious documents deploy macros that collect and exfiltrate sensitive data while attempting lateral network movement. Symantec’s comprehensive protections, including VMware Carbon Black and Email Threat Isolation, neutralize this threat. Discover how Symantec safeguards against such campaigns at broadcom.com.
06-05-2025 New Malware Threats TerraStealerV2 and TerraLogger Detected by Symantec Company News Two emerging malware families—TerraStealerV2 and TerraLogger—are actively targeting sensitive user data, linked to the Golden Chickens threat group. TerraStealerV2 steals browser credentials and crypto wallet data, while TerraLogger functions as a keylogger without exfiltration. Symantec, supported by Carbon Black and WebPulse, provides layered protection against these evolving threats. Users should update their security tools and stay alert to new malware tactics.
06-05-2025 StealC V2 Malware Adds Advanced Features and Payload Capabilities Cybersecurity The latest version of StealC infostealer introduces advanced features like multi-monitor screenshots, encrypted configuration, and customizable payload delivery using geolocation and hardware IDs. Enhanced with a new JSON-based C2 protocol and improved stealth, it poses a growing threat to systems and user data. Symantec, backed by Carbon Black and WebPulse, offers robust protection across behavior, file, and machine-learning layers. Users are urged to update security tools and remain alert to targeted attacks.
06-05-2025 Symantec IPS Blocks 54.1M Attacks in Week 18, 2025, Safeguarding Endpoints Cybersecurity Broadcom’s Symantec Intrusion Prevention System (IPS) blocked 54.1 million attacks across 340,900 endpoints in Week 18, 2025, with 86.8% stopped before infection, protecting desktops and servers, including Fortune 500 clients. Key threats neutralized include 23.4 million web server vulnerability scans, 5.7 million Windows OS exploit attempts, and 6.4 million malware command-and-control connections. The IPS also thwarted 2 million application vulnerability exploits and 672,100 coin mining attempts, showcasing its robust deep packet inspection capabilities. Businesses are encouraged to enable IPS on all devices and review Broadcom’s setup guide for optimal endpoint security.
06-05-2025 Symantec Endpoint Browser Extensions Block 6.7M Web Attacks Cybersecurity Symantec’s Endpoint Protection (SEP) and Endpoint Security (SES) browser extensions for Chrome and Edge thwarted 6.7 million web-based attacks across 153,600 endpoints, leveraging URL reputation and browser intrusion prevention technologies. The extensions blocked 6.3 million malicious website visits, 268,200 attempts to redirect users to attacker-controlled sites, and 94,200 browser notification scams. Powered by Symantec’s global threat intelligence and deep packet inspection, these tools effectively counter phishing, malware, and script-based threats. Businesses are encouraged to enable browser protection and explore Symantec Browser Protection for enhanced web security.
05-05-2025 Stealerium Malware Targets Taxpayers via Phishing Emails and LNK Files Cybersecurity Cybercriminals are exploiting tax season by using modified Stealerium infostealer malware delivered through phishing emails and malicious LNK files. This threat captures browser data, crypto wallet info, and app credentials, putting users at risk. Symantec offers strong protection through email, file, and web-based security layers, including Carbon Black and Email Threat Isolation. Stay secure by using trusted security tools and staying alert to suspicious tax-related emails.
02-05-2025 Symantec Counters ClickFix Social Engineering Tactic Used by Global APT Groups Company News Advanced persistent threat (APT) groups from North Korea, Iran, and Russia are deploying the ClickFix social engineering tactic, using fake error messages on malicious websites to trick users into running malware via PowerShell scripts. Symantec’s adaptive, email, and web-based protections, including Carbon Black and Email Threat Isolation, effectively block these attacks. This tactic highlights the evolving sophistication of cyber espionage.
02-05-2025 Discovery Bank Targeted in South Africa Smishing Scam Using FICA Compliance Lure What's New Cybercriminals are impersonating Discovery Bank in a smishing campaign targeting South African mobile users, using FICA compliance as a pretext to steal banking credentials via malicious SMS links. The phishing pages, hosted on a German cloud server, mimic the bank’s login portal. Symantec Endpoint Protection Mobile and WebPulse technology detect and block these threats, safeguarding users.
02-05-2025 Symantec Blocks MintsLoader in TAG-124 Cyber Attacks Service Symantec counters MintsLoader, a loader used by TAG-124 to target industrial, legal, and energy sectors with phishing and malicious payloads. Its obfuscated scripts and anti-VM tactics are thwarted by Symantec’s adaptive and machine learning protections.
01-05-2025 Symantec IPS Audit Signatures Detect Over 811 Million Threats in April 2025 Feature Symantec’s Intrusion Prevention System (IPS) audit signatures identified 811.5 million attacks across 2.1 million endpoints in April 2025, targeting vulnerabilities in web servers, Windows OS, and ransomware tools. These signatures monitor suspicious network traffic without blocking by default, allowing administrators to review logs and enable blocking for enhanced protection. Key detections included 311.7 million Windows OS vulnerability scans and 34.6 million ransomware-related attacks.
01-05-2025 Iranian APT Targets Middle Eastern Critical Infrastructure with Sophisticated Malware Company News An Iranian advanced persistent threat (APT) actor attacked critical Middle Eastern infrastructure, using backdoors, web shells, and living-off-the-land binaries (lolbins) to establish persistence and execute operations. Fortinet’s investigation revealed the attacker’s tactics, while Symantec’s adaptive and machine learning-based protections, including SONAR and Carbon Black, effectively block these threats. The campaign underscores the growing cyber risks to regional infrastructure.
30-04-2025 Symantec Thwarts TypeLib Hijacking in Microsoft Teams Phishing Campaign Company News Symantec has identified and neutralized a sophisticated Microsoft Teams phishing campaign by the Storm-1811 threat actor, deploying a PowerShell backdoor via TypeLib hijacking. The attack uses social engineering, posing as IT support to trick employees into enabling Windows Quick Assist for malware deployment. Symantec’s adaptive, file-based, and machine learning protections, including VMware Carbon Black, block associated malicious indicators.
30-04-2025 Symantec Blocks Hannibal Infostealer Targeting Browsers and Crypto Wallets Service Symantec has detected and neutralized Hannibal Infostealer, a C#-based malware rebranded from Sharp and TX stealers, actively sold on dark web forums. It targets Chromium and Gecko-based browsers, cryptocurrency wallets, FTP clients, and VPNs, using a crypto clipper to hijack transactions. Symantec’s adaptive, behavior, and network-based protections, including VMware Carbon Black, effectively block this threat.
30-04-2025 Symantec Neutralizes Pentagon Stealer Malware Targeting Crypto and App Credentials Cybersecurity Symantec has identified and blocked Pentagon Stealer, a new Python and Golang-based malware, also known as Acab and BLX Stealer, spreading through typosquatting campaigns. It targets browser credentials, cookies, cryptocurrency wallets, and app tokens from platforms like Discord and Telegram, using HTTP requests for stealthy data exfiltration. Symantec’s adaptive, behavior, and machine learning-based protections, including VMware Carbon Black, effectively counter this threat.
30-04-2025 Symantec Thwarts Spear Phishing Attack on World Uyghur Congress Using Trojanized Text Editor Company News A sophisticated spear phishing campaign targeted World Uyghur Congress members with a trojanized Uyghur text editor, deploying surveillance malware via spoofed domains. Symantec’s advanced protection, including SONAR, Carbon Black, and machine learning, effectively detects and blocks this threat. The attack highlights the growing risk of culturally tailored cyberattacks.
29-04-2025 Symantec Endpoint Protection Blocks Millions of Web Threats with Browser Extensions Company News Symantec's Endpoint Protection (SEP) browser extensions for Google Chrome and Microsoft Edge have successfully blocked 7.3 million cyberattacks across 164,700 endpoints in the last week. Using advanced URL reputation and Browser Intrusion Prevention, SEP protected users from phishing, malware, and other online threats. Ensure your protection by enabling SEP browser extensions today to safeguard against evolving cyber risks.
29-04-2025 Symantec Thwarts Konni APT’s Multi-Stage Malware Targeting South Korean Entities Company News A sophisticated multi-stage malware campaign, potentially linked to North Korea’s Konni APT, targets South Korean organizations using a disguised .lnk shortcut to deploy a Remote Access Trojan (RAT). Symantec’s advanced protections, including SONAR, Carbon Black, and Email Threat Isolation, effectively block and detect the threat. The RAT enables persistent access and data exfiltration to a compromised C2 server.
29-04-2025 Symantec Blocks ELENOR-corp, New Mimic Ransomware Targeting Healthcare Cybersecurity ELENOR-corp, a new Mimic ransomware variant, is targeting the healthcare sector with advanced capabilities like anti-forensic measures and data exfiltration, preceded by Clipper malware and Python-based infostealers. Symantec’s robust protections, including VMware Carbon Black and machine learning-based detection, effectively neutralize this threat. The ransomware employs registry persistence and deletes backups to hinder recovery.
29-04-2025 Symantec Blocks CVE-2025-24054 NTLM Vulnerability Exploits in Windows Cybersecurity Symantec’s advanced security solutions, including VMware Carbon Black and Data Center Security, effectively counter CVE-2025-24054, a Windows NTLM hash disclosure vulnerability exploited since March 19, 2025, recently added to CISA’s Known Exploited Vulnerabilities Catalog. This flaw, triggered by malicious .library-ms files, risks leaking user credentials through spoofing attacks. Symantec’s policies block malicious files, prevent unauthorized network connections, and stop data exfiltration.
29-04-2025 Symantec Mitigates Commvault Web Server Vulnerability CVE-2025-3928 Exploits Cybersecurity Symantec’s Data Center Security (DCS) offers robust protection against CVE-2025-3928, a high-severity Commvault Web Server vulnerability enabling authenticated attackers to deploy webshells, recently added to CISA’s Known Exploited Vulnerabilities Catalog. The flaw, actively exploited in the wild, is patched in Commvault versions 11.36.46, 11.32.89, 11.28.141, and 11.20.217. Symantec’s custom sandbox policy prevents attack techniques, ensuring system security. Learn more about safeguarding your systems at broadcom.com
29-04-2025 Symantec DCS prevents PowerShell-Based LOTL Cyberattacks with Zero-Day Protection Feature Symantec Data Center Security (DCS) offers robust zero-day protection against Living Off the Land (LOTL) attacks exploiting PowerShell, a tool often abused by cybercriminals for ransomware and data theft. Its default Intrusion Prevention policy for Windows and Linux servers blocks suspicious processes and file modifications, preventing privilege escalation and remote code execution. This defense-in-depth approach safeguards critical infrastructure without relying on signature updates.
29-04-2025 Symantec Neutralizes Gremlin Stealer Malware Targeting Sensitive Data Cybersecurity Symantec’s security solutions, including VMware Carbon Black and WebPulse, effectively block Gremlin Stealer, a new C#-based malware sold on Telegram that steals clipboard data, browser credentials, and cryptocurrency wallet information. This malware, identified on April 29, 2025, compresses stolen data into .zip files for exfiltration via Telegram APIs. Symantec’s machine learning and file-based defenses detect and prevent these attacks.
28-04-2025 RevolverRAT Targeting Users with Malicious Emails – Stay Protected Cybersecurity RevolverRAT, a Remote Access Trojan, spreads through targeted emails posing as copyright claims, leading to dangerous DLL side-loading attacks. Symantec’s email security products, including Email Threat Isolation, protect users from this and other malicious threats. Learn how to safeguard your devices with Symantec’s advanced protection against RevolverRAT and other evolving cyber risks. Stay secure by activating Symantec's defense solutions today.
25-04-2025 Symantec Email Threat Isolation Shields Norinchukin Bank Users from Phishing Attacks Company News Symantec Email Threat Isolation technology protects Norinchukin Bank users from a phishing campaign using fake login pages to steal credentials. The scam targets online banking customers with fraudulent emails mimicking JA Net Bank notifications. Symantec’s web and email security solutions block malicious links and domains, ensuring user safety.
25-04-2025 Symantec Endpoint Protection Stops Ammyy Admin and PetitPotato in MS-SQL Server Attacks Feature Symantec Endpoint Protection safeguards businesses from a new cyberattack targeting weak MS-SQL servers with Ammyy Admin and PetitPotato malware. Attackers exploit vulnerabilities to gain remote access and escalate privileges, but Symantec’s advanced file, web, and machine learning defenses block these threats. The solution ensures secure server environments by detecting and preventing malicious activities.