Developer docs
API playgroundTry for free, no card

Search company profiles

Symantec

Full company profile

uuid00083fu

Namestring
Symantec
Legal namestring
Symantec Corporation
Websiteurl
broadcom.com
Company typeenum
Public
Founded yearint
1982
Descriptiontext

Symantec, founded in 1982 and headquartered in Mountain View, California, operates today as the Enterprise Security division of Broadcom Inc. following Broadcom's $10.7 billion acquisition of the business in August 2019. The company provides a comprehensive enterprise cybersecurity platform spanning endpoint protection, email security, data loss prevention (DLP), network security, Security Service Edge (SSE) and cloud access security broker (CASB) capabilities, supported by the Global Intelligence Network threat intelligence data flywheel and integrated Carbon Black endpoint detection and response technology. Product surface includes flagship offerings such as Symantec Endpoint Security, Symantec Email Security.cloud, Symantec DLP, Symantec SSE, Symantec Network Security Solutions, and detection modules including STARGate (image-based scam detection using OCR and deep learning), Cloud Sandbox, Static Data Scanner, File Reputation Service and CloudSOC.

The platform is sold primarily to large enterprise and government organizations through Broadcom's direct enterprise field sales force, complemented by a global channel network of distributors and resellers including Axiz/MBCOM in South Africa and Westcon-Comstor across APAC. Revenue is generated through subscription-based recurring licensing for cloud-delivered products and one-time enterprise licenses for on-premises deployments, with quote-based pricing customized to organization size and protection requirements. Customer segments are horizontal, addressing endpoint protection, email threat defense, data compliance, SASE adoption and broader cyber threat mitigation across industries such as hospitality, motorsports, government and multinational enterprises. Underlying AI/ML capabilities span computer vision (STARGate OCR + deep learning), anomaly detection (File Reputation ML), predictive analytics (Incident Prediction) and behavioral analysis, validated by analyst recognition from Forrester, KuppingerCole, IDC, Radicati and MITRE Engenuity.

Symantec's go-to-market leverages Broadcom's enterprise software infrastructure, including partner locator tools, threat intelligence content marketing and participation in industry events. In July 2024 the company replaced its CEO, publicly acknowledging prior underperformance, and has since launched new security suites, the Email Security.cloud service and the Incident Prediction capability, alongside expanded channel partnerships across APAC and South Africa, indicating a turnaround posture under Broadcom ownership.

Short descriptiontext

Symantec, now Broadcom's Enterprise Security division, provides enterprise cybersecurity platforms covering endpoint, email, DLP, SSE and network security, powered by the Global Intelligence Network, and sold to large enterprises and governments globally via subscription and perpetual licenses.

Operating statusenum
Operating
Ownership categoryenum
Headcount rangeband
5,001–10,000
akta.pro rankint
HeadquartersMountain View, United States
HQ citystring
Mountain View
HQ countrystring
United States
HQ regionstring
North America
Markets served

Serves global market

Offices1 record

Each record includes

City, Country, Type, Description, Source

Keyword5 values
enterprise cybersecurity, endpoint protection, email security, data loss prevention, security service edge
Industry3 codes
1Data Security & Privacy for Cloud (DLP, DSPM, Tokenization)
CodeHDABAHAKPrimaryYes
2Endpoint Security Managed Services (EDR/XDR)
CodeBPAEADAHPrimaryNo
3Cybersecurity Architecture & Security Integration
CodeBPAEAAALPrimaryNo
NAICS code1 code
  • Computer Systems Design and Related Services54151
Product category
Enterprise Cybersecurity Software
Social media profiles2 records
GTM motion2 records

Each record includes

Type, Description, Source

Revenue model3 records
1Enterprise Security Software Subscriptions
TypeSubscription Recurring
Description

Comprehensive cloud-based email security services and endpoint security solutions sold as subscriptions with various service plans and protection levels.

broadcom.com
2Enterprise Software Licenses
TypeOne Time License
Description

Enterprise-grade security solutions including DLP and data protection sold through perpetual licenses and subscription models for on-premises and cloud deployment.

broadcom.com
3Endpoint Security Solutions
TypeSubscription Recurring
Description

Multi-tiered endpoint protection solutions with various levels of management capabilities, powered by Global Intelligence Network.

broadcom.com
Marketing channels3 records

Each record includes

Title, Type, Stage, Description, Source

Distribution channels4 records

Each record includes

Title, Type, Scope, Target buyer, Description, Source

Cost components5 values
Technology or R&D, Personnel, Marketing or Sales, Operations, Infrastructure
Pricing details1 tier
1Email Security Cloud with multiple defense layers, analytics, and optional add-ons
ModelSubscriptionBilling cadenceAnnual
Notes

Available through various service plans with multiple defense layers and optional add-on features.

broadcom.com
GTM typeB2B
B2B
Offering typeSoftware
Software
Brand1 of 6 records shown
1Symantec Data Loss Prevention (DLP)
Description

Comprehensive data loss prevention and data protection solutions for protecting sensitive data across various environments and ensuring regulatory compliance

broadcom.com
+5 more records
Core offering1 text field

Symantec, operating as the enterprise security division of Broadcom, provides a comprehensive enterprise cybersecurity platform covering endpoint protection, email security, data loss prevention, network security, and Security Service Edge (SSE). The portfolio integrates AI/ML-powered threat detection capabilities, the Global Intelligence Network, and detection modules such as STARGate, Cloud Sandbox, File Reputation, and CloudSOC (CASB) for hybrid and multi-cloud enterprise environments.

Differentiator
Functional benefit
Problem solved
Quantifiable outcome1 of 3 values shown
  • 125% ROI for enterprises deploying Symantec SSE solution
+2 more records
Product overview1 text field

Symantec, now part of Broadcom, offers a comprehensive enterprise cybersecurity portfolio organized as a platform-plus-modules architecture. The core offerings include Endpoint Security for device protection, Email Security.cloud for email threat defense, Data Loss Prevention (DLP) for data protection, Security Service Edge (SSE) for unified access control, and Network Security Solutions. These integrate with detection modules including STARGate (image-based scam detection), Cloud Sandbox (advanced malware analysis), File Reputation Service (file analysis), and CloudSOC (cloud access security broker). The portfolio is powered by Symantec's Global Intelligence Network and Carbon Black endpoint detection and response technology.

Product and service7 records
1Symantec Email Security.cloud
CategoryEmail Security
2Symantec Data Loss Prevention (DLP)
CategoryData Protection
3Symantec Endpoint Security
4Symantec Security Service Edge (SSE)
5Symantec Network Security Solutions
6Symantec New Security Suites
CategoryIntegrated Security Suites
7Symantec CloudSOC
Scale indicator3 records

Each record includes

Type, Value, Description, Source

Partnership2 partners
Strategic tierCoreTypeChannel Partner/ Reseller/ DistributorAnnounced on2025-11-05
Description

South African distributor Axiz partnered with MBCOM Technologies, which is Broadcom's sole distributor in the South Africa region. The partnership aims to expand access to Broadcom's enterprise software solutions including Symantec products, strengthen support and skills development for local channel partners, and contribute to digital transformation efforts in the region.

Strategic tierCoreTypeChannel Partner/ Reseller/ DistributorAnnounced on2024-09-09
Description

Westcon-Comstor expanded its Broadcom partnership in the APAC (Asia-Pacific) region, enabling broader distribution and availability of Broadcom software solutions including Symantec enterprise security products. This expansion strengthens the channel distribution network across APAC markets.

Recent move7 records

Each record includes

Date, Type, Title, Description, Source

Expansion highlight6 records

Each record includes

Type, Description

Peers10 records
TypeDirect peer
Description

Proofpoint is the closest direct competitor to Symantec Email Security.cloud, also recognized as a leader in KuppingerCole email security assessments, with overlap in advanced threat protection, BEC defense, and DLP for email.

TypeDirect peer
Description

Fortinet competes directly with Symantec Network Security and increasingly with the SSE proposition through FortiSASE, anchored on its dominant installed base of FortiGate firewalls in large enterprise networks.

TypeDirect peer
Description

Zscaler is the SSE/SASE pure-play incumbent and competes head-to-head with Symantec Security Service Edge (SSE), particularly in cloud-delivered secure web gateway, ZTNA, and CASB — overlapping with Symantec CloudSOC.

TypeDirect peer
Description

Palo Alto Networks competes directly with Symantec across endpoint (Cortex XDR/XSIAM), SSE/SASE (Prisma), DLP, and email security, and was recognized alongside Symantec in IDC MarketScape DLP. It is a primary next-gen platform competitor for enterprise security consolidation.

TypeDirect peer
Description

Check Point's Infinity platform competes across endpoint (Harmony), network security, and SASE, making it a structurally similar consolidated security vendor to Symantec for enterprise customers considering platform plays.

TypeDirect peer
Description

SentinelOne's Singularity XDR platform directly competes with Symantec Endpoint Security and Carbon Black EDR, particularly for enterprise greenfield and competitive replacement opportunities, with a strong narrative around AI-driven autonomous detection.

TypeDirect peer
Description

Trend Micro offers competing endpoint, email, network, and cloud security products (Vision One platform) targeting mid-market and enterprise customers with similar subscription and managed-service models to Symantec's portfolio.

TypeBroad incumbent
Description

Microsoft bundles Defender for Endpoint, Defender for Cloud, Defender for Office 365, and Purview DLP into the M365 / Azure enterprise stack, directly competing with Symantec's endpoint, email, cloud, and DLP products with strong distribution through existing Microsoft enterprise agreements.

TypeDirect peer
Description

CrowdStrike's Falcon platform directly competes with Symantec Endpoint Security / Carbon Black in endpoint detection and response (EDR/XDR), and increasingly in identity protection and cloud workload security, both targeting large enterprises with subscription-based, cloud-native offerings.

TypeBroad incumbent
Description

Cisco Security competes with Symantec across endpoint (Secure Endpoint), network, email (IronPort), and SSE/SASE (Cisco Secure Access), with distribution leverage from Cisco's deep enterprise networking footprint.

Market position
Strengths5 records

Each record includes

Headline, Details, Source

Weaknesses5 records

Each record includes

Headline, Details, Source

Competitive moat5 records

Each record includes

Type, Details

Key risks5 records

Each record includes

Headline, Details, Source

Key highlights7 records

Each record includes

Headline, Details, Source

Customer concentration

Classification, Details

Named customers4 records

Each record includes

Name, Industry, Type, Use case, Source, UUID

Segment4 records

Each record includes

Title, Type, Primary, Description, Pain point addressed, Use case, Source

Ideal customer profile3 records

Each record includes

Profile, Firmographic size, Sales motion, Sales cycle length, Buying structure, Purchase trigger, Buyer persona, Geography, Industry vertical, Primary use case, Description, Pain points, Evidence proof points, Target buyer

Technology focused
Yes
API detail
Has APIbool
No

Docs URL, Description

Integration1 record

Each record includes

Title, Type, Description, Source

AI capability7 records

Each record includes

Type, Description, Source

AI maturity
App detail

Has app

Feature11 records

Each record includes

Title, Differentiator, Description, Source

Core technology
Revenue estimate
Valuation estimate
Number of profiles
Profiles2 records

Each record includes

Name, Designation, Designation category, Overview, Profile commentary, Source

Subsidiaries2 records

Each record includes

Name, Acquired on, Relationship type, Type, Business focus

No data
Funding overview

Funding stage, Last funding date, Total funding USD

Funding rounds

Each record includes

Round, Amount USD, Date, Pre money valuation, Total investors, Investors, News

Investors

Each record includes

Name, Type, Date of entry, Rounds participated, Website

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A4 records

Each record includes

Name, Acquisition type, Announced date, Completed date, Status, Website, News

Investment

Each record includes

Name, Round, Announced date, Lead investor, Website, News

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Symantec

Enterprise Cybersecurity Softwarebroadcom.com

Symantec, now Broadcom's Enterprise Security division, provides enterprise cybersecurity platforms covering endpoint, email, DLP, SSE and network security, powered by the Global Intelligence Network, and sold to large enterprises and governments globally via subscription and perpetual licenses.

What Symantec does

Symantec, founded in 1982 and headquartered in Mountain View, California, operates today as the Enterprise Security division of Broadcom Inc. following Broadcom's $10.7 billion acquisition of the business in August 2019. The company provides a comprehensive enterprise cybersecurity platform spanning endpoint protection, email security, data loss prevention (DLP), network security, Security Service Edge (SSE) and cloud access security broker (CASB) capabilities, supported by the Global Intelligence Network threat intelligence data flywheel and integrated Carbon Black endpoint detection and response technology. Product surface includes flagship offerings such as Symantec Endpoint Security, Symantec Email Security.cloud, Symantec DLP, Symantec SSE, Symantec Network Security Solutions, and detection modules including STARGate (image-based scam detection using OCR and deep learning), Cloud Sandbox, Static Data Scanner, File Reputation Service and CloudSOC.

The platform is sold primarily to large enterprise and government organizations through Broadcom's direct enterprise field sales force, complemented by a global channel network of distributors and resellers including Axiz/MBCOM in South Africa and Westcon-Comstor across APAC. Revenue is generated through subscription-based recurring licensing for cloud-delivered products and one-time enterprise licenses for on-premises deployments, with quote-based pricing customized to organization size and protection requirements. Customer segments are horizontal, addressing endpoint protection, email threat defense, data compliance, SASE adoption and broader cyber threat mitigation across industries such as hospitality, motorsports, government and multinational enterprises. Underlying AI/ML capabilities span computer vision (STARGate OCR + deep learning), anomaly detection (File Reputation ML), predictive analytics (Incident Prediction) and behavioral analysis, validated by analyst recognition from Forrester, KuppingerCole, IDC, Radicati and MITRE Engenuity.

Symantec's go-to-market leverages Broadcom's enterprise software infrastructure, including partner locator tools, threat intelligence content marketing and participation in industry events. In July 2024 the company replaced its CEO, publicly acknowledging prior underperformance, and has since launched new security suites, the Email Security.cloud service and the Incident Prediction capability, alongside expanded channel partnerships across APAC and South Africa, indicating a turnaround posture under Broadcom ownership.

Symantec firmographics

Firmographics
Name
Symantec
Legal name
Symantec Corporation
Website
https://broadcom.com
Company type
Public
Founded year
1982
Operating status
Operating
Headcount range
5,001–10,000 employees
Short description
Symantec, now Broadcom's Enterprise Security division, provides enterprise cybersecurity platforms covering endpoint, email, DLP, SSE and network security, powered by the Global Intelligence Network, and sold to large enterprises and governments globally via subscription and perpetual licenses.
Ownership category
akta.pro rank

Symantec industry classification

Industry
Product category
Enterprise Cybersecurity Software
NAICS
Computer Systems Design and Related Services (54151)
akta.pro primary industry
Data Security & Privacy for Cloud (DLP, DSPM, Tokenization) (HDABAHAK)
akta.pro secondary industries
Endpoint Security Managed Services (EDR/XDR) (BPAEADAH), Cybersecurity Architecture & Security Integration (BPAEAAAL)

Keywords

  • Enterprise cybersecurity
  • Endpoint protection
  • Email security
  • Data loss prevention
  • Security service edge

Where Symantec is headquartered

Location

Headquarters

HQ city
Mountain View
HQ country
United States
HQ region
North America

Offices1 record

Markets served

Symantec business model

Business model
GTM type
B2B
Offering type
Software
Cost components
Technology or R&D, Personnel, Marketing or Sales, Operations, Infrastructure

Revenue model

  1. Enterprise Security Software Subscriptions: Comprehensive cloud-based email security services and endpoint security solutions sold as subscriptions with various service plans and protection levels.
  2. Enterprise Software Licenses: Enterprise-grade security solutions including DLP and data protection sold through perpetual licenses and subscription models for on-premises and cloud deployment.
  3. Endpoint Security Solutions: Multi-tiered endpoint protection solutions with various levels of management capabilities, powered by Global Intelligence Network.

Pricing tiers

ModelBillingPrice
SubscriptionAnnualEmail Security Cloud with multiple defense layers, analytics, and optional add-ons

Go-to-market motion2 records

Distribution channels4 records

Marketing channels3 records

Symantec product offering

Product offering

Core offering

Symantec, operating as the enterprise security division of Broadcom, provides a comprehensive enterprise cybersecurity platform covering endpoint protection, email security, data loss prevention, network security, and Security Service Edge (SSE). The portfolio integrates AI/ML-powered threat detection capabilities, the Global Intelligence Network, and detection modules such as STARGate, Cloud Sandbox, File Reputation, and CloudSOC (CASB) for hybrid and multi-cloud enterprise environments.

Product overview

Symantec, now part of Broadcom, offers a comprehensive enterprise cybersecurity portfolio organized as a platform-plus-modules architecture. The core offerings include Endpoint Security for device protection, Email Security.cloud for email threat defense, Data Loss Prevention (DLP) for data protection, Security Service Edge (SSE) for unified access control, and Network Security Solutions. These integrate with detection modules including STARGate (image-based scam detection), Cloud Sandbox (advanced malware analysis), File Reputation Service (file analysis), and CloudSOC (cloud access security broker). The portfolio is powered by Symantec's Global Intelligence Network and Carbon Black endpoint detection and response technology.

Differentiator

Problem solved

Functional benefit

Brands

  • Symantec Data Loss Prevention (DLP): Comprehensive data loss prevention and data protection solutions for protecting sensitive data across various environments and ensuring regulatory compliance
  • Symantec Endpoint Security
  • Symantec Network Security Solutions
  • Symantec Email Security Cloud
  • Symantec Security Service Edge (SSE)
  • Symantec SSE (Security Service Edge)

Products and services

  • Symantec Email Security.cloud
  • Symantec Data Loss Prevention (DLP)
  • Symantec Endpoint Security
  • Symantec Security Service Edge (SSE)
  • Symantec Network Security Solutions
  • Symantec New Security Suites
  • Symantec CloudSOC

Quantifiable outcome

  • 125% ROI for enterprises deploying Symantec SSE solution
  • +2 more outcomes

Companies that use Symantec

Customer profile

Named customers4 records

Segments4 records

Ideal customer profiles3 records

Symantec technology and API

Technology

Technology focussed Yes

API detail

Has API
No
API docs
API detail

Core technology

AI maturity

App detail

Integration1 record

AI capability7 records

Feature11 records

Symantec partnerships and signals

Strategic signal

Partnerships

Two partnerships are on record, tiered core.

  • MBCOM TechnologiescoreChannel Partner/ Reseller/ Distributor · 5 November 2025South African distributor Axiz partnered with MBCOM Technologies, which is Broadcom's sole distributor in the South Africa region. The partnership aims to expand access to Broadcom's enterprise software solutions including Symantec products, strengthen support and skills development for local channel partners, and contribute to digital transformation efforts in the region.
  • Westcon-ComstorcoreChannel Partner/ Reseller/ Distributor · 9 September 2024Westcon-Comstor expanded its Broadcom partnership in the APAC (Asia-Pacific) region, enabling broader distribution and availability of Broadcom software solutions including Symantec enterprise security products. This expansion strengthens the channel distribution network across APAC markets.

Scale indicators3 records

Recent moves7 records

Expansion highlights6 records

Symantec competitors and assessment

Company assessment

Direct peers

  • Proofpoint: Proofpoint is the closest direct competitor to Symantec Email Security.cloud, also recognized as a leader in KuppingerCole email security assessments, with overlap in advanced threat protection, BEC defense, and DLP for email.
  • Fortinet: Fortinet competes directly with Symantec Network Security and increasingly with the SSE proposition through FortiSASE, anchored on its dominant installed base of FortiGate firewalls in large enterprise networks.
  • Zscaler: Zscaler is the SSE/SASE pure-play incumbent and competes head-to-head with Symantec Security Service Edge (SSE), particularly in cloud-delivered secure web gateway, ZTNA, and CASB — overlapping with Symantec CloudSOC.
  • Palo Alto Networks: Palo Alto Networks competes directly with Symantec across endpoint (Cortex XDR/XSIAM), SSE/SASE (Prisma), DLP, and email security, and was recognized alongside Symantec in IDC MarketScape DLP. It is a primary next-gen platform competitor for enterprise security consolidation.
  • Check Point Software: Check Point's Infinity platform competes across endpoint (Harmony), network security, and SASE, making it a structurally similar consolidated security vendor to Symantec for enterprise customers considering platform plays.
  • SentinelOne: SentinelOne's Singularity XDR platform directly competes with Symantec Endpoint Security and Carbon Black EDR, particularly for enterprise greenfield and competitive replacement opportunities, with a strong narrative around AI-driven autonomous detection.
  • Trend Micro: Trend Micro offers competing endpoint, email, network, and cloud security products (Vision One platform) targeting mid-market and enterprise customers with similar subscription and managed-service models to Symantec's portfolio.
  • CrowdStrike: CrowdStrike's Falcon platform directly competes with Symantec Endpoint Security / Carbon Black in endpoint detection and response (EDR/XDR), and increasingly in identity protection and cloud workload security, both targeting large enterprises with subscription-based, cloud-native offerings.

Broad incumbents

  • Microsoft (Defender / Sentinel): Microsoft bundles Defender for Endpoint, Defender for Cloud, Defender for Office 365, and Purview DLP into the M365 / Azure enterprise stack, directly competing with Symantec's endpoint, email, cloud, and DLP products with strong distribution through existing Microsoft enterprise agreements.
  • Cisco (Security): Cisco Security competes with Symantec across endpoint (Secure Endpoint), network, email (IronPort), and SSE/SASE (Cisco Secure Access), with distribution leverage from Cisco's deep enterprise networking footprint.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks5 records

Key highlights7 records

Customer concentration

Symantec social profiles

Digital presence

Symantec financial estimates

Financial estimate

Revenue estimate

Valuation estimate

Symantec leadership team

Management profile

Number of profiles

Profiles2 records

Symantec subsidiaries and ownership

Company hierarchy

Subsidiaries2 records

Symantec funding detail

Funding detail

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

Symantec M&A and investment

M&A and investment

M&A4 records

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Symantec

What does Symantec do?

Symantec, operating as the enterprise security division of Broadcom, provides a comprehensive enterprise cybersecurity platform covering endpoint protection, email security, data loss prevention, network security, and Security Service Edge (SSE). The portfolio integrates AI/ML-powered threat detection capabilities, the Global Intelligence Network, and detection modules such as STARGate, Cloud Sandbox, File Reputation, and CloudSOC (CASB) for hybrid and multi-cloud enterprise environments.

Is Symantec a public or private company?

Symantec is a public company. It is classified as corporate owned and is currently operating.

When was Symantec founded?

Symantec was founded in 1982. It employs 5,001 to 10,000 people.

Where is Symantec based?

Symantec is headquartered in Mountain View, United States, in the North America region.

How does Symantec make money?

Three revenue lines are on record. Enterprise Security Software Subscriptions are the primary driver. The others are enterprise Software Licenses and endpoint Security Solutions.

Who are Symantec's main competitors?

Direct peers on record are Proofpoint, Fortinet, Zscaler, Palo Alto Networks, Check Point Software, SentinelOne, Trend Micro and CrowdStrike. Broad incumbents are Microsoft (Defender / Sentinel) and Cisco (Security).

Does Symantec have an API?

No public API is recorded for Symantec.

What industry is Symantec in?

Symantec's product category is Enterprise Cybersecurity Software. Its primary akta.pro industry code is HDABAHAK, Data Security & Privacy for Cloud (DLP, DSPM, Tokenization), with a secondary code of BPAEADAH, Endpoint Security Managed Services (EDR/XDR). Its NAICS code is 54151.

Unlock the full company data

50 free credits on sign-up, no credit card required.

Contact sales
Live signals
IndustrialcyberSymantec reports Warlock ransomware group targets water, telecom, government organizations through SharePoint flawsSymantec reported that the Longlegs group, behind Warlock ransomware, has exploited on-premises Microsoft SharePoint Server vulnerabilities to target at least four organizations in Portuguese- and Spanish-speaking countries. The group used a webshell to harvest ASP.NET machine keys and staged payloads in the SYSVOL share for rapid distribution. The attacks highlight ongoing risks to critical infrastructure operators.Cyber Security NewsHackers Turn Trusted Node.js Runtime Into Malware Launcher in Ransomware-Linked AttacksCybercriminals have been hijacking Node.js to run malware, evading detection since February 2026. Victims include government, tech, and hotel sectors, with attacks using tools like C2Looper and EtherHiding. Symantec advises monitoring for unexpected Node.js installations and registry entries.The Hacker NewsAttackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted AttacksThreat actors are using the trusted Node.js runtime to deploy malicious payloads in attacks targeting government, tech, and hotel sectors since February 2026. The technique avoids signature-based detection and has been used with tools like EtherHiding, C2Looper, and AsukaStealer. Symantec recommends auditing websites and restricting browser extensions to mitigate the risk.AcmCompromised Servers Provide Cover for Cyber Attack – Communications of the ACMSymantec and Carbon Black researchers reported a Hackledorb campaign that used an unpatched MSSQL server, DLL sideloading, a Huawei audio driver and a Teams relay tunnel to exfiltrate data and deploy DragonForce ransomware. The Backdoor.Turn malware hides in DbgView64.exe and routes encrypted QUIC traffic through Microsoft Teams relay servers, exploiting Microsoft's "Optimize Required" classification that bypasses firewall inspection.BankInfoSecurityWhy Great Customer Experience Means Zero ComplexityLeap Platform, acting as the go-to-market arm for Symantec and Carbon Black in North America and Latin America, is promoting a zero-complexity customer experience model to address enterprise cybersecurity market saturation. The company aims to reduce fragmentation by providing unified support and strategic guidance across the full lifecycle of security investments. This strategy positions customer experience as a key differentiator amid intense competition from other vendors.Dark ReadingLazarus Group Picks a New Poison: Medusa RansomwareThe Lazarus Group, a North Korean state-sponsored threat actor, has launched Medusa ransomware attacks against organizations in the Middle East and the United States. Researchers from Symantec and Carbon Black identified this collaboration as part of the group's continued financially motivated cybercrime activities, particularly targeting critical infrastructure.Security BoulevardJewelbug: A Single Control Panel for Cyberespionage and FraudSymantec researchers identified a China-based hack-for-hire group dubbed 'Jewelbug' operating a dual-purpose infrastructure that conducts both cyberespionage against governments and militaries in Asia and the Middle East, and cryptocurrency fraud targeting Chinese-speaking victims. The operation utilizes a single control panel called XG-Web to manage implants that have resulted in over 1 million check-ins, 580,000 stolen browser cookies, and thousands of credentials. A key tactic involved compromising a shared telecom-hosting platform to access more than 15 government webmail tenants simultaneously.IndustrialcyberSymantec reveals Jewelbug espionage campaign targeting Asian governments, telecoms, critical infrastructureSymantec and Carbon Black researchers identified Jewelbug, a China-based hack-for-hire group conducting espionage against governments in Asia and the Middle East while simultaneously operating a cryptocurrency fraud business. The group utilized shared infrastructure to compromise critical infrastructure targets, including state telecom operators and military networks, by exploiting a shared web hosting platform for a Middle Eastern government's webmail system. This operation resulted in over one million implant check-ins and significant data exfiltration from senior officials.ScworldChina-linked Jewelbug group conducts espionage and cryptocurrency theftSymantec reported that the China-linked cyber espionage group Jewelbug is conducting international spying and cryptocurrency theft using custom malware implants and fake websites. The group has compromised government, military, and telecommunications organizations across Asia and the Middle East, as well as a major U.S. industrial manufacturer.BleepingcomputerHackers breach govt webmail while running parallel crypto fraudThe Jewelbug hacker group compromised webmail accounts for 15 government tenants in a Middle Eastern country by injecting malicious scripts into a shared hosting platform operated by the state telecommunications provider. Researchers at Symantec discovered that the espionage campaign targeting governments and militaries was conducted alongside industrial-scale cryptocurrency fraud operations using the same control infrastructure.