Their mission is to find, fix, and alert the world to cyber threats before damage is done.
Featured stories
January 27, 2026
Exfil Out&Look for Logs: Weaponizing Outlook Add-ins for Zero-Trace Email ExfiltrationFebruary 12, 2026
Dataflow Rider: How Attackers can Abuse Shadow Resources in Google Cloud DataflowReal threats require real guidance
Varonis Threat Labs (VTL) is our team of threat hunters and security researchers who uncover how real‑world attackers target data across every industry and environment. Their discoveries give CISOs and security practitioners clear, practical guidance to reduce blast radius, secure sensitive data, and stop emerging threats before they cause damage.
Explore this page to see the VTL team’s latest discoveries, best practices, and more.
Recent discoveries
-
February 24, 2026
1Campaign: A New Cloaking Platform Helping Attackers Abuse Google Ads
1Campaign is a new cloaking platform that helps attackers bypass Google Ads screening, evade security researchers, and keep phishing and crypto drainer pages online longer.
Daniel Kelley
-
February 19, 2026
How Cybercriminals Buy Access: Logins, Cookies, and Backdoors
Explore how cybercriminals buy VPN credentials, infostealer logs, breach databases, and web shells to access networks without writing a single exploit.
Daniel Kelley
-
January 23, 2026
Stanley — A $6,000 Russian Malware Toolkit with Chrome Web Store Guarantee
A new malware toolkit called 'Stanley' spoofs websites while keeping the address bar intact and guarantees Chrome Web Store approval.
Daniel Kelley
-
January 09, 2026
Cybercrime Predictions for 2026: What We’re Seeing from the Frontlines
Discover how AI-powered cyber threats, malicious LLMs, and advanced phishing are reshaping security and demanding smarter, data-centric defenses in 2026.
Lexi Croisdale
-
December 28, 2026
MongoBleed (CVE-2025-14847): Risk, Detection & How Varonis Protects You
MongoBleed (CVE‑2025‑14847) is a critical unauthenticated memory-leak vulnerability in MongoDB Server that allows attackers to remotely extract uninitialized heap memory—including sensitive info like credentials.
Chen Levy Ben Aroy
-
December 09, 2025
Spiderman Phishing Kit Mimics Top European Banks With A Few Clicks
See how Spiderman, a new phishing kit targeting customers of European banks, works. The kit features real-time credential theft, OTP capture, and advanced filtering.
Daniel Kelley
In the News
Researchers Reveal How a Single Copilot Link Could Quietly Expose Personal Data
BleepingComputer.comDirect Send Phishing Campaign Revealed
YouTubeEnterprise Breaches. Common Failings & Lessons Learned
N2K CyberWireLessons Learned From Real-World Forensic Investigations
LinkedInAI Is Repeating the Same Security Mistake We Made Before
The VTL Team
Yogev Madar is the Director of Security Research at Varonis, where he leads advanced teams focusing on identifying, analyzing, and responding to emerging threats across cloud and enterprise environments. His work spans security research, threat detection, vulnerability research, and incident response, with deep expertise in cloud security, cyber threat intelligence, and identity‑centric security, including AWS, Google Cloud Platform, IAM, DLP, and security automation. Yogev works closely with cross‑functional teams to translate complex attacker behavior into practical insights that support research publications, conference presentations, and industry thought leadership.
Dor Yardeni is the Director of Security Research at Varonis, leading the team responsible for the detection engine that protects thousands of customers worldwide. With more than a decade of experience in cybersecurity, Dor specializes in red teaming, incident response, and detection engineering. His work focuses on data‑driven research, including building advanced threat detection models, reporting vulnerabilities in critical infrastructure systems, and investigating large‑scale ransomware incidents.
Rotem Tsadok leads Security Operations and Forensics at Varonis, directing investigations into advanced threats targeting sensitive data across hybrid environments. With deep blue and red-team expertise, he blends adversary emulation and incident response strategy with hands-on execution to guide complex technical and customer-facing teams. He has driven enterprise-scale initiatives that strengthen security posture and accelerate business impact. A dynamic speaker with 15+ years in the field, Rotem delivers practitioner-focused sessions packed with real-world tactics and lessons learned.
Mark Vaitzman is a Security Research Team Leader at Varonis, a leader in data security. As a passionate cybersecurity expert, Mark holds extensive experience in leading security threat and research teams in various cybersecurity companies, analyzing emerging threats, incident response and developing innovative solutions. He is also a lecturer at Cyber Security College, sharing his knowledge and shaping the next generation of cybersecurity professionals. Mark previously presented at CrestCon, DeepSec, and Black Hat USA. In his free time, he likes sailing in the sea and riding a motorcycle.
Joe is a passionate and dedicated blue-teamer with experience in a wide array of specialties such as Detection Engineering, Threat Hunting, Incident Response, and Cyber Intelligence. He currently leads Varonis’ Forensics group, a team primarily assisting customers with their response to critical breach events, for North Amera, Europe, and Australia. His interests and experience include reverse engineering, detection engineering, threat hunting, compromise assessment, threat deception and tool development for both red and blue team functionalities.
Protect against material data breaches
Power Your 24×7 Data Defense