#Threat Intelligence
All CosmicBytez Labs articles tagged #Threat Intelligence, across news, security advisories, how-to guides, and projects.
- News
F-Secure Launches Victim-First Scam Encyclopedia Covering 50+ Types of Consumer Fraud
F-Secure's Threat Intelligence team catalogued 50+ consumer scam types from the victim's perspective as losses double and 52% of victims now lose money.
- News
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Previdian honeypots logged 1,423 attempts to exploit CVE-2026-105740, Langflow's critical authenticated RCE flaw, exposing live attacker TTPs.
- News
ThreatsDay Bulletin: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor and 23 More
This week's bulletin covers an Adobe AEM RCE chain, a DNS-based crypto wallet drainer, an NVIDIA container escape, a self-healing WP backdoor, plus 23 more.
- News
Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management
Criminal IP unveiled AITEM, an AI framework linking exposure discovery to investigation, prioritization, and automated response for ASM teams.
- News
South Korea Probes Bank Breaches Amid Suspected AI-Powered Attacks
FSC held an emergency meeting after suspected AI-powered attacks breached seven South Korean banks and lenders, exposing data on over 186,000 customers.
- News
Google Rolls Out Gemini 4 Argon to Trusted Cyber Defenders
Google's Gemini 4 Argon rolls out to 650+ vetted defenders via the Fairwind Program, pairing autonomous vuln-hunting with a guardrail-free build.
- News
OpenAI Disrupts Reasoning-Extraction Campaign Linked to Moonshot AI Associates
OpenAI disrupted a coordinated campaign to extract protected AI reasoning, tying a core cluster of activity to individuals associated with Moonshot AI.
- News
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database and Shared Memory
Sucuri found the SC WordPress backdoor rebuilding itself from eight file, database, and shared-memory locations, using Ethereum RPC gateways for C2.
- News
MI5 Says China's MSS Funded Research Involving 100+ U.K.-Linked Academics
MI5's Sept. 30 Espionage Alert says China's MSS funded AI, cyber, and covert-comms research via front company CGTRI, reaching 100+ U.K. academics.
- News
Osavul Raises $10M to Spot Hostile Intent Across Cyber and Physical Domains
Hybrid risk intelligence firm Osavul closed a $10M Series A led by 33N Ventures to expand AI-driven threat detection for critical infrastructure.
- News
ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories
This week: an AI agent chained two Zammad zero-days to root in seconds, 543,699 live secrets sat exposed on GitHub, plus an Unsloth Studio model-inspection RCE.
- News
Google: AI Is Changing the Pace and Profile of Vulnerability Discovery
Google's GTIG found AI-discovered vulnerabilities are twice as likely to enable remote code execution, as monthly CVE disclosures more than doubled in 2026.
- News
Bitget Resumes Bitcoin Withdrawals After $387.5 Million North Korea-Linked Heist
Bitget restored BTC withdrawals Sep 28 in a phased restart after its $387.5M breach, with ETH, USDT, and fiat/P2P to follow through Oct. 2.
- News
Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks
Microsoft links its NeedyMantis implant to Storm-3069, found via DLL sideloading against telecoms, universities, and nonprofits since October 2025.
- News
PamStealer's Third Variant Adds Live C2 Payload Decryption and Four-Layer Persistence
Jamf Threat Labs found a third PamStealer variant tying payload decryption to a live X25519 exchange with its C2 server and four persistence layers.
- News
The SOC Doesn't Need to Start Over With Every Alert: AI Is Cutting Attacker Retry Time to Minutes
AI now resolves failed attack attempts in minutes instead of hours, and Conifers.ai argues SOCs need shared operational memory to keep pace.
- News
Bitget Hack Losses Climb to $387.5 Million as CEO Points to North Korea
Bitget's hack losses grew from an initial $351.6M estimate to $387.5M as North Korea-linked actors spoofed backend transfer approvals.
- News
Kiteworks Urges Customers to Shut Down Servers Over Possible Imminent Zero-Day Attack
Kiteworks told 1,500+ customers to shut down servers for a multi-hour window after credible threat intel warned of a possible imminent zero-day attack.
- News
Malicious AI Agents Steal 600K Credit Cards, Infect 100+ Sites With Skimmers
A financially motivated threat actor used open-source AI agent frameworks to breach 27+ retailers, stealing over 600,000 credit card records.
- News
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data
Stolen OAuth token from May's TanStack npm worm let attackers clone 170 CrowdSec private repos, undetected for four months.
- News
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls — three distinct clusters hitting Russian organizations with backdoors, ransomware, and wipers.
- News
3BB Attacker Used MeshCentral Backdoor for Root Access to Subscriber Data
An intruder inside Thai broadband provider 3BB used MeshCentral as a hidden backdoor, gaining root access to 55+ machines to target RADIUS...
- News
Anthropic's September 2026 Report Details AI-Assisted Fraud, Espionage & Influence Ops
Anthropic's latest misuse report names groups stealing AI vendor API keys, running fake reseller scams, and using Claude for state-linked ops.
- News
In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review
Roundup: novel InjectEave EM eavesdropping, an AT&T insider's SIM-swap sentencing, a Glasswing audit, and a $10M bounty on an Iranian cyber chief.
- News
AI Is Giving Lesser-Resourced Attackers Nation-State-Level Reach, Google Warns
Google's GTIG says criminal and state-backed hackers are using AI to automate attacks at a scale once reserved for well-funded nation states.
- News
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
Google tracks financially motivated group Breeze Comet manipulating Brazilian banking and payment systems like Pix, STR, and Boleto since 2024.
- News
DoJ Corrects China Hacking Claim: Agencies Were Targets, Not Victims
The DoJ walked back a claim that NASA, the Fed, and other agencies were breach "victims," clarifying they were targets of China-linked group QTFY.
- News
Microsoft Warns of TerminalFix Attacks Deploying Reverse Tunnels
A new ClickFix variant tricks victims into running PowerShell in Windows Terminal, sideloading a DLL that opens a persistent reverse-tunnel backdoor.
- News
In Other News: Log4j RCE Scare, Minimus Shutdown, Iranian Hacker Sanctions
This week's roundup: a Log4j RCE scare gets debunked, container-security startup Minimus shuts down, and the US sanctions Iranian MOIS hackers.
- News
Hackers Abuse npm Mirrors to Host Phishing Redirect Pages
Threat actors are planting malicious HTML packages on npm and its mirrors that impersonate Cloudflare CAPTCHAs, silently redirecting victims to attacker sites.
- News
U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches
Operation Economic Outcast sanctions ~60 Iran-linked entities including MOIS-affiliated hackers who hit energy, defense, healthcare, and US government.
- News
ReliaQuest Confirms Failed Data-Theft Attack After ShinyHunters Employee Impersonation
ReliaQuest disclosed a social engineering attack where ShinyHunters impersonated an employee to steal data — the attempt was detected and blocked.
- News
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
UAT-10147 uses agentic AI to automate attacks on 170,000 web servers, deploying SPECTRE with BYOVD EDR bypass and an AI-assisted Linux kernel rootkit.
- News
WordlistLoader & SynkLoader: New Malware Families Delivering Infostealers and Phishing Windows Credentials
Two new malware loaders target ransomware access brokering: WordlistLoader drops Amatera Stealer via ClickFix, SynkLoader harvests Windows credentials.
- News
WordlistLoader and SynkLoader: Two New Windows Malware Loaders Analysed
Security researchers expose WordlistLoader deploying Amatera stealer via ClickFix and SynkLoader delivering a 7-module RAT through Microsoft Teams phishing.
- News
ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit
This week: Gogs CVSS 10.0 RCE via path traversal, n8n prototype pollution, Iran IRGC $10M bounty, and GLM-5.3 AI discovering 2,436 vulnerabilities.
- News
Ransom Busters: Ransomware Affiliate Poses as Data Recovery Firm
A ransomware affiliate operating as 'Ransom Busters' contacts breach victims posing as a recovery service, then double-extorts them for $20K–$60K.
- News
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
Dubbed 'City Forum,' a single threat actor has been silently scraping customer portals across Salesforce and ServiceNow for over a year.
- News
Fortune 500 Companies Hit in Azure Data Theft Campaign
Threat actor TheHatman exposed 3.5M+ enterprise records from McDonald's, Vodafone, and TCS via infostealer-driven Azure Entra ID credential theft.
- News
Apple Sends New Threat Notification Alerts Over Mercenary Spyware Attacks
Apple warned iPhone users in 110 countries of mercenary spyware attacks. Enable Lockdown Mode and update iOS immediately if you receive an alert.
- News
Enterprise Perimeter Defenses Improved — Interior Security Collapsed
Picus Blue Report 2026: edge prevention rose to 69% but interior dropped to 37%. Registry credential theft blocked less than 1% of the time.
- News
DeadLock Ransomware Uses Blockchain to Resist Infrastructure Takedown
DeadLock ransomware stores its C2 configuration in Polygon smart contracts, making law enforcement takedowns ineffective against its 80+ victim operation.
- News
China-Linked Storm-1175 Turns N-able N-central Into MSP Ransomware Launchpad
Microsoft warns that the China-linked threat actor Storm-1175 is exploiting a critical zero-day in N-able N-central (CVE-2026-18577) to gain god-mode...
- News
New StormEncryptor Ransomware Used by Former Medusa Affiliate
A financially motivated threat actor formerly associated with the Medusa ransomware operation is now deploying a new ransomware strain called...
- News
OpenAI's Next AI Model Astra Shows Cyber Performance Strong Enough to Trigger Pause
OpenAI has paused internal activities involving its upcoming Astra model after evaluations revealed the AI demonstrated advanced agentic coding and...
- News
AI Sends Global Crime Syndicates Into Fraud Nirvana
Organized crime groups worldwide have fully embraced AI as a force multiplier for fraud, enabling operations at a scale and sophistication that INTERPOL...
- News
Head Mare Hacktivists Breach TrueConf to Trojanize Client Installers with PhantomCore Backdoors
The Head Mare hacktivist group exploited two unpatched TrueConf server vulnerabilities to replace legitimate client installers with malicious versions...
- News
Vishing Extortion Group UNC6671 Rebrands After Making Millions
Vishing extortion group UNC6671 (formerly BlackFile) rebrands into Redact, Pink, Helix, and Falcon after earning millions from enterprise voice phishing.
- News
TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign
New analysis traces the cloud threat actor TeamPCP to Redis cryptojacking campaigns active since 2020, revealing a six-year evolution from opportunistic...
- News
Hackers Run khunt Post-Exploitation Toolkit from Oracle Database
Threat actors exploited a SQL injection flaw to compile and execute the khunt post-exploitation toolkit directly inside an Oracle database using the...
- News
The Coordination Gap: How Attackers Are Outpacing Law Enforcement
Threat actors have evolved their strategies faster than law enforcement can coordinate across jurisdictions and agencies, creating a widening gap that...
- News
Inside the Underground Business of BTMOB RAT
Flare researchers analyzed thousands of underground posts to reveal how the BTMOB Android RAT evolved from a single MaaS product into a fragmented...
- News
Chinese Hacker Uses DeepSeek via Telegram to Launch Fully Autonomous Cyberattacks
Palo Alto Networks' Unit 42 documented a Chinese-speaking threat actor using the open-source Hermes Agent framework to direct DeepSeek AI through...
- News
ESET Threat Report: Malicious AI Skills and Adaptable Malware on the Rise
ESET's mid-2026 threat report reveals attackers adapting established techniques to AI platforms — deploying malicious AI skills, AI-assisted malware,...
- News
Chinese Threat Actor Uses DeepSeek and Hermes Agent to Launch Fully Autonomous Cyberattacks
Palo Alto Networks Unit 42 exposes a Chinese-speaking threat actor who directed an AI agent via a single Telegram message, letting DeepSeek autonomously...
- News
ESET H1 2026: Malicious AI Skills Surge to 3,000+ as ClickFix and Quishing Break Records
ESET's H1 2026 threat report reveals 3,000+ malicious AI skills in open repositories, a 108% ClickFix surge, record quishing activity, and the first...
- News
Hacker Uses DeepSeek AI to Autonomously Attack Vulnerable Servers
Palo Alto Networks Unit 42 documents a Chinese-speaking threat actor who used DeepSeek and the open-source Hermes Agent framework to conduct autonomous...
- News
Amazon Links Debug, Chalk NPM Supply Chain Attacks to North Korean Hackers
Amazon security researchers have attributed the compromise of widely used NPM packages including debug and chalk to a North Korea-linked threat group, in...
- News
North Korean Hackers Behind Major Open-Source Supply Chain Attacks, Amazon Says
Amazon security research has exposed a North Korea-linked hacker group as the orchestrators of multiple high-profile open-source software supply chain...
- News
Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates
Researchers at Hunt.io have traced the Flying Eagle Android remote access trojan framework to over 170 internet-exposed control panel servers, as its...
- News
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Cisco Talos has detailed msaRAT, a Rust-based implant used by the Chaos ransomware group that hides its command-and-control channel inside the victim's...
- News
Ransomware Is Accelerating — And It's Not Because of AI
Black Kite's 2026 Ransomware Report reveals 7,551 publicly disclosed victims in a single year — a 24.9% increase — driven not by AI but by ecosystem...
- News
OpenAI Confirms ChatGPT Is Down Worldwide — ~50-Minute Global Outage
OpenAI's ChatGPT, API platform, and Codex suffered a ~50-minute worldwide outage on July 25, 2026, disrupting millions of users and downstream...
- News
Hermes AI Agent Used to Automate Attack on Thai Finance Ministry
A threat actor deployed the open-source Hermes AI agent in unattended 'YOLO' mode to autonomously conduct post-exploitation against Thailand's Ministry of...
- News
In Other News: Dolphin X AI Malware, Car Anti-Theft Hack, 432 Linux Kernel CVEs
This week's security roundup covers an AI-prioritizing infostealer targeting developer machines, a hardcoded Bluetooth key in 2.2 million car anti-theft...
- News
Upbound Says Hack Caused $13 Million in Fraudulent Acima Leases
The Upbound Group disclosed that a cybersecurity breach exposed customer data later used by threat actors to open $13 million in fraudulent Acima...
- News
New Index Tracks Material Breaches — And Refuses to Add Up the Losses
Richard Bird, Chief Strategy and Security Officer at Singulr AI, has built the Hacker in a Hoodie (HIH) Index — an evidence-graded ledger tracking...
- News
Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs
A solo Russian-speaking threat actor known as "bandcampro" outsourced their entire C2 operation to Google's Gemini CLI — writing zero code themselves...
- News
SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch
Threat actor UTA0533 exploited two SonicWall zero-day vulnerabilities — CVE-2026-15409 and CVE-2026-15410 — to deploy custom malware against targets weeks...
- News
Guten Tag, Bonjour, Hola: Dark Reading Launches European Cyber Defenders Hub
Dark Reading has unveiled an expanded DR Global section tailored to European cybersecurity defenders, delivering region-specific threat intelligence,...
- News
ClickLock: New macOS Infostealer Kills Apps Every 210ms to Force Password Entry
Group-IB researchers discovered ClickLock, a new macOS infostealer distributed via ClickFix lures that terminates all visible system processes in a loop...
- News
Identity Attacks Overtake Exploits as Top Ransomware Cause
Sophos 2026: 79% of ransomware attacks start with stolen identities. MFA was present in 97% of credential-based cases yet failed to stop every one of them.
- News
New Spirals Ransomware Encrypts Victim Network in Under 24 Hours
A newly identified ransomware group called Spirals has demonstrated alarming operational speed, completing the full attack lifecycle — initial access,...
- News
Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity
Microsoft has detailed three distinct attack paths used by actors aligned with ShinyHunters to infiltrate corporate Salesforce environments over the past...
- News
Misconfigured Server Exposes Three Evilginx Phishing Ops Targeting M365
An attacker's operational security mistake — leaving a Python HTTP server and .bash_history exposed on a public port — allowed researchers to uncover...
- News
Australia Warns of Global Campaign Targeting Vulnerable CMS Platforms
The Australian Cyber Security Centre has issued an alert about a coordinated global campaign actively exploiting unpatched vulnerabilities in WordPress,...
- News
China and India-Linked Hackers Both Targeted the Same Pakistani Police Force
SentinelOne researchers discovered that threat actors linked to both China and India independently targeted the Balochistan Police force in Pakistan for...
- News
Ghost Accounts Abuse GitHub API in Mass Recon Campaign
Multiple threat campaigns are leveraging disposable 'ghost' GitHub accounts to conduct mass reconnaissance against organizations, systematically mapping...
- News
Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns
SentinelOne researchers have uncovered two years of sustained cyberespionage against Pakistani law enforcement — with China-nexus and India-nexus threat...
- News
Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours
A single threat actor leveraged AI workflows, chained cloud misconfigurations, and stolen credentials to breach a large Amazon Web Services customer...
- Security
CVE-2026-35210: OpenCTI Authorization Bypass Allows Confidence Level and Object Marking Circumvention
An authentication bypass vulnerability in OpenCTI prior to 7.260326.0 allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass...
- News
RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service
A new Android malware operation called RedWing is being rented out on Telegram as a ready-made bank-fraud service, letting even low-skill criminals take...
- News
Chinese LLMs Broaden the Gap Between Attackers & Defenders
China's GLM 5.2 finds vulnerabilities at $0.17 each and outperforms frontier Western models on security benchmarks — while AI-enabled adversary activity...
- News
Agentic AI Used to Conduct Ransomware Attack via Langflow Vulnerability
Threat group JadePuffer leveraged an LLM agent to autonomously execute a multi-stage ransomware-style attack through a critical Langflow vulnerability,...
- News
Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer
Kaspersky has identified a previously undocumented APT group — Armored Likho (aka Eagle Werewolf) — deploying an AI-assisted Python infostealer called...
- News
JadePuffer Ransomware Used an AI Agent to Automate the Entire Attack
Security researchers have documented what appears to be the first ransomware operation conducted entirely by a large language model agent — JadePuffer...
- News
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
JFrog researchers attribute a fresh npm supply chain campaign to North Korea's Lazarus Group. Malicious packages impersonating Rollup polyfill tooling...
- News
North Korean Hackers Publish 108 Malicious Packages in PolinRider Campaign
Threat actors linked to North Korea's Contagious Interview campaign have published 108 malicious packages and browser extensions across npm, Packagist,...
- News
PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords
Jamf Threat Labs has discovered PamStealer, a sophisticated two-stage macOS infostealer that impersonates the Maccy clipboard manager, delivers a...
- News
FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs
Threat actors who exploited the FortiBleed vulnerability to gain persistent access to thousands of Fortinet firewalls are now monetizing that access by...
- News
Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices
Working alongside the FBI and Lumen Technologies, Google's Threat Intelligence Group has significantly degraded NetNut — one of the largest networks that...
- News
How Ransomware Syndicates Weaponize Corporate-Style Organization
From outsourced labor to tiered pricing models, today's top ransomware groups operate less like rogue hackers and more like Fortune 500 companies — with...
- News
U.S. Offers $10 Million for Russian Hackers Targeting WhatsApp and Signal Users
The U.S. Department of State is offering up to $10 million through its Rewards for Justice program for information identifying members of UNC5792 and...
- News
FBI: Russian Hackers Now Target Signal Backup Recovery Keys
The FBI and CISA warn that a Russian-linked phishing campaign targeting Signal users has evolved to steal Backup Recovery Keys, giving attackers full...
- News
Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials
Ukraine's SSU and the FBI have exposed a sustained Russian intelligence campaign using fake support SMS messages to steal Signal, WhatsApp, and Telegram...
- News
Why Patch Directives Only Go So Far
Six weeks of undetected access through a compromised VPN appliance exposes a hard truth: patching is necessary but not sufficient. Organisations already...
- News
Ukraine and FBI Expose Russian Intelligence Campaign Stealing Signal Credentials via Fake SMS
The SSU and FBI jointly disclosed a sustained Russian intelligence operation targeting messaging credentials of government officials, military personnel,...
- News
Europe Evolves Into Ransomware's Favorite Region
New research from Black Kite shows ransomware attacks against European organizations surged 55% in the first four months of 2026 compared to the same...
- News
More Malicious OpenClaw Skills Threaten AI Supply Chain
Unit 42 researchers identified five persistent malicious skill packages on ClawHub — OpenClaw's AI agent marketplace — including infostealers disguised as...
- News
Russian APT Gamaredon Upgrades Its Arsenal, Requiring New Defenses
ESET research reveals FSB-sponsored Gamaredon has significantly upgraded its C2 infrastructure obfuscation and malware delivery capabilities, running 35...
- News
FortiBleed: 5-Stage Attack Chain Behind 110 Million Credential Heist on FortiGate Firewalls
Deep analysis of the FortiBleed operation reveals a sophisticated five-stage credential harvesting pipeline — custom Golang sniffers, Telegram-based...
- Project
OpenCTI: Building a Cyber Threat Intelligence Platform in Your Homelab
Deploy OpenCTI to aggregate, correlate, and visualize threat intelligence from MISP, NVD, AlienVault OTX, and Shodan — all in a self-hosted Docker stack.
- News
FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist
The FortiBleed campaign's operators weaponize Fortinet's own built-in diagnostic command to run a custom Golang sniffer that intercepts 24 authentication...
- News
Scope of Salesforce Attacks Expands as Icarus Leaks Stolen Data
More victims have surfaced after attackers breached application vendor Klue and abused its OAuth tokens to access customers' Salesforce environments. The...
- News
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack, with attackers injecting backdoor code into Pro plugin releases...
- News
China-Nexus Actor Spies on US Researchers Undetected for a Year
Google's Threat Intelligence Group discovered and disrupted a sprawling China-nexus espionage campaign that stole RedCAP credentials to silently breach...
- News
Google Exposes China Espionage Group UNC6508 Lurking in Networks Since 2023
Google's Threat Intelligence Group has unmasked UNC6508, a China-linked espionage actor that silently maintained access to critical infrastructure and...
- News
How Software Development's Speed Obsession Enabled TeamPCP's Chaos Crusade
TeamPCP's remarkable success attacking open-source software was no accident — it exploited a cultural vulnerability baked into modern development: the...
- News
USB Worm Spreads Crypto-Stealing Malware via Windows Shortcut Files
A self-spreading USB worm active since February 2026 hides real files behind malicious .lnk shortcuts, hijacks clipboard cryptocurrency addresses, hunts...
- News
CryptoBandits Malware Doubles as a Backdoor, Abuses Tor for Stealthy C2
A newly detailed malware family called CryptoBandits routes all traffic through a local SOCKS5 proxy and the Tor network, blending credential theft with...
- News
Cybersecurity Firms Impacted by Klue Supply Chain Attack
The hackers exfiltrated data from Salesforce instances of Klue customers, including Huntress and Recorded Future, in a cascading supply chain compromise.
- News
Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data
Salesforce has disabled the Klue Battlecards app integration following a security incident in which attackers abused OAuth tokens to access customer CRM...
- News
Bulgaria Allowed Surveillance Tech Firm to Sell Products to Repressive Regimes, Report Says
Human Rights Watch obtained Bulgarian export licensing records showing the government approved surveillance firm Circles' technology sales to law...
- News
INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023
Cybersecurity researchers have charted the evolution of INC ransomware from a nascent RaaS operation to one of the most prolific cybercrime groups in...
- News
'Popa' Botnet Linked to Publicly-Traded Israeli Firm
Security researchers have traced the sprawling Popa Android botnet — which enslaved millions of consumer TV boxes for ad fraud and data scraping — to a...
- News
144 Mastra npm Packages Compromised via Hijacked Contributor Account
A supply chain attack dubbed easy-day-js has compromised 144 npm packages in the @mastra/* namespace by hijacking a contributor account for the popular...
- News
The Top 10 Attack Surface Exposures in 2026
A comprehensive breakdown of the most dangerous attack surface exposures organizations face in 2026 — from exposed admin panels and credential reuse to...
- News
'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud
The latest supply chain attacks against PyPI, which hit 37 wheels and 19 code packages, show a continued evolution of the persistent Shai-Hulud software...
- News
GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks
GitHub has announced that npm version 12 will disable install scripts by default as a breaking change aimed at combating software supply chain attacks...
- News
Who Runs the Ransomware Group 'The Gentlemen'?
KrebsOnSecurity investigates the identity and structure behind The Gentlemen, the second most active ransomware gang of 2026, known for offering...
- News
What the 2026 DBIR Confirms: Attacks Are Living in the Browser
The 2026 Verizon DBIR confirms phishing, shadow AI, malicious extensions, and credential theft now execute inside the browser, exposing major security gaps.
- News
IronWorm and New Miasma Worm Variant Hit npm in Coordinated Supply Chain Attacks
Two distinct malware campaigns have hit the npm ecosystem simultaneously — IronWorm deploys a Rust-based infostealer via 50+ poisoned packages, while a new…
- News
AI-Built Ransomware Toolkit Automates EDR Evasion and AD Discovery
A threat actor has deployed an AI-generated ransomware attack toolkit that automates Active Directory discovery and helps evade endpoint detection and…
- News
Beyond Assume-Breach: How AI-Native Security Will Reshape Enterprise Defense
Twenty years after Dark Reading launched, security leaders are looking beyond the assume-breach paradigm toward AI-native, hyper-segmented enterprise defense…
- News
As Global Powers Explore Humanoid Robots, Cyber-Risk Looms
Nation-states are racing to dominate the embodied AI and humanoid robotics market, but as governments and militaries integrate these systems, the…
- News
From $5 Attacks to Botnet-Powered Platforms: Inside the DDoS-as-a-Service Market
DDoS attacks are increasingly sold as subscription services with pricing tiers, reseller programs, and customer support. Flare's analysis reveals how the…
- News
Frontier AI Reinforces the Future of Modern Cyber Defense
As OpenAI and Anthropic push frontier AI capabilities forward, SentinelOne argues that AI-native, machine-speed cyber defense is now essential — and that the…
- News
GCHQ Chief: AI Is an 'Unstoppable Force' with Offensive and Defensive Cyber Ramifications
Anne Keast-Butler, head of the UK's GCHQ signals intelligence agency, has warned that artificial intelligence represents an unstoppable force in cyberspace…
- News
Russian Spies Aggressively Targeting Western Technology as Sanctions Bite
Western intelligence officials warn that Moscow's espionage apparatus is deploying cyber spies, hackers, and recruited middlemen to steal dual-use...
- News
UK Cyberspying Chief Calls AI 'an Unstoppable Force' and Warns About Russia
UK signals-intel chief warns AI is reshaping threats as an unstoppable force while Russia escalates hostile gray-zone activity below open conflict.
- News
Iranian APT Targets Aviation, Software Companies With
Nimbus Manticore, an Iranian advanced persistent threat group, has continued operations targeting aviation and software companies during and after the US.
- News
Ghostwriter Targets Ukraine Government Entities with Prometheus Phishing Malware
The Belarus-aligned Ghostwriter APT (UAC-0057/UNC1151) has launched a new phishing campaign impersonating Prometheus, a Ukrainian e-learning platform, to...
- News
ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI
This week's threat intelligence bulletin covers Linux rootkit campaigns, an actively exploited router zero-day, AI-assisted intrusions, new scam kit...
- News
Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials
Threat actors have compromised the widely-used actions-cool/issues-helper GitHub Action, redirecting every existing tag to a malicious imposter commit...
- News
Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid
Researchers at HUMAN Security uncovered Trapdoor, a sophisticated Android ad fraud and malvertising operation that used 455 malicious apps and 183...
- News
Verizon DBIR 2026: Vulnerability Exploitation Overtakes
Verizon's 2026 Data Breach Investigations Report reveals a landmark shift: vulnerability exploitation has surpassed credential abuse as the leading breach...
- News
Inside the REMUS Infostealer: Session Theft, MaaS, and Rapid Evolution
A Flare threat intelligence analysis breaks down the REMUS infostealer — a rapidly evolving credential theft tool built around stolen browser sessions and...
- News
Living Off the Pipeline: Defending Against CI/CD Subversion
Adversaries are increasingly weaponizing CI/CD pipelines as a living-off-the-land vector — abusing trusted build infrastructure to execute attacks without...
- News
ODNI Taps Officials to Coordinate Response to Foreign
Director of National Intelligence Tulsi Gabbard has appointed two officials to lead cross-agency monitoring of foreign threats targeting the 2026 U.S....
- News
SecurityScorecard Acquires Driftnet to Boost Third-Party
SecurityScorecard has acquired Driftnet to expand visibility into third-party ecosystems, addressing growing supply chain attack risks that continue to...
- News
TeamPCP Ups the Game, Releases Shai-Hulud Worm's Source Code
The hacking group TeamPCP has publicly released the source code for its Shai-Hulud supply chain worm, actively encouraging other threat actors to...
- News
Tables Turn on 'The Gentlemen' RaaS Gang With Data Leak
An OPSEC failure provides a rare window into the inner workings of The Gentlemen ransomware-as-a-service group, exposing their affiliate model, TTPs, and...
- News
Mini Shai-Hulud Worm Compromises TanStack, Mistral AI
TeamPCP has expanded its supply chain attack campaign with a fresh Mini Shai-Hulud worm that compromised npm and PyPI packages from TanStack, UiPath,...
- News
Google: Hackers Used AI to Develop Zero-Day Exploit for Web
Google Threat Intelligence Group researchers say a zero-day exploit targeting a widely used open-source web administration tool was likely generated using...
- HOWTO
CrowdSec: Deploy a Community-Powered Intrusion Prevention System
Install and configure CrowdSec on Linux to detect and block attacks using crowdsourced threat intelligence, custom scenarios, and iptables/nftables bouncers.
- News
One Missed Threat Per Week: What 25M Alerts Reveal About
Analysis of more than 25 million security alerts across enterprise SOCs reveals a troubling pattern: organizations are institutionalizing the practice of...
- News
Trellix Source Code Breach Claimed by RansomHouse Hackers
The RansomHouse threat group has claimed responsibility for the Trellix source code repository breach disclosed last week, leaking a set of proof images...
- News
New Bluekit Phishing Kit Features AI Assistant and Automated Domain Registration
A newly discovered phishing-as-a-service toolkit called Bluekit is emerging on underground forums, offering threat actors an AI assistant for campaign...
- News
Feuding Ransomware Groups Leak Each Other's Data
When rival ransomware groups 0APT and KryBit turned on each other, they exposed infrastructure details, operational data, victim lists, and internal...
- Newsletter
Apr 28 Digest: Medtronic 9M Breach, GitHub RCE, LiteLLM
ShinyHunters hits Medtronic and ADT in the same week, exposing millions of records; a critical one-push RCE lands in GitHub; LiteLLM's pre-auth SQL...
- News
ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse
This week's ThreatsDay Bulletin covers the $290M KelpDAO DeFi hack tied to Lazarus Group, new macOS living-off-the-land attack techniques, ProxySmart SIM...
- News
Researchers Uncover Pre-Stuxnet 'fast16' Malware Targeting
SentinelOne has discovered 'fast16', a 2005-era Lua-based cyber sabotage implant that predates Stuxnet by five years and targeted high-precision...
- News
Threat Actor Uses Microsoft Teams to Deploy New 'Snow'
UNC6692 employs email bombing and Teams impersonation to deliver a three-component Snow malware suite — SnowBelt, SnowGlaze, and SnowBasin — enabling full...
- News
Malicious KICS Docker Images and VS Code Extensions Hit
Threat actors hijacked the official checkmarx/kics Docker Hub repository by overwriting existing image tags — including v2.1.20 and alpine variants — and...
- News
Trigona Ransomware Deploys Custom CLI Exfiltration Tool in Active Attacks
Recently observed Trigona ransomware attacks are using a bespoke command-line exfiltration tool to steal data from compromised environments faster and...
- News
Vercel Finds More Compromised Accounts in Context.ai-Linked
Vercel has expanded its breach investigation tied to the Context.ai supply chain compromise and identified additional customer accounts with unauthorized...
- News
No Exploit Needed: How Attackers Walk Through the Front
Stolen credentials remain the dominant initial access vector in 2026 — no zero-days, no malware, just valid logins that blend in with normal activity...
- News
Why the Axios Attack Proves AI Is Mandatory for Supply
The North Korean supply chain attack on Axios — a JavaScript library with 100 million weekly downloads — highlights why human-scale monitoring can no...
- News
Tycoon 2FA Loses Phishing Kit Crown Amid Surge in Attacks
Following law enforcement disruption of the Tycoon 2FA platform, threat actors are reusing its tools and techniques across a wave of new phishing kits,...
- News
$13.74M Hack Shuts Down Sanctioned Grinex Exchange After
Grinex, a Kyrgyzstan-based cryptocurrency exchange sanctioned by the U.S., U.K., and EU for facilitating sanctions evasion, has suspended all operations...
- News
Grinex Exchange Blames Western Intelligence for $13.7M
Kyrgyzstan-based cryptocurrency exchange Grinex has suspended all operations after a $13.7 million hack, with the platform controversially attributing the...
- News
Three Microsoft Defender Zero-Days Actively Exploited; Two
Huntress is warning that threat actors are actively exploiting three privilege escalation vulnerabilities in Microsoft Defender — codenamed BlueHammer,...
- News
Citizen Lab: Law Enforcement Used Webloc to Track 500
Citizen Lab has documented how an Israeli surveillance company called Cobwebs Technologies built an advertising-based global geolocation platform named...
- News
UK Government Threatens Tech Bosses With Jail Time Over AI
UK communications regulator Ofcom has warned tech executives they face criminal prosecution and imprisonment if their platforms fail to adequately combat...
- News
Cryptocurrency ATM Giant Bitcoin Depot Reports $3.6 Million
Bitcoin Depot, one of North America's largest Bitcoin ATM operators, has filed an SEC disclosure revealing a cyberattack in which threat actors gained...
- News
Cybercriminals Target Accountants to Drain Russian Firms'
Cybercriminals are stealing millions from Russian companies by compromising accountants' computers and disguising fraudulent transfers as routine salary...
- News
ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache
This week's ThreatsDay Bulletin from The Hacker News covers 20 active threats including a hybrid P2P DDoS botnet, a 13-year-old Apache ActiveMQ RCE flaw...
- News
Storm-1175 Deploys Medusa Ransomware at 'High Velocity'
Microsoft says the financially motivated cybercrime group Storm-1175, linked to China, has exploited N-day and zero-day vulnerabilities in high-velocity...
- News
Microsoft Links Storm-1175 to Medusa Ransomware Zero-Day
Microsoft has formally attributed Medusa ransomware zero-day attacks to Storm-1175, a China-based financially motivated cybercriminal group that has...
- News
36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants
Cybersecurity researchers discovered 36 malicious npm packages disguised as Strapi CMS plugins that abused Redis and PostgreSQL connections to harvest...
- News
Evolution of Ransomware: Multi-Extortion Ransomware Attacks
Modern ransomware has evolved far beyond simple file encryption. Multi-extortion tactics — combining encryption, data theft, and public leak threats —...
- News
Microsoft Details Cookie-Controlled PHP Web Shells
Microsoft Defender researchers have documented a stealthy PHP web shell technique that uses HTTP cookies as a covert command-and-control channel on Linux...
- News
UNC1069 Social Engineering of Axios Maintainer Led to npm
The North Korean threat actor UNC1069 used a sophisticated, targeted social engineering campaign against the Axios npm package maintainer Jason Saayman to...
- News
Blast Radius of TeamPCP Attacks Expands Amid Hacker
As organizations disclose breaches tied to TeamPCP's supply chain attacks, ShinyHunters and Lapsus$ are taking credit and creating a murky attribution...
- News
Adversaries Exploit Vacant Homes to Intercept Mail in Hybrid Cybercrime
Threat actors are weaponizing vacant properties as drop addresses for mail interception, blending physical access with digital fraud. A Flare threat...
- News
Drift Loses $280 Million as Hackers Seize Security Council
The Drift Protocol DeFi platform lost at least $280 million after a sophisticated threat actor executed a planned governance attack, seizing control of...
- News
Google Attributes Axios npm Supply Chain Attack to North
Google's Threat Intelligence Group has formally attributed the supply chain compromise of the popular Axios npm package to UNC1069, a financially...
- News
Attack on Axios Developer Tool Threatens Widespread
Security researchers at multiple firms are sounding alarms over a supply chain attack against Axios, an npm package with 100 million weekly downloads....
- News
New RoadK1ll WebSocket Implant Used to Pivot on Breached
Security researchers have identified a newly discovered malicious implant named RoadK1ll that leverages WebSocket connections to silently move from an...
- News
Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple
This week's cybersecurity roundup covers long-running telecom espionage operations reaching courtrooms, resurging LLM jailbreak techniques, Apple's UK age...
- News
AI Slashes Cyberattack Exploit Timelines From Years to Days
New research shows AI is dramatically accelerating how quickly threat actors can weaponize vulnerabilities, with 92% of security professionals expressing...
- News
TA446 Deploys DarkSword iOS Exploit Kit in Targeted
Proofpoint has attributed a targeted email campaign to Russian state-sponsored threat actor TA446, which is leveraging the recently disclosed DarkSword...
- News
TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides
The TeamPCP threat actor — behind previous supply chain attacks on Trivy, KICS, and litellm — has now compromised the telnyx Python package on PyPI,...
- Project
Build a Collaborative IPS with CrowdSec
Deploy CrowdSec on a Linux server to get community-powered intrusion prevention — block brute-force attacks, credential stuffing, and vulnerability...
- News
New Speagle Malware Hijacks Cobra DocGuard for State-Sponsored Espionage
A newly discovered .NET infostealer dubbed Speagle repurposes compromised Cobra DocGuard servers for C2 and data exfiltration, targeting organizations...
- News
Interlock Ransomware Has Been Exploiting Cisco FMC Zero-Day
The Interlock ransomware gang has been actively exploiting a CVSS 10.0 insecure deserialization flaw in Cisco Secure Firewall Management Center since late...
- News
LeakNet Ransomware Weaponizes ClickFix and Deno Runtime for Stealthy Corporate Attacks
The LeakNet ransomware gang is using ClickFix social engineering for initial access and a Deno-based malware loader to execute fileless payloads from...
- News
GlassWorm Escalates: 72 Malicious Open VSX Extensions Use
The GlassWorm self-propagating worm campaign has compromised 72 Open VSX extensions using invisible Unicode Private Use Area characters and a Solana...
- News
Termite Ransomware Operator Velvet Tempest Chains ClickFix
Microsoft-tracked threat actor Velvet Tempest is deploying Termite ransomware via a ClickFix social-engineering chain that loads DonutLoader and installs...
- Project
Deception Technology Lab: T-Pot Honeypot with OpenCanary
Deploy a full deception technology stack using T-Pot and OpenCanary to capture real attacker behaviour, generate threat intelligence, and sharpen your...
- News
Cloudflare 2026 Threat Report: 230 Billion Daily Threats as
Cloudflare's inaugural threat intelligence report reveals its network blocks 230 billion cyber threats daily, with DDoS attacks doubling to 47.1 million...
- News
AI-Armed Amateur Hacker Compromises 600+ FortiGate
Amazon's threat intelligence team has documented how a Russian-speaking, financially motivated actor used multiple commercial generative AI tools to...
- News
Diesel Vortex: Russian Cybercrime Ring Steals 1,649
A Russian-linked phishing operation dubbed Diesel Vortex has stolen over 1,649 credentials from major freight and logistics companies across the US and...
- News
AI-Driven Threats Accelerate: Agentic Attacks, Model
Multiple industry reports warn that 2026 marks the emergence of agentic AI threats — autonomous systems capable of planning and executing multi-step...
- News
Ransomware in 2026: Data-Only Extortion Replaces Encryption
With 91 publicly disclosed ransomware attacks in January 2026 alone, the ransomware landscape is shifting toward data-only extortion while healthcare...
- News
SSHStalker Linux Botnet Uses IRC Protocol for Command and Control
Security researchers discover a new Linux botnet named SSHStalker that leverages the legacy IRC protocol for C2 operations, marking a return to old-school...
- Security
International AI Safety Report: AI Now Provides 'Meaningful
The 2026 International AI Safety Report confirms AI systems can assist attackers across multiple stages of the cyberattack chain, with vulnerability...
- Newsletter
Global Threat Intelligence & New Tools - Issue #3
This week: state-backed espionage campaigns across 155 countries, China-linked router hijacking, ransomware surge, new security tools, and site updates.
- News
Shadow Campaigns: State-Backed Espionage Group Breaches 70+
Palo Alto Unit 42 reveals a state-aligned group designated TGR-STA-1030 compromised government and critical infrastructure targets in 37 countries using...
- HOWTO
OSINT Reconnaissance Methodology for Security Professionals
A structured approach to open-source intelligence gathering covering domain reconnaissance, email enumeration, social media profiling, and infrastructure...
- News
AI-Powered Cyberattacks Expected to Cause Major Enterprise
Security experts predict autonomous AI systems will be responsible for at least one major enterprise breach within months, as threat actors weaponize...
- News
The Rise of Ransomware-as-a-Service: 14 Active Platforms
Security researchers identify 14 active RaaS platforms operating sophisticated affiliate programs, with entry costs as low as $40 per month lowering the...
- News
Ransomware Attacks Surge in Early 2026 with 26 Claims in One Day
Threat intelligence reports show 8 active ransomware groups claimed 26 victims on February 2nd alone, with major corporations including BASF and Honeywell...
- News
Healthcare Sector Faces Unprecedented Ransomware Surge in 2026
Ransomware attacks against healthcare organizations have increased 67% in the first month of 2026, with multiple hospital systems reporting service disruptions.
- News
AI-Powered Phishing Achieves 54% Click-Through Rate
Microsoft reveals adversaries using AI for automated vulnerability discovery, phishing campaigns, and malware generation. AI-crafted phishing emails...