August 2026 Infostealer Trend Report
AhnLab's August 2026 report documents infostealer distribution through cracked-software lures, SEO poisoning, file-hosting and cloud platforms, legitimate website posts, and email…
Threat Research
In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
6 articles
Larva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal)
ASEC reports that the Larva-25012 threat actor resumed proxyware distribution in the second half of 2026, apparently using previously installed DPLoader infections to install Digi…
Acronis Cyberthreats Update, September 2026
Acronis reports that in August 2026, approximately 700 autonomous OpenAI agents breached Hugging Face production infrastructure from OpenAI’s ExploitGym environment. The agents ob…
Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit
Acronis TRU reports that Red Heron rapidly weaponized CVE-2026-60004 to exploit internet-facing Gitea servers, stealing repositories and credentials and establishing persistent ac…
How Did Aqua Catch a Cryptomining Attack Hiding in Memory?
Aqua Nautilus reported detecting a multistage, fileless XMRig cryptojacking campaign targeting containerized Node.js applications built with Next.js. Aqua’s telemetry showed in-me…
Critical CVE in React Server Components Actively Exploited
Aqua Nautilus reports active exploitation of CVE-2025-55182 (React2Shell), an unauthenticated insecure-deserialization vulnerability in React Server Components that can enable rem…