In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2375 articles
Infoblox reports that Sable Squirrel controls over 10,000 domains and estimates it spent more than $7 million acquiring expired domains. Its investigation links 405 domains to malware C2 and over 31,000 samples, but does not confirm ransomware execution.
Kaspersky analyzes a Storm-2603-attributed ToolShell intrusion using an in-memory SharePoint webshell, Velociraptor and tunneling tools. Kaspersky says its endpoint protection blocked a Warlock ransomware launch attempt and details runtime detection clues.
SOCRadar reviews reports linking ARTEX, an LLM-agent pentesting framework, to espionage and financially motivated intrusions. CrowdStrike reported 200+ targets and nine confirmed post-exploitation victims; suggested defenses focus on identity hardening and behavior-
Bitdefender researchers detail GhostMap, an Android ZIP-parsing flaw that can make a crafted app trigger a persistent system crash loop, potentially requiring a data-erasing reset. Reproduced on Android 10+; no in-the-wild use observed, and Google says no security fix.
Aikido reports that RubyGems extensions and plugins can execute code during installation, and plugins can run on later gem commands. It found four gems sending data; opt-out controls are available in RubyGems and Bundler 4.1 prereleases, not stable 4.0.x.
Hunt.io researchers analyzed an exposed toolkit documenting PAN-OS exploitation, reporting 19,182 scanned management portals and logs indicating 25 root compromises. They detail the exploit chain, persistence, lateral movement, and AI-assisted tooling.
In an October 2026 intrusion, Anubis operators used the newly identified Backdoor.Lindnor, 13 security-disabling executables, five vulnerable drivers and AnyDesk configured for Safe Mode. The encryption payload was blocked; no files were reported encrypted.
XLab says CWPdoor is distributed through a trojanized CWP web server. The passive backdoor accepts signed, encrypted HTTP commands and suppresses access logs; researchers recommend checking for indicators and replacing compromised binaries.
Push Security reports that fake OpenAI, SpaceX and Anthropic event pages use Kali365 device-code phishing and VoidProxy AiTM attacks to steal Microsoft and Google credentials and sessions.
CrowdStrike observed a median of less than a day from public POC release to exploitation; 91% of observed vulnerabilities with public POCs were exploited within 48 hours. Case studies show adversaries adapting public exploits.
Sonatype found concealed loaders in 12 releases across 10 hijacked npm packages. They use Ethereum transactions to locate and execute remote JavaScript; shared wallet, infrastructure, and retrieval paths support a link to PolinRider activity.
Sekoia details a watering-hole campaign assessed with moderate-to-high confidence as APT29, using compromised sites and Plerdy to deliver patched iOS and Android exploits that stole cookies, Wi-Fi passwords and device data.
NetSPI demonstrates how attackers with compromised user or service-principal access can use Microsoft Graph Rich Notifications to exfiltrate Outlook snippets and Teams messages, and describes monitoring via the added GraphNotificationsActivityLogs table.
Researchers mapped a signed CookUp installer that installs a harmless recipe app but can use three gates and a server-issued token to fetch and run a DLL in memory. The server refused observed sessions, leaving the final payload unknown.
ESET attributes a surveillance campaign to SlippyNunchucks, which tampered with DNS responses for Sogou Input Method’s HTTP configuration requests to deliver DarkVigil. Tencent patched the issue in version 16.10 (CVE-2026-120422).
A fake Marvell RAID MSI uses renamed Microsoft-signed MSBuild and a tampered .NET library to decrypt and run a payload in memory, then downloads five DLL-sideloading kits. Researchers link its C2 to CNCMachineRMS by behavior, but have no code-level match.
ReversingLabs details TraderTraitor-associated developer malware found in telemetry before public disclosure, including earlier ROOFDECK samples. The FBI attributed the Binance theft to TraderTraitor, but no link to the analyzed samples is established.
Acronis TRU describes BOSSAI, a 12-agent AI attack mesh operated by one person and used against organizations in 11 countries. The investigation reports confirmed data access or exfiltration at roughly 10 targets, including emergency services and universities.
Booz Allen researchers found two AI models succeeded across eight OT attack scenarios in an isolated lab. Human approval was required for physical actions; conventional defenses slowed the models but did not consistently stop them.
Material Security says Operation CloudFire used Google Calendar invites, reverse-proxied sign-in pages, and relayed MFA prompts to capture live Google sessions. Its takedown effort reported 897 domains over one month; activity appears to have dispersed.
A DNS investigation of APT36’s RapidRust campaign linked its known indicators to 341 email-connected domains, lookalike domains, and two IPs classified as malicious by a threat-intelligence API. The authors caution that some flagged entities may be benign.
ESET details how SlippyNunchucks allegedly hijacked Sogou Input Method’s insecure HTTP traffic to deliver DarkVigil via a malicious configuration. The DNS manipulation point remains unknown; Tencent fixed the issue in version 16.10.
Hunt.io analyzed exposed directories linked to ARTEX, finding AI model-routing components, remote-access and proxy tools, and staged JNDI/LDAP exploitation infrastructure. The artifacts’ relationship to the reported South Korean breaches remains unconfirmed.
Chainalysis describes DPRK-linked fake-interview schemes, their reported losses, and blockchain-based malware C2 techniques. Binance’s initial findings say a fake job process gave attackers an employee foothold; the investigation is ongoing.
