In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2384 articles
Huntress analyzed a fake GTA 6 ISO that installs NJRAT, DCRAT, Mercurial Grabber, and Chaos ransomware used as a wiper. Researchers say updated Windows Defender should detect it.
Unit 42 demonstrated that an attacker with root access to a Kubernetes node can spoof cgroup data to trick SPIRE into issuing co-located workloads’ identities. Its Spooffe tool automates identity enumeration; Unit 42 reports no in-the-wild exploitation.
Proofpoint reports that BlueMoon chains Chrome and Windows flaws in espionage campaigns linked to APT31 and other clusters. Attacks install varied payloads and persistence; patching Chrome does not remove existing implants.
Proofpoint reports at least four China-aligned groups used the BlueMoon chain of three unpatched browser and Windows flaws for espionage since late August, targeting organizations in the U.S. and Southeast Asia.
A password-protected pension-themed Word attachment concealed DellHeuristics.exe, whose lab activity used GitHub APIs. Its embedded IP matched an earlier regional phishing IOC, but a SideWinder link remains unproven.
The article details how an AD RMS Service Group member can extract a software-held SLC private key, decrypt documents protected by the deployment offline, and forge trusted identities. It explains detection gaps and limits of remediation.
Zscaler ThreatLabz analyzed SloppyRAT, a malware family found in June 2026 that is likely used in ransomware-related attacks. It details the ClickFix delivery chain, malware capabilities, C2 communications, and detection guidance.
Hunt.io reports a campaign exploiting CVE-2026-15409 in SonicWall SMA1000 appliances to steal LDAP credentials and Active Directory secrets. It assesses with moderate confidence that the activity is linked to a cyberattack on a UK council.
Cofense describes a phishing campaign impersonating university leaders with fabricated sexual misconduct claims. Links route victims through Google Drive to a malicious Zoho Assist download; healthcare-affiliated universities appear to be the main targets.
Socket traced malicious browser extensions targeting Axiom Trade and Padre users. The extensions harvest authenticated session and wallet-related data and send it to attacker-controlled infrastructure.
The episode discusses four npm packages containing a Mini Shai-Hulud payload that resurfaced after 111 days, plus supply-chain threats, PolinRider’s execution method, GitHub defenses and developer precautions.
Volexity reports that UTA0560 and JungleBamboo used the same Chrome–Windows exploit chain in phishing campaigns, despite a gap between Chromium fixes and Chrome releases, to deploy distinct backdoors and credential-stealing malware.
Wiz researchers found LiteLLM authentication weaknesses and exploitable attack paths to MCP access, root-level code execution, and cloud credentials. Patches are available; the MCP bypass has been observed exploited and is listed in CISA’s KEV catalog.
Zimperium’s zLabs details Mantax Otax v2, an Android spyware-ransomware linked to Indonesian actors. It spreads through sideloaded APKs, steals credentials and surveillance data, and mainly encrypts files on Android 9 and earlier; Firebase supports C2 and extortion.
LevelBlue analyzes four Nightmare-Eclipse PoCs targeting Kaspersky, Avast, NVIDIA, and CrowdStrike, detailing their techniques, impacts, detection opportunities, and remediation status.
Sophos analyzed a staged rootkit on compromised F5 BIG-IP APM devices that hides a web shell in memory by intercepting Apache and PHP operations. F5 linked related activity to exploitation of CVE-2025-53521.
Unit 42 traced a pay-per-install operation using gaming videos and SEO-poisoned downloads to spread OfferLoader and deliver Insomnia RAT, ARKTunnel and Docro Hijacker. Researchers identified over 10,000 loader samples.
Barracuda researchers describe a phishing campaign that routes victims through Microsoft services, then builds the phishing page locally with a blob URL. Service workers, sandboxed iframes and backend controls manage the workflow.
Sophos explains how c05d5254 modifies Apache and PHP loading to inject a web shell into memory on F5 BIG-IP APM appliances, evading disk scans. It recommends checking memory, files, logs and integrity reports even after patching.
Proofpoint details BlueMoon, an exploit kit chaining Chrome and Windows vulnerabilities that multiple espionage-focused actors used in spearphishing campaigns. The report covers its exploit mechanics, payloads, targets, and detection opportunities.
Seqrite analyzes MacSync, a macOS MaaS stealer delivered through ClickFix lures and malvertising. The report details its native Mach-O stager, in-memory AppleScript payload, credential theft, persistence, and chunked exfiltration.
Check Point Research found that hidden ChatGPT instructions could use shared JFrog Artifactory metadata to relay connected Gmail data, chat history, and files between accounts. OpenAI took the internal service offline; no user update is required.
StealthMole traces The Night Hunters’ fragmented Telegram and social-media network, linking it to seven defacement alerts and actor-published claims of database, government and industrial-control access. The claims are not independently verified.
Huntress traced a campaign using rogue ScreenConnect clients to run staged VBScript and PowerShell payloads, persist on Windows hosts, and spread scripts to newly connected endpoints. ConnectWise fixed a related file-transfer vulnerability in ScreenConnect 26.6.5.
