In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2393 articles
ESET says the Gentlemen ransomware group uses GentleKiller and other tools to disable EDR defenses. Its analysis describes BYOVD-based privilege escalation, targeting of more than 400 processes, and multiple tool variants.
Varonis Threat Labs found that attackers brute-forced an intentionally exposed Google Cloud SQL honeypot, extracted decoy data and left ransom notes. Similar AWS RDS and Azure MySQL honeypots were not compromised.
Analysis of an exposed attacker directory traces a campaign targeting exposed Fortinet devices. Researchers say 21,632 entries did not represent verified breaches; their review found evidence of internal traffic at 918 organisations and 148 confirmed compromises.
Authorities took down more than 100 servers and domains and remediated 14,971 websites in an operation targeting TA569. Proofpoint details SocGholish’s fake-update and GhoLoader chain and recommends layered defenses and WordPress hardening.
A fake EQVita homebrew project lures PlayStation Vita fans into running Windows files, including a disguised Lua script that checks location and contacts attacker infrastructure. Similar fake repositories have distributed SmartLoader and Lumma Stealer.
Microsoft reports a campaign active since at least February that uses malicious USB shortcut files and Tor to spread malware, steal cryptocurrency wallet data, capture screenshots, and execute downloaded JavaScript.
AhnLab analyzed resume-disguised LNK files that launch decoy documents while creating scripts, scheduling persistence, and downloading payloads. DLL side-loading then loads Xctdoor, which attempts to contact an external C2 server.
Sysdig researchers observed an actor using an exposed, unauthenticated Ollama server as inference capacity for VAPT, an evolving offensive framework. Its observed targets were private practice ranges; no public victim systems were targeted.
A compromised Mastra npm maintainer account was used to inject a malicious dependency into more than 140 packages. The malware installs a cross-platform backdoor that steals browser data and can run attacker-supplied code; attribution remains unconfirmed.
Rapid7 analyzed a Dropping Elephant campaign that used a China-themed lure, DLL side-loading and Donut shellcode to run an evasive RAT in memory. The report details its tradecraft, C2 behavior and behavior-based detection opportunities.
StepSecurity reports that 15 JetBrains Marketplace plugins with about 70,000 installs captured AI API keys and sent them over plaintext HTTP to a hardcoded C2. JetBrains removed the plugins; StepSecurity found the server still responding on June 19, 2026.
Datadog demonstrates how an attacker controlling an Entra agent blueprint could add a credential, impersonate associated agents across tenants, and use a privileged agent’s permissions to take over a Global Administrator account.
ThreatLabz found SmartApeSG JavaScript injected into the Okendo Reviews widget. The obfuscated, staged loader targeted desktop visitors and could lead to ClickFix prompts and malware delivery. Okendo restored the script to a clean state.
Trend Micro details in-the-wild exploitation of CVE-2026-35273 in PeopleTools 8.61 and 8.62. The chain uses PSIGW SSRF and XMLDecoder for in-JVM RCE; Oracle released an out-of-band patch on June 10, 2026.
ESET researchers detail how the Gentlemen ransomware group maintains and supplies affiliates with a standardized suite of EDR killers, including its in-house GentleKiller framework and externally sourced tools.
LevelBlue SpiderLabs details RoguePlanet’s Windows Defender workflow abuse to gain SYSTEM execution and GreatXML’s WinRE recovery-partition tampering to access BitLocker-protected data, with technical mechanisms and detection guidance.
AhnLab details malicious consent-form LNK files that launch obfuscated PowerShell, run downloaded payloads in memory, establish scheduled-task persistence and collect system data. The activity resembles prior Kimsuky operations.
Cato Networks reconstructed an intrusion attributed to Poisson, who used OpenSSH and Tailscale to retain access to a French automotive business after its Havoc C2 went offline. The investigation also describes keylogging and persistence methods.
Netskope describes a macOS ClickFix campaign using fileless AppleScript to steal credentials and data, tamper with cryptocurrency wallets, and install persistent remote access through a fake Apple system service.
Wiz describes how its Red Agent bypassed a GitHub URL validator in a GCP Cloud Run service to read local files, exposing service-account credentials and application source code.
Check Point researchers detail a campaign distributing Rust clipboard hijackers for Windows and macOS through fake crypto tools. The malware replaces copied wallet addresses, while manipulated engagement across platforms helps make downloads appear trustworthy.
A malicious dependency added to 141 Mastra npm packages ran an install-time loader that deployed a cross-platform implant. Socket says the payload collected browser history and wallet-extension inventories, installed persistence, and enabled further remote tasking.
Zimperium’s zLabs describes Rokarolla, an Android banking trojan that targets 217 banking and crypto apps. Fake-app droppers and Accessibility abuse enable credential and PIN theft, SMS interception, clipboard manipulation, and covert screenshots.
Researchers detail three ClickFix campaigns using BabaDeda, Lorem Ipsum and Potemkin loaders to deliver stealers, RATs and backdoors through fake update lures, compromised sites, staged payloads and techniques including DLL side-loading and DGA-based C2.
