In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2499 articles
Researchers linked APT36 infrastructure to CapraRAT APKs, including one impersonating Viber. The spyware requests permissions that could enable surveillance, message interception, and access to device data.
Wiz researchers describe JINX-0132 exploiting exposed or misconfigured Nomad, Consul, Docker API, and Gitea instances to run XMRig miners, and outline exposure findings and defenses.
Cisco Talos details three threats disguised as AI tool installers: CyberLock and Lucky_Gh0$t ransomware, and Numero, which disrupts Windows interfaces. The installers spread through fake sites, search results, and a malicious ChatGPT-themed package.
Huntress describes a 2025 intrusion at a market research company, with reconnaissance and credential-related registry changes on a server followed by a Mesh Agent loader on an executive’s workstation. Huntress suspects state-aligned espionage actors.
CloudSEK says its BeVigil scanner found unauthenticated LFI endpoints on a travel-industry subdomain that could expose server files, source code, credentials, and configuration data.
Team Cymru and Black Lotus Labs map DanaBot’s multi-tier C2 and management infrastructure, reporting more than 150 active C2 servers on average and Russian-linked backend systems. The article also describes the Operation Endgame II takedown.
Wiz reports active exploitation of Ivanti EPMM vulnerabilities CVE-2025-4427 and CVE-2025-4428, detailing Sliver payloads, database dumping, web shells and reverse shells. Ivanti patches are available.
Hunt.io researchers link more than 230 domains impersonating Gulf-region businesses to shared SSH keys and hosting patterns. The ongoing campaign uses cloned sites, including mobile payment lures targeting Zain customers.
CloudSek says many hacktivist claims against Indian targets were exaggerated or unsupported, while detailing APT36’s phishing campaign using Crimson RAT to target government and defense networks.
Huntress observed three incidents involving exploitation of Samsung MagicINFO 9. Attackers attempted to install services using downloaded executables; one host showed execution evidence. Huntress advises keeping servers off the internet until a patch is available.
Bitdefender details an active malvertising campaign using cryptocurrency-brand impersonation and targeted Facebook ads to deliver malware. Its scripts coordinate with a local service to run payloads and collect system data while evading analysis.
Huntress compared intrusions exploiting CrushFTP and CentreStack/Triofox, finding shared infrastructure and tools despite different file-transfer methods. In some incidents, security tools detected and quarantined files before further activity.
Researchers detail a campaign using a cloned Indian Defence Ministry portal and clipboard-based commands to deliver malware on Windows and Linux. The Windows payload uses mshta.exe; the observed Linux script only opens an image.
Darktrace details SocGholish infections leading to RansomHub activity, including fake browser updates, WebDAV and SCF-based forced authentication to expose NTLM hashes, Python backdoors, and port-hopping C2.
Aqua researchers found that overly permissive default IAM roles in AWS services and the Ray framework could let attackers misuse S3 access to tamper with other services and potentially escalate privileges. AWS changed several policies and guidance.
Volexity describes campaigns by suspected Russian actors UTA0352 and UTA0355 that use targeted social engineering and legitimate Microsoft OAuth workflows to steal authorization codes and access victims’ Microsoft 365 accounts.
An investigation links staged domains and M247 servers to APT34-like infrastructure through shared SSH keys, fabricated company websites, and a port 8080 404 response pattern, offering indicators defenders can monitor before activity begins.
Huntress reconstructs two incidents involving abused or attacker-installed RMM tools, including one ending in Akira ransomware. It recommends asset inventory, attack-surface reduction, and endpoint monitoring.
A briefly exposed server linked to KeyPlug and RedGolf/APT41 contained Fortinet exploit scripts, a PHP webshell, reverse-shell tools, and reconnaissance files listing Shiseido-related domains and authentication portals.
Researchers analyzed fake PDF-to-DOCX sites impersonating pdfcandy[.]com that trick users into running PowerShell, delivering Arechclient2/SectopRAT. The report details the redirect chain, Windows execution stages, IOCs and defenses.
Researchers identified phishing pages impersonating employee and member portals that steal credentials and OTPs. The PHP-based kit uses server-side validation, while related domains and hosting infrastructure provide indicators for defenders to investigate.
Huntress traced a successful RDP brute-force intrusion, credential-file searching and domain enumeration to infrastructure it suspects is linked to ransomware operators and initial access brokers.
Hunt.io identified a GoPhish server linked to domains impersonating Polish energy and government organizations, as well as other brands. No phishing content was active during review, but the infrastructure appeared maintained for possible credential collection.
Hunt.io researchers describe Gamaredon’s short-TTL, rotating DNS infrastructure and a separate server cluster linked to a ShadowPad backdoor, detailing its delivery chain, shared certificate clues, and indicators of compromise.
