In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2500 articles
Hunt.io researchers describe Gamaredon’s short-TTL, rotating DNS infrastructure and a separate server cluster linked to a ShadowPad backdoor, detailing its delivery chain, shared certificate clues, and indicators of compromise.
Huntress observed in-the-wild exploitation of CrushFTP’s CVE-2025-31161 authentication bypass, followed by backdoor-account creation and deployment of RMM tools and malware. Affects versions 10.0.0–10.8.3 and 11.0.0–11.3.0; patched in 10.8.4+ and 11.3.1+.
Hunt.io researchers used behavioral queries to identify ClickFix pages delivering Lumma and CryptBot, harvesting Zoho credentials, and staging PowerShell payloads. The article details their techniques, infrastructure, indicators, and defensive recommendations.
Aqua researchers detail a campaign that brute-forces Tomcat management consoles, installs JSP backdoors, steals SSH credentials, and deploys Windows and Linux payloads for persistence, lateral spread, and cryptomining.
Researchers detail a phishing campaign using Cloudflare Pages and Workers, search-ms links, and disguised LNK files to install malware. The infection reports victims’ IP addresses through Telegram and establishes persistence while communicating with Pyramid C2.
Wiz describes JINX-0126’s use of weakly credentialed exposed PostgreSQL servers to deploy fileless XMRig-C3 miners. Pool statistics suggest the campaign may have affected over 1,500 machines.
ThreatFabric analyzes Crocodilus, an Android banking Trojan that uses Accessibility features, overlays and remote control to steal credentials, OTPs and crypto wallet seed phrases. Early campaigns targeted Spain and Turkey.
A campaign impersonates brands in partnership emails to lure YouTube creators into a Clickflix flow that runs malicious PowerShell and delivers Lumma Stealer, which targets browser credentials, cookies, and cryptocurrency wallets.
Wiz researchers detailed four Ingress NGINX flaws that can enable unauthenticated RCE and access to Kubernetes secrets. They reported more than 6,500 publicly exposed clusters; fixes are available in versions 1.12.1 and 1.11.5.
Bitdefender researchers analyzed a campaign of at least 331 Google Play apps with more than 60 million downloads. The apps bypassed Android restrictions to hide, launch ads, and direct users to phishing attempts; 15 were still available when the research ended.
Researchers found evidence of intrusions against South Korean organizations using reconnaissance tools, SQL injection, and Rust- and MinGW-compiled loaders to deploy Cobalt Strike Cat and Marte shellcode. Logs showed two compromised hosts beaconing.
Wiz says reviewdog/action-setup@v1 was briefly compromised, injecting code that exposed CI secrets in workflow logs. Coinbase confirmed an unsuccessful attempt to compromise coinbase/agentkit; Wiz recommends auditing runs and rotating exposed secrets.
Cisco Talos describes observed phishing and spam campaigns that use CSS to hide content from email filters and track recipients’ actions, preferences, and device details, and recommends filtering and email privacy proxies.
Hunt researchers found a web-based file management panel called Filebroser on two of four servers hosting JSPSpy web shells. They describe the infrastructure and share HTTP indicators and page titles defenders can use to track related activity.
Huntress reconstructs an intrusion involving a successful account brute-force attack, credential theft through an unpatched Veeam service, WinRM lateral movement and persistence. VPN compromise is suspected, but telemetry was incomplete.
Talos describes attacks targeting organizations in Japan since January 2025. The unknown attacker exploited CVE-2024-4577 for access, then used Cobalt Strike and other tools for persistence, lateral movement, and credential theft.
A campaign targeting Albion Online players used fake EFF messages and decoy documents to deliver Stealc and Pyramid C2 malware. Researchers detail its execution chain, credential theft, and 11 related servers linked by shared SSH keys.
Huntress investigated three intrusions at organizations wholly or partly in Canada, linking activity to RedCurl through malware, infrastructure and tradecraft. Attackers used scheduled tasks, Python reverse proxies and cloud storage for suspected exfiltration.
Cisco Talos attributes campaigns targeting government, manufacturing, telecommunications and media organizations to Lotus Blossom, detailing Sagerunex variants that use Dropbox, Twitter and Zimbra for command and control.
Darktrace analyzes Lynx ransomware’s tactics and a December 2024 customer compromise involving lateral movement, suspected stolen admin credentials, data exfiltration, AnyDesk use, and SMB-based file encryption.
Researchers traced Joker Android malware infrastructure by pivoting on reused SSL certificates, identifying 77 linked Alibaba-hosted servers and malicious APKs. The malware can steal SMS and device data and enroll victims in premium services.
Researchers found LightSpy command-list entries for extracting Facebook and Instagram database files, a previously unreported core version, Windows surveillance plugins, and exposed administration endpoints across its infrastructure.
Fake software download pages targeting Chinese-speaking users distribute backdoored Windows executables that modify Windows Defender settings and connect to suspected command-and-control infrastructure.
Wiz Research details CVE-2024-0132, a TOCTOU flaw in NVIDIA Container Toolkit that can let a container-image controller mount the host filesystem and escape isolation. NVIDIA says version 1.17.4 fixes it and a patch bypass, CVE-2025-23359.
