Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1076 results
highperson_alertThreat ActorRussian National Indicted for TVRAT/DarkVNC Phishing Campaign
Searzhudin Tamirlanovich Aktulaev, a 40-year-old Russian national, orchestrated a large-scale phishing campaign between June 2016 and November 2017. Motivated by financial fraud and credential theft, Aktulaev targeted freelancers on an unnamed freela…
highbug_reportVulnerabilitySality P2P botnet dismantled after 20+ years of operation
Sality botnet infrastructure (active since 2003), affecting 15,000+ infected devices globally. Primary payload in recent years: EggJagger clipjacking malware targeting cryptocurrency wallets.
highbug_reportVulnerabilityActive malware campaign uses fake vendor sites to deliver Silver Fox malware
Organizations with China-based operations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors.
highperson_alertThreat ActorPhishing Actors Abuse Faronics Deploy for ScreenConnect Installation
The actors are unattributed phishing operators conducting opportunistic attacks against organizations using social engineering lures. Between July 21 and August 20, 2026, they targeted over 457 endpoints with phishing emails disguised as invoices, ta…
highperson_alertThreat ActorBreeze Comet Targets Brazilian Financial Sector for Payment Fraud
Breeze Comet (formerly UNC5669, overlaps with Plump Spider and SHADOW-AETHER-064) is a financially motivated threat actor operating out of Brazil since September 2023.
highpublicGeopoliticalNovocure breach exposes 1,400+ U.S. cancer patient records
The Novocure incident reflects the sustained targeting of healthcare infrastructure, particularly oncology and patient data repositories, which has intensified across North American providers since late 2025.
highbug_reportVulnerability13 malicious Packagist packages target iOS devices to steal crypto wallets
Packagist/Composer ecosystem: 13 malicious theme packages across 5 vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms). Targets Vietnamese streaming sites using OphimCMS/KKPhim.
highperson_alertThreat ActorNimbus Manticore Deploys Cross-Platform RATs via Fake Job Coding Tests
Nimbus Manticore is an Iranian threat actor also tracked as Iranian Dream Job, known for using recruitment-themed social engineering lures to compromise targets.
highbug_reportVulnerability22K Exchange servers unpatched for CVE-2026-62911 auth bypass flaw
Microsoft Exchange Server 2016, 2019, and Subscription Edition (SE). Approximately 21,899 internet-exposed servers remain unpatched globally, with highest concentrations in the United States (6,200) and Germany (5,100).
highperson_alertThreat ActorClickFix Operators Dominate Initial Access via Social Engineering
ClickFix operators are threat actors leveraging a social engineering technique that manipulates users into executing malicious commands through clipboard manipulation.
highpublicGeopoliticalLatvia's cyber threat level remains high amid Russia-linked activity
Latvia's elevated cybersecurity posture reflects its position as a NATO frontline state and vocal supporter of Ukraine. CERT.LV's Q2 2026 report indicates that while incident volumes have moderated from peak levels, they remain substantially above hi…
highperson_alertThreat ActorVenezuelan ATM Jackpotting Group Targets U.S. Financial Infrastructure
This threat actor is a coordinated group of Venezuelan nationals conducting ATM jackpotting operations targeting financial institutions in the United States.
highperson_alertThreat ActorUAC-0099 Deploys GuardBreaker to Sabotage AI-Assisted Malware Analysis
UAC-0099 is a Russia-aligned threat actor with a history of targeting Ukraine's transportation and energy sectors. The group demonstrates tactical innovation by adapting emerging anti-AI analysis techniques to evade detection.
highbug_reportVulnerabilityPaperCut NG/MF zero-days exploited for data theft via auth bypass and RCE
PaperCut NG and MF print management software, all versions prior to Emergency Patch Release 3 (issued September 2026). Affects internet-facing Application Servers.
highbug_reportVulnerabilityTerminalFix campaign uses fake CAPTCHAs to deploy reverse tunnels
Windows systems with PowerShell and Windows Terminal enabled. Targets organizations with Active Directory environments. Attack vector: compromised websites displaying fake Cloudflare CAPTCHA prompts.
highperson_alertThreat ActorNorth Korean IT Worker Scheme Expands Into Healthcare and Sales Roles
North Korean state-sponsored threat actors, tracked as Famous Chollima, Jasper Sleet, Nickel Tapestry, PurpleDelta (formerly TAG-121), UNC5267, and Wagemole, operate a sophisticated job fraud scheme to generate revenue for the DPRK's nuclear weapons…
highperson_alertThreat ActorFire Ant compromises Cisco routers for network surveillance
Fire Ant is a Chinese espionage-focused threat actor attributed by Sygnia, with operational overlap to UNC3886 (previously documented by Google). The group targets critical infrastructure and high-value networks through a "target behind the target" s…
highperson_alertThreat ActorRhysida ransomware gang breaches Berlin city administration
Rhysida is a ransomware-as-a-service (RaaS) operation active since mid-2023, conducting double-extortion attacks against high-value targets. The group exfiltrates sensitive data before deploying ransomware, then threatens public disclosure to pressur…
highperson_alertThreat ActorSilver Fox Distributes ValleyRAT via Signed Chinese Adware
Silver Fox is a threat actor attributed by Kaspersky to campaigns distributing the ValleyRAT backdoor (also tracked as Winos 4.0). The group has demonstrated consistent use of DLL sideloading techniques leveraging legitimate, signed software to evade…
highperson_alertThreat ActorAurora Ransomware Operators Leverage Cursor AI for Network Intrusion
Aurora (aka Aur0ra) ransomware operators are a Russian-speaking cybercrime group operating a ransomware-as-a-service (RaaS) model with affiliates. The group has been active since at least April 2026, targeting organizations across nine countries with…
highperson_alertThreat ActorSpring Ring Campaign Weaponizes Microsoft Teams for Vishing Attacks
Spring Ring is a coordinated social engineering campaign identified between January and April 2026 that leverages external Microsoft Teams accounts to impersonate IT help desk personnel.
highperson_alertThreat ActorNigerian Sextortion Operators Extradited to US for Crimes Resulting in Deaths
Two Nigerian nationals, 26-year-old Adebola Festus Adekunle and 24-year-old Mudasiru Afeez Olawale, are cybercriminals involved in sextortion schemes targeting minors.
highperson_alertThreat ActorFire Ant Expands Espionage to Cisco Routers and TACACS Servers
Fire Ant is a China-linked cyber espionage actor that has conducted long-running campaigns targeting network infrastructure and virtualization platforms.
highperson_alertThreat ActorChinese QTFY Group Targeted U.S. Federal Agencies via IoT Botnet
QTFY (also known as QT AND QTCYBER) is a Chinese state-sponsored threat actor active since 2018, operating on behalf of Nanjing Xinjiuwei Network Technology Co.
highperson_alertThreat ActorFulcrumSec claims 86 GB data theft from Manchester Airports Group
FulcrumSec is a financially motivated data-extortion group active since 2025. The group specializes in stealing sensitive corporate data and threatening to publish it, operating without deploying ransomware or encrypting victim systems.
highbug_reportVulnerability19 malicious Chrome/Edge extensions steal crypto and credentials
Google Chrome and Microsoft Edge users who installed any of 19 malicious extensions, including "Enable Right Click & Copy" (70,000+ Chrome users, 10,000+ Edge users). Campaign active since early 2024.
highbug_reportVulnerabilityTerminalFix campaign uses fake CAPTCHAs to deploy reverse-tunnel backdoor
Organizations across multiple sectors using Windows environments with PowerShell and Windows Terminal. Attack leverages compromised websites serving fake Cloudflare CAPTCHA pages to social engineer users into executing malicious PowerShell commands.
highperson_alertThreat ActorTerminalFix Campaign Deploys Multi-Stage Attacks via Fake CAPTCHAs
TerminalFix is a coordinated campaign activity (variant of ClickFix social engineering technique) disclosed by Microsoft Threat Intelligence. The campaign targets organizations across multiple industries using compromised websites to deliver sophisti…
highpublicGeopoliticalBerlin refuses ransom demand after Rhysida-linked breach of state network
The August 2026 compromise of Berlin's state administrative network represents a significant escalation in ransomware targeting of European critical infrastructure and government services.
highbug_reportVulnerability19 malicious Chrome/Edge extensions drain crypto wallets via auto-updates
19 browser extensions (18 Chrome, 1 Edge) published since February 2024, with "Enable Right Click & Copy — Smart Unlock + OCR" having 80,000 installs. Extensions either created by threat actor or purchased from legitimate owners.