Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 723 results
highpublicGeopoliticalCEVA Logistics breach exposes European Steam customers' shipping data
This incident exemplifies the systemic risk posed by third-party logistics providers in global supply chains. CEVA Logistics, a subsidiary of CMA CGM Group (the world's third-largest shipping company), operates critical infrastructure spanning 1,000…
highperson_alertThreat ActorHead Mare Exploits TrueConf Flaws to Deploy PhantomCore Backdoor
Head Mare is a threat actor conducting targeted intrusion operations against Russian organizations across critical infrastructure and technology sectors.
highperson_alertThreat ActorDecember 2025 Poland Energy Sector Campaign via Private APN
No specific threat actor has been publicly attributed to this campaign. The December 2025 attacks targeted Poland's energy infrastructure with purely destructive intent, representing a coordinated operation against multiple facilities including wind…
criticalbug_reportVulnerabilityProgress Kemp LoadMaster command injection (CVE-2026-8037) exploited
Progress Kemp LoadMaster appliances. All versions with vulnerable escape_quotes() function. Unauthenticated remote attack vector.
highpublicGeopoliticalLevi Strauss discloses social engineering breach targeting employees
The incident reflects the persistent threat of social engineering attacks against major U.S. corporations, particularly within the retail and apparel sectors.
criticalbug_reportVulnerabilityKVM VM escape vulnerabilities require immediate patching
KVM (Kernel-based Virtual Machine) hypervisor. Specific affected versions not disclosed in advisory. Impacts organizations running KVM-based virtualization infrastructure on Linux hosts.
highpublicGeopoliticalCyberattack disrupts North Carolina port operations, critical infrastructure
The incident at North Carolina Ports Authority facilities represents a significant disruption to U.S. critical maritime infrastructure. Port of Wilmington and Port of Morehead City together constitute key logistics nodes on the U.S.
highpublicGeopoliticalSwiss government SharePoint breach exposes 200 accounts via July flaws
The breach of Switzerland's Federal Office for Information Technology and Telecommunication (BIT) represents a significant compromise of neutral state infrastructure.
criticalperson_alertThreat ActorCanadian Cybercriminal Connor Moucka Pleads Guilty to Snowflake Breach
Connor Riley Moucka (aliases "Judische," "Waifu") is a 26-year-old Canadian software engineer from Kitchener, Ontario, who operated as a cybercriminal since at least 2020.
criticalbug_reportVulnerabilityCritical Cisco Catalyst SD-WAN flaws require immediate patching
Cisco Catalyst SD-WAN Software (specific versions not disclosed in advisory). Scope: SD-WAN infrastructure components used for enterprise WAN connectivity and management.
highbug_reportVulnerabilityCisco IOS/IOS XE vulnerabilities require immediate patching per CERT.BE
Cisco IOS and IOS XE platforms. Specific affected versions not provided in advisory. Multiple vulnerabilities of high severity impact network infrastructure devices including routers and switches running these operating systems.
highbug_reportVulnerability4,407 Rockwell PLCs exposed online; 22 in cities hit by water attacks
Rockwell Automation programmable logic controllers (PLCs) globally: 4,407 exposed devices (2,844 in US). Primary models: MicroLogix 1400 (50%) and MicroLogix 1100 (8%).
highperson_alertThreat ActorCanadian Cybercriminal Pleads Guilty to Snowflake Data Theft Campaign
Connor Riley Moucka (also known as Alexander Moucka and "Waifu"), a 26-year-old Canadian national, operated as a cybercriminal targeting cloud storage environments for financial gain.
highperson_alertThreat ActorPoipet Scam Network Leveraged ChatGPT for Multi-Scheme Fraud Operations
The Poipet scam network is a Cambodia-based organized criminal operation originating from Poipet, a city with extensive ties to scam compounds and human trafficking.
highbug_reportVulnerabilityCISA orders 3-day patch for exploited IBM Langflow, N-central, Tomcat flaws
IBM Langflow (CVE-2026-9198, CVSS 9.8) - default deployments vulnerable to unauthenticated RCE via API endpoint chaining. N-able N-central (CVE-2026-18576) - all versions before 2026.3 allow unauthenticated admin account hijacking; incomplete patch b…
criticalbug_reportVulnerabilityCritical Veeam Service Provider Console flaws require immediate patching
Veeam Service Provider Console - specific affected versions not disclosed in available information. All users running VSPC should assume exposure until vendor guidance is reviewed.
highperson_alertThreat ActorKali365 Campaign Weaponizes Microsoft Device Code Flow Against US Firms
Kali365 is a device code phishing campaign targeting US organizations through abuse of legitimate Microsoft authentication mechanisms. The campaign leverages a phishing kit designed to trick victims into approving attacker-controlled device codes on…
highperson_alertThreat ActorDOUBLECUP LaaS Uses ClickFix and Steganography to Deploy CountLoader
DOUBLECUP is a Russian loader-as-a-service (LaaS) operation active since early June 2026. The service provides operators with licenses and a Go-based Windows GUI client to orchestrate campaigns that deliver malware via ClickFix social engineering lur…
highbug_reportVulnerabilityN-able N-central auth bypass exploited; CISA orders patch by Aug 6
N-able N-central versions prior to 2026.3 HF1. CVE-2026-18577 (CVSS 8.2) is an incomplete patch for CVE-2026-18556. Affects on-premises N-central servers with remote management capabilities.
highperson_alertThreat ActorMidnight Blizzard targets hospitality Wi-Fi in CaptiveCrunch campaign
Midnight Blizzard (APT29, also tracked as Storm-2945, IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo) is a Russian-attributed advanced persistent threat group linked to intelligence collection operations.
highperson_alertThreat ActorDOUBLECUP loader-as-a-service delivers malware via ClickFix attacks
DOUBLECUP is a Russian loader-as-a-service platform that has operated since early June 2026. The service provides customers with licenses and a Go-based Windows tool for creating malicious ClickFix campaigns.
highbug_reportVulnerability18 malicious npm packages deliver cross-platform RAT to Alibaba developers
18 npm packages targeting Alibaba developer tool users, primarily Chinese-speaking environments. Key packages: lib-mtop (v1.0.1-1.0.3), aone-kit, aone-kit-cli, aone-sandbox, local-config-parser, smart-config-manager, and 12 others.
highperson_alertThreat ActorExfilSquad Breaches UK Police Database, Leaks 100K+ Records
ExfilSquad is a data extortion group that conducts targeted intrusions to steal sensitive information and leverage it for ransom demands. The group operates by exfiltrating data from compromised organizations, publishing proof samples, and threatenin…
criticalbug_reportVulnerabilityN-Central actively exploited vulnerability requires immediate patching
N-Central remote monitoring and management (RMM) platform. Specific affected versions not disclosed in available advisory. CVE identifier not yet assigned or published.
highperson_alertThreat ActorChinese-Speaking Actor Deploys GHOSTBLADE via Leaked DarkSword iOS Kit
An unidentified Chinese-speaking threat actor conducting mobile exploitation campaigns against iOS devices. The actor operates extensive infrastructure spanning over 100 web properties concentrated in Hong Kong with reach into Japan, the United State…
highpublicGeopoliticalU.K. Police Legal Database Breach Exposes Officer Contact Data on Dark Web
The breach of the Police National Legal Database represents a targeted exposure of U.K. law enforcement and criminal justice infrastructure, albeit limited to contact metadata rather than operational intelligence.
criticalbug_reportVulnerabilityColdcard wallet PRNG flaw enabled $70M Bitcoin theft in 41 minutes
Coldcard hardware wallets (Coinkite): Mk2 and Mk3 firmware 4.0.0–4.1.9 (fixed in 4.2.0); Mk4 and Mk5 before 5.6.0; Q model before 1.5.0Q; Edge builds before 6.6.0X (Mk4/Mk5) and 6.6.0QX (Q).
highperson_alertThreat ActorStorm-2945 Exploits Captive Portals in CaptiveCrunch Espionage Campaign
Storm-2945 is an operational sub-cluster of Midnight Blizzard (APT29), a Russia-based threat actor attributed by US and UK governments to the Foreign Intelligence Service of the Russian Federation (SVR).
highperson_alertThreat ActorChinese-Speaking Actor Deploys OctLurk & SilkLurk in Central Asia
A Chinese-speaking threat actor, not yet attributed to any known APT group, has been conducting targeted cyber espionage operations against government and strategic organizations in Central Asia and Syria since January 2025.
highbug_reportVulnerabilityCISA warns of rising attacks on internet-exposed PLCs in water systems
Internet-exposed programmable logic controllers (PLCs) in U.S. water and wastewater systems. Specific vendors and models not disclosed in available information.