Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 567 results
highperson_alertThreat ActorSilent Lynx Targets CIS Governments with Multi-Chain Espionage Campaign
Silent Lynx is a Kazakhstan-nexus threat actor active since at least 2020, conducting cyber espionage operations against government organizations across the Commonwealth of Independent States.
highperson_alertThreat ActorHotejka TDS Operates 20,000+ Cloudflare Scam Domains Since 2017
Hotejka is a Russian-language cybercrime affiliate program operating the Help TDS (Traffic Distribution System) since at least 2017. Assessed to be a rebrand of ROI777, a traffic monetization operation exposed in 2018 following a data leak from its s…
highperson_alertThreat ActorFamous Chollima DPRK IT Worker Scheme Disrupted in Texas Raids
Famous Chollima (also tracked as WageMole) is a North Korean state-sponsored threat actor conducting fraudulent IT worker schemes to generate revenue for the DPRK regime.
criticalbug_reportVulnerabilityNextcloud Collabora CODE app RCE exploited in wild since September 10
Collabora Online - Built-in CODE Server (richdocumentscode) versions before 26.4.303, used with Nextcloud. Standalone Collabora Online servers not affected. Nextcloud instances using only richdocuments app (external Collabora server) not affected.
highperson_alertThreat ActorCoGUI, Haozi, and Iron Man System Phishing Kits Disrupted
CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System are three interconnected phishing-as-a-service (PhaaS) kits operated within the Chinese-language cybercriminal ecosystem.
highperson_alertThreat ActorNorth Korea Fraudulent IT Worker Scheme: 14 Charged, 187 Devices Seized
North Korean state-sponsored operation tracked as Famous Chollima, purpledelta, and Wagemole. Active from approximately 2019 to July 2025, this scheme involves DPRK IT workers obtaining remote employment at U.S.
highperson_alertThreat ActorStorm-2990 & Storm-3119: Chinese phishing kit ecosystem disrupted
Storm-2990 and Storm-3119 represent two interconnected Chinese-language cybercriminal entities operating a large-scale phishing ecosystem. Storm-2990 is a cluster of phishing kit developers responsible for three major kits: CoGUI (NX/FA), Haozi (Phoe…
criticalbug_reportVulnerabilityAI-assisted Chrome full-chain exploit built in 6 days, all bugs patched
Google Chrome versions prior to 152.0.7977.82 on Windows. Three vulnerabilities chained: CVE-2026-85045 (V8 JavaScript engine), CVE-2026-78952 (Crashpad crash handler), and one unidentified bug in animated-WebP decoder.
criticalbug_reportVulnerabilityLedger hardware wallets sold via CryptoBilis contain spy chip implants
Ledger Nano X hardware wallets distributed through Southeast Asian reseller CryptoBilis (Malaysia-based, operating across Southeast Asia). Compromised devices also sold via Amazon Japan and Yahoo! Auctions Japan by China-based sellers shipping from M…
highperson_alertThreat ActorCyberXero: AI-Augmented IAB Targets Ukraine with Claude Code
CyberXero is a Russian-speaking, financially motivated initial access broker (IAB) active since at least July 2026. The actor operates a sophisticated dual-pipeline operation: a global automated campaign against WordPress and e-commerce platforms for…
highperson_alertThreat ActorShinyHunters member arrested in FBI crackdown on extortion activity
ShinyHunters is a cybercrime group known for large-scale data breaches and extortion operations. The group has been linked to numerous high-profile data theft incidents targeting organizations globally.
highperson_alertThreat ActorChinese Hacker Targets South Korean Banks with AI-Powered Tools
The threat actor is identified as a Chinese hacker who conducted targeted cyberattacks against South Korean financial institutions. Motivation appears to be focused on the financial services sector, potentially for financial gain, espionage, or disru…
highperson_alertThreat ActorFBI Arrests ShinyHunters-Linked Ransomware Negotiator in Canada
ShinyHunters is a financially motivated cybercrime group specializing in data theft and extortion. The group typically uses phishing and stolen credentials to exfiltrate data from software-as-a-service (SaaS) platforms, then threatens to publish stol…
highperson_alertThreat ActorGhostAction Campaign Injects Credential-Stealing Workflows into 340+ Repos
GhostAction is a large-scale supply chain attack campaign first identified in September 2025, focused on compromising GitHub maintainer accounts to inject malicious GitHub Actions workflows.
highperson_alertThreat ActorFBI Arrests Third ShinyHunters Suspect in Jobs Portal Breach
ShinyHunters is a financially motivated extortion group specializing in large-scale data breaches and extortion operations. According to FBI assessments, the group has breached more than 140 organizations and extracted at least $70 million in extorti…
highperson_alertThreat ActorFBI arrests Canadian suspect tied to ShinyHunters FBI breach
ShinyHunters is an extortion group specializing in data theft from web applications and cloud-based SaaS platforms, demanding ransom payments under threat of public data leaks.
highperson_alertThreat ActorGermany arrests alleged Qilin ransomware core member after extradition
Qilin is a notorious ransomware-as-a-service (RaaS) operation that emerged in August 2022 under the name Agenda. The group operates a double-extortion model, exfiltrating sensitive data before encrypting victim systems.
highperson_alertThreat ActorFlax Typhoon Exploits Five KEV Flaws for Initial Access
Flax Typhoon is a China-linked advanced persistent threat (APT) group attributed to conducting cyber espionage operations. The actor is assessed to be affiliated with the Chinese government and has been observed positioning itself within critical inf…
highbug_reportVulnerabilityGoBalance flaw exposes Tor .onion private keys via public descriptors
GoBalance (Go rewrite of Onionbalance), shipped with EndGame toolkit. Only affects sites using Tor-format master keys (not GoBalance's default safer format). Original Onionbalance and Tor core not affected.
highperson_alertThreat ActorFBI Seizes Flax Typhoon Domains Hosting MicroScan and FishHub Tools
Flax Typhoon is a Chinese state-sponsored threat actor attributed to conducting cyber espionage operations against critical infrastructure and organizations globally.
highperson_alertThreat ActorRansomware campaign disrupts IDCF Cloud, impacts Japanese govt clients
This campaign represents an unattributed ransomware operation targeting IDC Frontier's IDCF Cloud infrastructure-as-a-service platform in Japan. The threat actor demonstrated rapid compromise capabilities, claiming to breach the East Japan Region 1 i…
highperson_alertThreat ActorIntegrity Technology Group: China-linked firm breached global targets
Integrity Technology Group is a China-based for-profit cybersecurity company with documented links to the Chinese government. According to the FBI and six partner agencies, the company's employees develop and acquire cyber tools for use and sale, hos…
highperson_alertThreat ActorFakeGit Campaign Reactivates with 17,610 Malicious GitHub Repositories
FakeGit is a coordinated malware distribution campaign that leverages fake GitHub repositories to deliver multiple malware families. The operation uses a combination of throwaway accounts and approximately 700 compromised legitimate developer account…
highperson_alertThreat ActorUAC-0099 Deploys ASHVEIN RAT Against Ukrainian Government Targets
UAC-0099 is a Russia-aligned threat actor first documented by CERT-UA in June 2023, actively targeting Ukrainian government, defense, border guard, and logistics entities since at least mid-2022 following Russia's full-scale invasion of Ukraine.
highperson_alertThreat ActorChina-Linked Actors Target Global Networks via Integrity Tech
China-linked malicious cyber actors enabled by Integrity Technology Group (Integrity Tech), a China-based company with links to the Chinese Government. The company was sanctioned by the UK government in 2025 for malicious cyber activity against the U…
highperson_alertThreat ActorASOS Data Breach: Social Engineering and Credential Theft Campaign
The threat actor behind this incident identifies themselves as "Xuanye Group." No attribution to known APT groups or established cybercrime syndicates has been made.
highperson_alertThreat ActorU.S. offers $10M reward for HAFNIUM actor Zhang Yu in Exchange attacks
HAFNIUM (also tracked as Silk Typhoon, Operation Exchange Marauder) is a Chinese state-sponsored APT group attributed by Microsoft and the U.S. government to China's Ministry of State Security (MSS).
highperson_alertThreat ActorZohar Pinhasi Charged with $19M Ransomware Victim Fraud Scheme
Zohar Pinhasi (also known as Zack Silver and Zack Green) is a 50-year-old U.S. and Israeli national who owned and operated MonsterCloud, a Florida-based company purporting to offer ransomware recovery services. Pinhasi is charged by the U.S.
criticalbug_reportVulnerabilityTensorlake npm package 0.5.144 compromised with Shai-Hulud worm
npm package "tensorlake" version 0.5.144 (TypeScript SDK for Tensorlake applications). Malicious version no longer available on npm registry. Affects users who installed this specific version, particularly those with access to CI/CD pipelines, cloud…
highperson_alertThreat ActorFortiBleed Campaign Exploits Leaked Credentials to Compromise FortiGate VPNs
FortiBleed refers to a large-scale credential-harvesting and access-brokering campaign discovered in June 2026, when attackers inadvertently exposed a server containing usernames and plaintext passwords for 73,932 Fortinet FortiGate firewall URLs acr…