Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 454 results
highperson_alertThreat ActorIntegrity Technology Group: China-linked firm breached global targets
Integrity Technology Group is a China-based for-profit cybersecurity company with documented links to the Chinese government. According to the FBI and six partner agencies, the company's employees develop and acquire cyber tools for use and sale, hos…
highperson_alertThreat ActorFakeGit Campaign Reactivates with 17,610 Malicious GitHub Repositories
FakeGit is a coordinated malware distribution campaign that leverages fake GitHub repositories to deliver multiple malware families. The operation uses a combination of throwaway accounts and approximately 700 compromised legitimate developer account…
highperson_alertThreat ActorUAC-0099 Deploys ASHVEIN RAT Against Ukrainian Government Targets
UAC-0099 is a Russia-aligned threat actor first documented by CERT-UA in June 2023, actively targeting Ukrainian government, defense, border guard, and logistics entities since at least mid-2022 following Russia's full-scale invasion of Ukraine.
highperson_alertThreat ActorChina-Linked Actors Target Global Networks via Integrity Tech
China-linked malicious cyber actors enabled by Integrity Technology Group (Integrity Tech), a China-based company with links to the Chinese Government. The company was sanctioned by the UK government in 2025 for malicious cyber activity against the U…
highperson_alertThreat ActorASOS Data Breach: Social Engineering and Credential Theft Campaign
The threat actor behind this incident identifies themselves as "Xuanye Group." No attribution to known APT groups or established cybercrime syndicates has been made.
highperson_alertThreat ActorU.S. offers $10M reward for HAFNIUM actor Zhang Yu in Exchange attacks
HAFNIUM (also tracked as Silk Typhoon, Operation Exchange Marauder) is a Chinese state-sponsored APT group attributed by Microsoft and the U.S. government to China's Ministry of State Security (MSS).
highperson_alertThreat ActorZohar Pinhasi Charged with $19M Ransomware Victim Fraud Scheme
Zohar Pinhasi (also known as Zack Silver and Zack Green) is a 50-year-old U.S. and Israeli national who owned and operated MonsterCloud, a Florida-based company purporting to offer ransomware recovery services. Pinhasi is charged by the U.S.
highperson_alertThreat ActorFortiBleed Campaign Exploits Leaked Credentials to Compromise FortiGate VPNs
FortiBleed refers to a large-scale credential-harvesting and access-brokering campaign discovered in June 2026, when attackers inadvertently exposed a server containing usernames and plaintext passwords for 73,932 Fortinet FortiGate firewall URLs acr…
highperson_alertThreat ActorCanto Incognito Targets AI/LLM Infrastructure for Crypto Mining Botnet
Canto Incognito is a financially motivated threat actor attributed with moderate confidence to an Italian-speaking operator based on Italian-language artifacts and netflow indicators.
highperson_alertThreat ActorRansomware Groups Target Backup Infrastructure to Eliminate Recovery
This analysis covers a tactical shift across multiple ransomware groups rather than a single named threat actor. Groups including ALPHV/BlackCat, BlackMatter, and Gunra have adopted backup destruction as a standard component of their operations.
highperson_alertThreat ActorShinyHunters Leader Detained in Jordan, Cooperating with FBI
ShinyHunters is a prolific data theft and extortion group attributed to multiple high-profile breaches. The suspected leader, a teenager from Amman, Jordan operating under the handle "Rey" (identified as Saif Al-din Khader), was detained by Jordanian…
highperson_alertThreat ActorAdvantest Corporation Ransomware Attack Exposes PII Data
No specific threat actor or ransomware group has been publicly attributed to this incident. The attack occurred on February 15, 2026, when an unauthorized third party breached Advantest Corporation's network, deployed ransomware, and exfiltrated data…
highperson_alertThreat ActorHuman-Operated Phishing Platform Targets AI Chatbot Ad Portals
The operators behind this campaign run a human-operated phishing platform that impersonates advertising products for major AI chatbots including ChatGPT, Gemini, Claude, Perplexity, Meta Muse, and Manus.
highperson_alertThreat ActorIran-Nexus Actor Targets Iraqi Infrastructure via Blinder Tunnel
CL-STA-1178 is an Iranian state-aligned threat actor tracked by Unit 42, previously associated with campaigns identified by Elastic Security Labs as "The Shelby Strategy." The actor demonstrates sophisticated operational capabilities, frequently empl…
highperson_alertThreat ActorInsider Sentenced for Ransomware-Style Extortion Against NJ Employer
Daniel Rhyne, a 57-year-old former core infrastructure engineer from Kansas City, Missouri, executed an insider threat attack against his New Jersey-based industrial employer in November-December 2023.
highperson_alertThreat ActorShinyHunters Breaches FBI via Oracle PeopleSoft Patch Failure
ShinyHunters is a cybercrime group known for data theft and breach operations. In this incident, the group exploited a vulnerability in Oracle PeopleSoft to compromise the FBI's job portal, stealing personal details of thousands of bureau employees.
highperson_alertThreat ActorShinyHunters Member "Rey" Detained in Jordan, Cooperating with FBI
ShinyHunters is a prolific cybercriminal group specializing in data theft, extortion, and breach operations. Originating around April-May 2020, the group evolved from earlier extortion-focused collectives TheDarkOverlord and GnosticPlayers.
highperson_alertThreat ActorTA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
TA419 is a China-aligned, espionage-motivated threat actor attributed by Proofpoint. Active since at least April 2025, the group conducts credential phishing campaigns targeting individuals at U.S.
highperson_alertThreat ActorShinyHunters Member "Rey" Detained in Jordan, Cooperating with FBI
ShinyHunters is a cybercrime group specializing in data theft and extortion operations. The group has gained notoriety for breaching organizations, exfiltrating sensitive data, and either selling stolen databases on underground forums or leveraging t…
highperson_alertThreat ActorChina MSS Funded 100+ U.K. Academics via CGTRI Front Company
China's Ministry of State Security (MSS) is the principal civilian intelligence agency of the People's Republic of China, responsible for counterintelligence, foreign intelligence, and political security.
criticalperson_alertThreat ActorWarlock exploits SharePoint flaws to deploy ransomware in Iberia
Warlock (also tracked as Gold Salem, Longlegs, Storm-2603) is a suspected China-linked threat actor that gained prominence in mid-2025 through zero-day exploitation of Microsoft SharePoint vulnerabilities dubbed "ToolShell." The group is attributed b…
highperson_alertThreat ActorWarlock: China-Linked Ransomware Group Targets Critical Infrastructure
Warlock is a China-linked ransomware group that has demonstrated a focus on critical infrastructure and public sector targets. The actor's motivation appears to align with both financial gain through ransomware operations and potential strategic inte…
highperson_alertThreat ActorChina-Nexus Actor UAT-11587 Deploys Antino Backdoor Across Asia
UAT-11587 is a China-nexus threat actor tracked by Cisco Talos, first detected in September 2025 targeting Taiwan's academic, think tank, and civil society policy community.
highperson_alertThreat ActorTren de Aragua sanctioned for $40M ATM jackpotting campaign
Tren de Aragua (TdA) is a Venezuelan transnational criminal organization designated by the U.S. Treasury as a Transnational Criminal Organization in July 2024 and by the State Department as a Foreign Terrorist Organization in February 2025.
highperson_alertThreat ActorMicrosoft X Account Hijacked in Cryptocurrency Pump-and-Dump Scheme
The threat actors behind this incident remain unidentified. Their motivation appears to be financial gain through a cryptocurrency pump-and-dump scheme, leveraging the compromise of Microsoft's official X (formerly Twitter) account with over 13 milli…
highperson_alertThreat ActorSpanish Police Arrest 16-Year-Old Administrator of KillSec Ransomware Group
KillSec is a ransomware-as-a-service (RaaS) operation attributed to a Spain-based 16-year-old suspected administrator and a distributed network of operators across Europe.
highperson_alertThreat ActorKillSec Ransomware Gang Dismantled in Operation KillSwitch
KillSec is a ransomware and data extortion gang active since approximately 2024. The group is allegedly led by a 16-year-old administrator, with other key members including an 18-year-old developer (who was a minor during some alleged crimes), a nego…
highperson_alertThreat ActorOpenAI disrupts distillation campaign tied to Moonshot AI associates
Individuals associated with Moonshot AI, a Chinese AI company based in Beijing, are attributed to this coordinated adversarial distillation campaign. The operators sought to illicitly extract protected reasoning from OpenAI's AI models through system…
highperson_alertThreat ActorStar Blizzard deploys CosmicPulse backdoor via new RedFlick technique
Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor active since 2017. The group is attributed to Russian intelligence services and is motivated by espionage objectives aligned with R…
highperson_alertThreat ActorUnidentified Actors Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
The threat actors behind this campaign remain unidentified. Their motivation appears to be financially driven, leveraging trusted AI platforms (ChatGPT Custom GPTs) to conduct social engineering attacks that deliver remote access trojans.