Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 454 results
highperson_alertThreat ActorCSuite Campaign Steals M365 Sessions, Deploys RMM Tools via Phishing
CSuite is a phishing campaign targeting C-suite executives and high-value business users, primarily in the United States. The campaign was analyzed across 351 sandbox submissions, with 51% originating from the US, followed by India (18%), and additio…
highperson_alertThreat ActorFBI warns ShinyHunters members to surrender after Dutch arrest
ShinyHunters is a financially motivated cybercrime group linked to extortion activities targeting organizations in the United States, Netherlands, and globally.
highperson_alertThreat ActorFormer US Air Force Members Sentenced for Multi-Year BEC Fraud
Chijioke Timothy Odimegwu (25) and Harafat Mogaji (26) are former United States Air Force members who conducted business email compromise (BEC) scams and phishing campaigns while stationed at Dover Air Force Base in Delaware.
highperson_alertThreat ActorStar Blizzard Deploys CosmicPulse Backdoor via Fake Event Invitations
Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor attributed by U.S., U.K., Australian, Canadian, and New Zealand security agencies to Center 18 of Russia's Federal Security Service…
highperson_alertThreat ActorStorm-3068 Pivots from Identity Compromise to Cloud Infrastructure
Storm-3068 is a threat actor tracked by Microsoft that demonstrated sophisticated understanding of cloud-native attack paths. In this intrusion, the actor leveraged a compromised user identity obtained through self-service password reset to gain pers…
highperson_alertThreat ActorAutomated AI Agent Breaches Dutch Cybersecurity Nonprofit DIVD
The threat actor employed an automated AI agent to conduct what DIVD characterized as the first observed "agentic AI-powered attack" against their organization. The actor's identity, motivation, and origin remain unknown.
highperson_alertThreat ActorStar Blizzard Adopts RedFlick Delivery Technique in 2026 Campaigns
Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor attributed by CISA to the FSB Centre 18.
highperson_alertThreat ActorPhantomSub Campaign Abuses npm Packages to Subscribe Devs to WhatsApp
PhantomSub is a supply chain campaign targeting software developers through malicious npm packages. The campaign abuses the Baileys WhatsApp open source project to add victims to WhatsApp groups and channels without consent.
highperson_alertThreat ActorDutch Police Arrest 24-Year-Old Linked to ShinyHunters Group
ShinyHunters is a financially-motivated cybercrime group known for large-scale data breaches and extortion operations. The group has historically targeted organizations to steal sensitive data for sale or extortion.
highperson_alertThreat ActorKeio Corporation ransomware attack disrupts Japanese rail operator
No specific threat actor has been identified or claimed responsibility for this incident as of the reporting date. The attack targeted Keio Corporation, a major Japanese private railway operator with 85 km of track, 69 stations, and a hospitality div…
highperson_alertThreat ActorDutch Police Arrest Amsterdam Man in ShinyHunters Investigation
ShinyHunters is a cybercrime group known for large-scale data breaches and extortion operations. The group has been active since at least 2020, targeting organizations across multiple sectors to steal and leak sensitive data.
highperson_alertThreat ActorRatHat MaaS Operators Deploy AI-Powered Android Banking Trojan
RatHat operators are cybercriminals running a malware-as-a-service (MaaS) platform focused on Android banking fraud. The operators build and distribute the RatHat Android banking trojan, providing customers with web-based consoles to control infected…
criticalperson_alertThreat ActorJadePuffer Ransomware Targets Azure Tenants with Agentic AI Attacks
JadePuffer (tracked by Microsoft as Storm-3168) is a ransomware operator that emerged in July 2026, specializing in agent-driven attacks against cloud infrastructure.
highperson_alertThreat ActorShinyHunters escalates attacks after Dutch arrest of suspected member
ShinyHunters is a prolific cybercrime group known for large-scale data theft and extortion operations. The group operates as a collective with multiple members across jurisdictions.
highperson_alertThreat ActorNeedyMantis: Modular Post-Compromise Framework in Targeted Intrusions
NeedyMantis is a modular post-compromise malware framework, not a threat actor. It has been observed in use by at least one operator, Storm-3069 (linked to the DAEMON Tools supply chain compromise).
criticalperson_alertThreat ActorNorth Korean Hackers Steal $387.5M from Bitget Crypto Exchange
North Korean state-sponsored threat actors are attributed to this breach based on on-chain analysis and IP behavior patterns. These groups are financially motivated, conducting large-scale cryptocurrency theft operations to generate revenue for the N…
highperson_alertThreat ActorJADEPUFFER (Storm-3168) Deletes Azure Resources via Compromised Principals
JADEPUFFER (tracked by Microsoft as Storm-3168) is a threat actor notable for conducting the first documented ransomware operation orchestrated end-to-end using large language models (LLMs).
highperson_alertThreat ActorFormer U.S. Army Soldier Sentenced for Hacking 10 Tech and Telecom Firms
Cameron John Wagenius (aliases 'kiberphant0m', 'cyb3rph4nt0m'), a 21-year-old former U.S. Army soldier, conducted hacking and extortion operations while on active duty between April 2023 and December 2024.
highperson_alertThreat ActorShinyHunters Exploits Oracle PeopleSoft CVE via WAF Bypass
ShinyHunters is a financially motivated extortion gang known for data theft and extortion operations. The group targets organizations with vulnerable internet-facing applications to exfiltrate sensitive data and leverage it for ransom demands.
highperson_alertThreat ActorLunex MaaS Platform Deploys Psychedelic Stealer via BYOVD Technique
Lunex is a malware-as-a-service (MaaS) platform attributed to Russian-speaking developers or development teams. The platform distributes the Psychedelic Stealer (also known as LunexStealer) to multiple criminal groups, enabling credential theft, cryp…
criticalperson_alertThreat ActorShinyHunters Exploits Oracle PeopleSoft CVE-2026-35273 via WAF Bypass
ShinyHunters is a financially motivated cybercrime group (tracked by Mandiant as UNC6240) with an established pattern of data theft extortion. The group originated as GnosticPlayers before rebranding to ShinyHunters in 2020.
highperson_alertThreat ActorKiteworks Issues Precautionary Shutdown After Federal Threat Warning
No specific threat actor has been publicly identified in this incident. Federal intelligence authorities provided credible threat intelligence to Kiteworks indicating that an unspecified threat actor may attempt to target some Kiteworks systems.
highperson_alertThreat ActorClop Ransomware Leak Site Compromised via Grav CMS Path Traversal Flaw
This incident involves two distinct threat actors: Clop, a financially motivated ransomware operation known for large-scale data extortion campaigns, and ShinyHunters, a cybercrime actor specializing in data breaches and database theft.
highperson_alertThreat ActorStorm-3168 (JADEPUFFER) conducts agentic Azure cloud attacks
Storm-3168 is Microsoft's tracking designation for JADEPUFFER, a threat actor first documented by Sysdig in July 2026 as the first known agentic ransomware operation.
highperson_alertThreat ActorRydox Marketplace Operator Pleads Guilty to Data Trafficking
Ardit Kutleshi, a 28-year-old Kosovar national, operated Rydox, a large-scale illegal online marketplace facilitating the sale of stolen personal information, login credentials, credit card details, and cybercrime tools.
criticalperson_alertThreat ActorLazarus Group Steals $351.6M from Bitget via Backend Compromise
Lazarus Group (G0032), also tracked as Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, and ZINC, is a North Korean state-sponsored APT group. The actor is financially motivated, conducting large-scale cryptocurrency heists to generate revenue f…
highperson_alertThreat ActorStorm-2570 Ransomware Affiliate Operates Across Multiple RaaS Ecosystems
Storm-2570 is a ransomware affiliate tracked by Microsoft Threat Intelligence since April 2025. Unlike actors that consistently support a single ransomware operation, Storm-2570 operates as a cross-ecosystem threat actor working with multiple ransomw…
criticalperson_alertThreat ActorRansomware gangs exploit critical JetBrains TeamCity flaw vs US govt
No specific threat actor or ransomware gang has been named in this campaign. Multiple ransomware operators are exploiting a critical vulnerability in JetBrains TeamCity software to conduct operations targeting U.S. federal agencies.
highperson_alertThreat ActorUNK_CondorFiltration Targets Chilean Orgs via Default Password Spray
UNK_CondorFiltration is a threat cluster attributed by Proofpoint, conducting password spray campaigns against Microsoft 365 tenants. The actor's motivation appears to be credential harvesting and data exfiltration from cloud environments, with a spe…
criticalperson_alertThreat ActorAI-Powered Payment Skimmer Campaign Steals 600K+ Credit Cards
A financially motivated threat actor, believed to be Chinese-speaking based on operational indicators, is conducting large-scale automated attacks against online retailers using open-source AI agent frameworks.