Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
satellite_altDaily BriefCyber Threat Daily Brief — October 28, 2026
Today's briefing: 9 critical and 29 high-severity threats. A total of 45 detailed analyses covering vulnerabilities, threat actors, and geopolitical context.
Latest Reports
28 / 1786 results
highperson_alertThreat ActorDevMan RaaS Centralizes Affiliate Operations via Dedicated Portal
DevMan (tracked as Funky Mantis by PRODAFT) is a ransomware-as-a-service operation that emerged in April 2025, initially as an affiliate for Qilin, DragonForce, Apos, and RansomHub before transitioning to independent RaaS operations.
highpublicGeopoliticalAI Agent Used in Alleged Breach of Thai Finance Ministry
The alleged intrusion into Thailand's Ministry of Finance represents a significant evolution in cyber threat tradecraft, demonstrating the operational use of autonomous AI agents to automate post-exploitation activities.
highbug_reportVulnerabilityDNS hijacking on hotel Wi-Fi redirects users to fake Microsoft 365 logins
Wi-Fi gateways at hotels and conference centers in multiple U.S. cities, India, and Saudi Arabia. Targets traveling employees from financial services, professional services, legal, healthcare, energy, and retail sectors accessing Microsoft 365.
highperson_alertThreat ActorBlueNoroff Phishing Kit Profiles Crypto Wallets Before Malware Delivery
BlueNoroff (also tracked as APT38, NICKEL GLADSTONE, BeagleBoyz, Stardust Chollima) is a North Korean state-sponsored threat actor attributed to financially motivated operations targeting the cryptocurrency and technology sectors.
highbug_reportVulnerabilityCertighost exploit public for AD CS flaw allowing DC impersonation
Microsoft Active Directory Certificate Services (AD CS) on Windows Server 2012 through 2025 (including Server Core) and Windows 10 versions 1607 and 1809. Environments with Enterprise CA and default Machine certificate template are vulnerable.
criticalbug_reportVulnerabilityChatGPT Workspace Agents CSRF flaw enabled rogue AI agent deployment
OpenAI ChatGPT Workspace Agents (Agent Builder tool) used by organizations with authorized connectors (Outlook, Gmail, Google Drive, Slack, Teams, etc.). Patched as of June 8, 2026. Product being deprecated November 30, 2026.
criticalbug_reportVulnerabilityBing Images SVG flaw allowed unauthenticated RCE as SYSTEM on servers
Microsoft Bing Images service (CVE-2026-32194, CVE-2026-32191). Both Windows Server 2022 and Linux image-processing workers. Vulnerability exploitable via public "Search by Image" upload and URL-based image crawler.
highpublicGeopoliticalIllinois man sentenced for social engineering attack on 750+ Snapchat users
This case represents a domestic criminal prosecution within the United States for cybercrime targeting individual consumers. The incident reflects the persistent challenge of social engineering attacks against commercial platform users and the exploi…
highperson_alertThreat ActorHermes AI Agent Used for Post-Exploitation at Thai Finance Ministry
The threat actor behind this intrusion remains unattributed. Hunt.io assesses with low-to-medium confidence that the operator is Chinese-speaking or fluent in Chinese, based on linguistic artifacts (password containing "Leishen," meaning thunder god)…
highperson_alertThreat ActorGolden Chickens MaaS Resurfaces With Four New Malware Families
Golden Chickens (also known as Venom Spider, tracked by Recorded Future as TAG-195) is a financially motivated malware-as-a-service (MaaS) developer that provides tooling to multiple cybercrime groups.
highbug_reportVulnerabilityNodeBB forum software patches 8 high-severity flaws with public exploits
NodeBB forum software, all versions before 4.14.0. Fixes available in version 4.14.2 and later. Five of eight flaws affect only forums with ActivityPub federation enabled (default in v4 fresh installs, disabled in v3 upgrades).
highperson_alertThreat ActorClop Ransomware Gang Exploits PTC Windchill and FlexPLM Vulnerabilities
Clop (also tracked as Cl0p) is a financially motivated ransomware and data extortion gang with a well-established pattern of targeting enterprise software platforms to steal sensitive data and extort victims.
criticalbug_reportVulnerabilityRedis patches authenticated RCE flaws in versions 6.2–8.8
Redis versions 6.2.22, 7.2.14, 7.4.9, 8.2.7, 8.4.4, 8.6.4, and 8.8.0. Exploitation requires authenticated access and RESTORE command privileges. Streams-based chain also requires EVAL and XGROUP commands; RedisBloom chain (8.8.0) requires EVAL and bu…
highperson_alertThreat ActorUAC-0099 Deploys MATCHBOIL.V2 via Fake Notepad++ Plugin
UAC-0099 is a Russia-aligned threat group active since at least mid-2022. The actor conducts cyber espionage operations primarily targeting Ukrainian entities.
highbug_reportVulnerabilityDolphin X RAT uses AI profiling to prioritize high-value victims
Organizations and individuals infected with Dolphin X remote access trojan. No specific vendor products or CVEs associated; threat affects Windows endpoints where the malware is deployed via social engineering or other distribution methods.
highpublicGeopoliticalOrigin Energy breach exposes 2M Australian customer records
The breach of Origin Energy, Australia's largest energy retailer with $8.5 billion in annual revenue and cross-border holdings in UK renewable energy, underscores the persistent targeting of critical infrastructure providers in the Indo-Pacific regio…
highbug_reportVulnerabilityBing malvertising pushes fake Claude installer delivering SectopRAT
Microsoft Bing search users seeking Claude AI desktop app. Malicious Claude Artifact hosted on legitimate claude.ai domain (removed by Anthropic). At least 29 organizations compromised July 21-22, 2026.
criticalperson_alertThreat ActorRussian Espionage Group Exploited Zimbra Zero-Day for Email Theft
A Russian state-sponsored espionage group conducted a sustained campaign exploiting a zero-day vulnerability in Zimbra's webmail client. The actor, tracked as TA488 by Proofpoint and CL-STA-1114 by Unit 42, operated undetected for at least five month…
highperson_alertThreat ActorLaundry Bear exploits Zimbra XSS zero-day for email theft
Laundry Bear (also tracked as Void Blizzard by Microsoft) is a Russian state-sponsored APT group first publicly attributed by Dutch intelligence agencies in May 2025 following their 2024 compromise of the Dutch National Police.
highbug_reportVulnerabilityUAC-0099 abuses Notepad++ plugin loading to deploy LunchPoke malware
Organizations in Ukraine using Notepad++ 8.8.3. The attack does not exploit a vulnerability in Notepad++; it abuses legitimate plugin-loading functionality to deploy LunchPoke, BurnyBear, and MatchBoil V2 malware loaders via social engineering (malic…
criticalbug_reportVulnerabilityProgress Telerik UI for AJAX RCE vulnerability requires immediate patching
Progress Telerik UI for AJAX - specific affected versions not disclosed in available information. Vulnerability enables remote code execution.
highpublicGeopoliticalMicrosoft 365 outage disrupts cloud services across North America
The incident represents a technical service disruption affecting critical cloud infrastructure rather than a geopolitical cyber event. Microsoft 365's position as backbone infrastructure for government, defense, and commercial operations in North Ame…
criticalbug_reportVulnerabilityCheck Point privilege escalation flaws under active exploitation
Check Point products (specific versions not disclosed in available data). Three privilege escalation vulnerabilities identified, including one actively exploited flaw enabling full admin authentication bypass.
highperson_alertThreat ActorRussian cyberespionage campaign targets Zimbra via JavaScript injection
This campaign is attributed by Unit 42 to Russian cyberespionage interests. The actor's motivation centers on intelligence gathering through compromise of email infrastructure.
highbug_reportVulnerabilityClaude Cowork sandbox escape lets AI agent access macOS host files
Anthropic Claude Cowork macOS desktop app running local sessions. Approximately 500,000 macOS users affected prior to mitigation. Users who continue to run local execution (not cloud) remain vulnerable.
highperson_alertThreat ActorChaos Ransomware Group Deploys msaRAT Rust Implant via Headless Browsers
Chaos is a ransomware group that operates through spam floods, vishing campaigns, Quick Assist abuse, and RMM tools for initial access and persistence. The group deploys custom tooling including the msaRAT Rust-based implant as a pre-ransomware stage…
highperson_alertThreat ActorJadeProx Deploys TriBack Loader Against Asian, Latin American Targets
JadeProx is a China-nexus threat actor tracked by Group-IB, discovered through an exposed Alibaba Cloud server in Singapore in mid-April 2026. The actor targets government, healthcare, and education organizations across Asia and Latin America.
highperson_alertThreat ActorLaundry Bear: Russian APT deploys zero-click phishing via Zimbra exploit
Laundry Bear is an advanced persistent threat (APT) group attributed to Russian state support, specializing in covert email data acquisition. The group conducts espionage operations targeting Western organizations and NATO members.