Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 439 results
highperson_alertThreat ActorIranian State-Linked Hackers Deploy CHOSEN BRICK Malware
Iranian state-linked threat actors conducting espionage operations targeting dissidents, activists, and journalists globally. The activity is attributed to Iranian intelligence services and is assessed to support regime repression efforts against per…
highperson_alertThreat ActorNightEagle, Hacking Cat, and Toy Ghouls Target Russian Enterprises
Three distinct threat activity clusters are actively targeting Russian enterprises. NightEagle (APT-Q-95) is a sophisticated threat actor active since at least 2023, employing advanced persistence and lateral movement techniques.
highperson_alertThreat ActorN0va Targets US and EU Orgs with Token-Theft Phishing Campaigns
N0va is a threat actor conducting phishing campaigns targeting organizations across North America and Europe. The actor's motivation appears to be financially driven, with objectives including payment fraud, invoice manipulation, and access to sensit…
highperson_alertThreat ActorREF9334 Deploys KREMLIN Malware Targeting Brazilian Financial Sector
REF9334 is a Brazilian threat actor tracked by Elastic Security Labs, active since at least May 2025. The actor specializes in banking fraud operations targeting Brazilian financial institutions through sophisticated malware delivery campaigns.
highperson_alertThreat ActorIran MOIS Uses Telegram-Controlled Malware to Target Dissidents
Iran's Ministry of Intelligence and Security (MOIS), the country's primary intelligence agency, is attributed by the FBI, UK NCSC, and Netherlands AIVD as the operator behind this espionage campaign.
criticalperson_alertThreat ActorCVE-2026-59310: VMware vCenter RCE exploited by ransomware gangs
No specific threat actor attribution is provided. The campaign involves multiple ransomware gangs actively exploiting CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter.
highperson_alertThreat ActorIranian State Actors Deploy CHOSEN BRICK Against Dissidents Globally
Iranian state cyber actors are attributed by NCSC UK, FBI, and AIVD to deploying CHOSEN BRICK malware against dissidents, activists, and journalists perceived as threats to the Iranian regime.
highperson_alertThreat ActorIranian State Actors Deploy CHOSEN BRICK Spyware Against Dissidents
Iranian state-sponsored cyber actors conducting surveillance operations against individuals perceived as threats to the Iranian regime. The NCSC assesses that Iran almost certainly uses cyber activity to support repression of dissidents, activists, a…
highperson_alertThreat ActorBlack Axe Leaders Extradited to US for Wire Fraud and Money Laundering
Black Axe is a transnational cybercrime syndicate founded in 1977 in Nigeria, now recognized as one of the world's most dangerous and far-reaching criminal organizations.
highperson_alertThreat ActorUTA0560 Exploits Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
UTA0560 is a Chinese-linked threat actor tracked by Volexity that conducts cyber espionage operations targeting non-governmental organizations. The actor demonstrates sophisticated capabilities in exploiting zero-day vulnerabilities and conducting sp…
highperson_alertThreat Actor3BB Broadband Intrusion: MeshCentral Backdoor Used for Root Access
The threat actor behind this intrusion remains unattributed. The operation targeted 3BB, Thailand's largest broadband provider, with the apparent objective of exfiltrating subscriber credential databases.
highperson_alertThreat ActorRed Heron Exploits Gitea RCE to Compromise 13 Organizations
Red Heron is a suspected Chinese threat actor attributed with moderate confidence to operating within a China-linked context. Attribution is based on the use of Simplified Chinese labels for target classification, consistent classification of Taiwan…
highperson_alertThreat ActorHISHIMIRO/jeetbot.cc Leaked OAuth Tokens from 31K Twitch Users
HISHIMIRO/jeetbot.cc is a Russia-based commercial bot service operator linked to the malicious Twitch browser extension "Twitch Enhanced Viewer | JeetBot." The operator, identified as Cyprus-based developer Aleksandr Popov, runs JeetBot as a commerci…
highperson_alertThreat ActorMultiple APT and Cybercrime Groups Abuse Claude AI to Extract Android Secrets
This activity involves multiple distinct threat actor categories operating independently: state-sponsored espionage groups linked to Russia and China, and financially motivated cybercrime actors.
highperson_alertThreat ActorShinyHunters and Helix Linked to Passkey-Themed M365 Phishing Campaign
ShinyHunters and Helix are cybercrime actors linked to data extortion operations. Both groups have established reputations in the underground economy for compromising corporate environments and exfiltrating sensitive data for extortion or sale.
highperson_alertThreat ActorGenerative Threat Groups Weaponize Claude AI for Cyber Operations
Generative Threat Groups (GTGs) is a collective term coined by Anthropic to describe diverse threat actors leveraging Claude AI models for offensive cyber operations between December 2025 and August 2026.
highperson_alertThreat ActorGTG-20006 (Midnight Blizzard) Uses Claude AI for Malware Evasion
GTG-20006 is a Russian state-sponsored cyber espionage group attributed by Anthropic, aligning with Midnight Blizzard (APT29, Cozy Bear). The actor demonstrates advanced operational sophistication by integrating generative AI into their entire attack…
highperson_alertThreat ActorThreat Actors Abuse Claude AI Platform to Distribute ClickFix Malware
Unattributed threat actors conducting opportunistic campaigns that exploit the trust and visibility of AI platforms for malware distribution. Motivation appears to be financially driven, leveraging the growing adoption of AI tools and the inherent tr…
highperson_alertThreat ActorUNC3569 Exploits Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
UNC3569 is a China-linked threat actor attributed by Google Threat Intelligence to the country's hacker-for-hire ecosystem. Active since at least 2021, the group targets government, education, technology, and finance sectors primarily in East and Sou…
highperson_alertThreat ActorUkrainian National Sentenced to Four Years for Conti Ransomware Role
Conti is a prolific ransomware-as-a-service (RaaS) operation that emerged in 2020 and became one of the most active and damaging cybercrime groups globally.
highperson_alertThreat ActorMantax Otax: Android malware blends ransomware and spyware features
Mantax Otax is a newly identified Android malware family that exhibits hybrid functionality, combining ransomware encryption capabilities with spyware data exfiltration and victim harassment features.
highperson_alertThreat ActorRussian-speaking actor uses AI agents to exploit PaperCut flaws
A likely Russian-speaking threat actor leveraged hundreds of AI agents to orchestrate a large-scale exploitation campaign targeting PaperCut NG/MF servers globally.
highperson_alertThreat ActorShinyHunters Breaches AdaptHealth, Exposing 4.1M Patient Records
ShinyHunters is a financially motivated cybercrime group known for large-scale data theft and extortion operations. The group typically targets organizations to steal sensitive data, then demands ransom payments in exchange for not publicly leaking t…
highperson_alertThreat ActorU.S. Disrupts Chinese Organized Crime Scam Marketplace, Freezes $52.8M
Chinese organized crime syndicates operating the Xinbi Guarantee illicit marketplace, a Telegram-based platform facilitating pig butchering romance scams, wire fraud, and money laundering.
highperson_alertThreat ActorChinese AI Firms Conduct Industrial-Scale Distillation on U.S. Models
Six Chinese AI companies—DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI—are attributed by CISA, NSA, and FBI as conducting coordinated, industrial-scale AI model distillation attacks against U.S. frontier AI providers since late 2024.
highperson_alertThreat ActorAPT31 Deploys BlueMoon Exploit Kit Chaining Chrome and Windows Zero-Days
APT31 (also tracked as Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, TA412, Tide Castle, Violet Typhoon, and ZIRCONIUM) is a China-aligned state-sponsored threat actor conducting espionage operations.
highperson_alertThreat ActorGentlemen Ransomware Gang Breaches Veradigm via Third-Party Vendor
The Gentlemen is a double-extortion ransomware gang that emerged around mid-2025. The group operates opportunistically across multiple sectors and geographies, targeting organizations based on access availability rather than strategic selection.
highperson_alertThreat ActorSophos Analyzes Memory-Resident PHP Web Shell in F5 BIG-IP APM
Sophos is a cybersecurity vendor that published technical analysis on September 7, 2026, examining malware targeting F5 BIG-IP Access Policy Manager (APM) appliances. Sophos is the researcher/defender in this context, not the threat actor.
highperson_alertThreat ActorDoppelCart: 119,000+ Fake E-Commerce Domains Used for Card Theft
DoppelCart is a large-scale fraud operation attributed to coordinated threat actors conducting payment card theft through fraudulent e-commerce infrastructure.
highperson_alertThreat ActorShinyHunters Claims Breach of Florida DMV DAVID Database
ShinyHunters is a financially motivated cybercrime extortion gang known for conducting data breaches targeting organizations with large databases of personally identifiable information (PII).