Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1047 results
highperson_alertThreat ActorStorm-3068 Pivots from Identity Compromise to Cloud Infrastructure
Storm-3068 is a threat actor tracked by Microsoft that demonstrated sophisticated understanding of cloud-native attack paths. In this intrusion, the actor leveraged a compromised user identity obtained through self-service password reset to gain pers…
highperson_alertThreat ActorAutomated AI Agent Breaches Dutch Cybersecurity Nonprofit DIVD
The threat actor employed an automated AI agent to conduct what DIVD characterized as the first observed "agentic AI-powered attack" against their organization. The actor's identity, motivation, and origin remain unknown.
highperson_alertThreat ActorStar Blizzard Adopts RedFlick Delivery Technique in 2026 Campaigns
Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor attributed by CISA to the FSB Centre 18.
highperson_alertThreat ActorPhantomSub Campaign Abuses npm Packages to Subscribe Devs to WhatsApp
PhantomSub is a supply chain campaign targeting software developers through malicious npm packages. The campaign abuses the Baileys WhatsApp open source project to add victims to WhatsApp groups and channels without consent.
highbug_reportVulnerabilityDas U-Boot out-of-bounds write allows code execution via fragmented IP
Das U-Boot versions 2009.08 through 2026.07 (pre-fix) when compiled with CONFIG_IP_DEFRAG=y. Das U-Boot is a widely-deployed open-source bootloader used in embedded systems, IoT devices, and network equipment.
highperson_alertThreat ActorDutch Police Arrest 24-Year-Old Linked to ShinyHunters Group
ShinyHunters is a financially-motivated cybercrime group known for large-scale data breaches and extortion operations. The group has historically targeted organizations to steal sensitive data for sale or extortion.
highbug_reportVulnerabilityMCP Python SDK flaw lets malicious servers steal OAuth credentials
Anthropic MCP Python SDK versions 1.9.1–1.29.1 (1.x line) and 2.0.0–2.1.1 (2.x line). Affects MCP clients using HTTP with OAuth providers (OAuthClientProvider, ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider, RFC7523OAuthClientProvider) th…
highperson_alertThreat ActorKeio Corporation ransomware attack disrupts Japanese rail operator
No specific threat actor has been identified or claimed responsibility for this incident as of the reporting date. The attack targeted Keio Corporation, a major Japanese private railway operator with 85 km of track, 69 stations, and a hospitality div…
highpublicGeopoliticalTimes Car breach exposes 6.6M accounts in Japan mobility sector
The breach of Times Car, a subsidiary of the Park24 Group operating Japan's largest car-sharing network with 29,000 stations nationwide, represents a significant compromise of critical transportation infrastructure data.
highperson_alertThreat ActorDutch Police Arrest Amsterdam Man in ShinyHunters Investigation
ShinyHunters is a cybercrime group known for large-scale data breaches and extortion operations. The group has been active since at least 2020, targeting organizations across multiple sectors to steal and leak sensitive data.
highbug_reportVulnerabilityApple patches CoreGraphics out-of-bounds write exploited in targeted attacks
CVE-2026-86950 affects CoreGraphics in iOS versions before 26.7.1, iPadOS before 26.7.1, macOS Tahoe before 26.7.1, and macOS Sequoia before 15.8.1. Impacted devices include iPhone 11 and later, iPad Pro (3rd gen 12.9-inch and 1st gen 11-inch and lat…
highperson_alertThreat ActorRatHat MaaS Operators Deploy AI-Powered Android Banking Trojan
RatHat operators are cybercriminals running a malware-as-a-service (MaaS) platform focused on Android banking fraud. The operators build and distribute the RatHat Android banking trojan, providing customers with web-based consoles to control infected…
highperson_alertThreat ActorShinyHunters escalates attacks after Dutch arrest of suspected member
ShinyHunters is a prolific cybercrime group known for large-scale data theft and extortion operations. The group operates as a collective with multiple members across jurisdictions.
highperson_alertThreat ActorNeedyMantis: Modular Post-Compromise Framework in Targeted Intrusions
NeedyMantis is a modular post-compromise malware framework, not a threat actor. It has been observed in use by at least one operator, Storm-3069 (linked to the DAEMON Tools supply chain compromise).
highbug_reportVulnerabilityZimbra XSS vulnerabilities require immediate patching per CERT.BE
Zimbra Collaboration Suite - specific affected versions not disclosed in available advisory. Multiple Cross-site Scripting (XSS) vulnerabilities identified.
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway flaws under active global exploitation
Citrix NetScaler ADC and Gateway appliances. CVE-2026-88771 (improper input validation allowing unauthenticated remote command execution) and CVE-2026-88772 (remote code execution or denial-of-service).
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway under active attack via two RCE flaws
Citrix NetScaler ADC and Gateway on-premises: versions 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS editions before 14.1-73.37 FIPS and 13.1-37.279. Cloud-managed instances not affected.
highbug_reportVulnerabilityCarbonato botnet exploits exposed Docker daemons to deploy AI agents
Docker daemons exposed without authentication on TCP port 2375. All versions of Docker with unauthenticated remote API access are vulnerable. The malware deploys Hermes AI Agent framework and establishes Telegram-based command and control.
highperson_alertThreat ActorJADEPUFFER (Storm-3168) Deletes Azure Resources via Compromised Principals
JADEPUFFER (tracked by Microsoft as Storm-3168) is a threat actor notable for conducting the first documented ransomware operation orchestrated end-to-end using large language models (LLMs).
highperson_alertThreat ActorFormer U.S. Army Soldier Sentenced for Hacking 10 Tech and Telecom Firms
Cameron John Wagenius (aliases 'kiberphant0m', 'cyb3rph4nt0m'), a 21-year-old former U.S. Army soldier, conducted hacking and extortion operations while on active duty between April 2023 and December 2024.
highbug_reportVulnerabilityCloudflare patches cross-tenant data leak in Containers service
Cloudflare Containers and Sandboxes service, available to Workers Paid plan customers. All customers using Containers on shared physical hosts were potentially affected.
highperson_alertThreat ActorShinyHunters Exploits Oracle PeopleSoft CVE via WAF Bypass
ShinyHunters is a financially motivated extortion gang known for data theft and extortion operations. The group targets organizations with vulnerable internet-facing applications to exfiltrate sensitive data and leverage it for ransom demands.
highperson_alertThreat ActorLunex MaaS Platform Deploys Psychedelic Stealer via BYOVD Technique
Lunex is a malware-as-a-service (MaaS) platform attributed to Russian-speaking developers or development teams. The platform distributes the Psychedelic Stealer (also known as LunexStealer) to multiple criminal groups, enabling credential theft, cryp…
highbug_reportVulnerabilityCompromised GitHub Actions re-enabled with malicious code for 7+ days
Two third-party GitHub Actions previously compromised in Mini Shai-Hulud campaign. Specific action names not disclosed. Affects any workflows consuming these actions during the exposure window (7+ days).
highbug_reportVulnerabilityElementor WordPress plugin CSRF flaw enables admin account takeover via link
Elementor Website Builder WordPress plugin versions 4.3.0 and 4.3.1 only. Affects over 2 million active installations. Fixed in version 4.3.2.
highbug_reportVulnerabilityCISA: SharePoint RCE and MikroTik RouterOS flaws exploited in wild
CVE-2026-65660: Microsoft Office SharePoint Server (unspecified versions). CVE-2026-67279: MikroTik RouterOS 7.x builds. Both vulnerabilities confirmed exploited in active attacks.
highperson_alertThreat ActorKiteworks Issues Precautionary Shutdown After Federal Threat Warning
No specific threat actor has been publicly identified in this incident. Federal intelligence authorities provided credible threat intelligence to Kiteworks indicating that an unspecified threat actor may attempt to target some Kiteworks systems.
highpublicGeopoliticalU.S. Soldier Sentenced for Snowflake Breach Targeting 100M AT&T Records
This incident represents a significant insider threat case involving an active-duty U.S. Army soldier with secret-level security clearance who exploited cloud infrastructure vulnerabilities to conduct financially motivated cybercrime.
highbug_reportVulnerabilityKiteworks urges global server shutdown for zero-day threat mitigation
Kiteworks secure file-sharing platform, all customer deployments worldwide. Specific affected versions not disclosed. Zero-day vulnerability details not yet public.
highperson_alertThreat ActorClop Ransomware Leak Site Compromised via Grav CMS Path Traversal Flaw
This incident involves two distinct threat actors: Clop, a financially motivated ransomware operation known for large-scale data extortion campaigns, and ShinyHunters, a cybercrime actor specializing in data breaches and database theft.