Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 445 results
highperson_alertThreat ActorLazarus Deploys Crypto-Stealing Malware via macOS Malvertising Campaign
Lazarus is a North Korea-linked APT group with a sustained focus on financial gain, particularly targeting cryptocurrency assets. Operating under DPRK state sponsorship, the group has evolved its tactics to include sophisticated social engineering ca…
highperson_alertThreat ActorShinyHunters Breaches Brinks Home via Microsoft Entra Vishing Attack
ShinyHunters is a financially motivated cybercrime extortion gang known for large-scale data theft and public leak operations. The group specializes in breaching organizations to exfiltrate sensitive customer and employee data, which they leverage fo…
highperson_alertThreat ActorChaos Ransomware Deployed via Microsoft Teams Vishing in North America
Chaos is a ransomware-as-a-service (RaaS) operation active since at least February 2025, believed to be linked to former members of the BlackSuit and Royal ransomware gangs—both spinoffs from the notorious Conti cybercrime syndicate.
highperson_alertThreat ActorState-Sponsored Campaign Exploits AnySign4PC to Deploy SIGNBT & COPPERHEDGE
South Korean authorities (KISA, National Intelligence Service, National Police Agency, Financial Security Institute) disclosed a state-sponsored campaign targeting South Korean entities.
highperson_alertThreat ActorSilver Fox Deploys 3-Driver BYOVD Chain to Deliver ValleyRAT
Silver Fox is a Chinese cybercrime group known for sophisticated intrusion campaigns targeting organizations in Asia. The group demonstrates advanced operational capabilities through multi-layered attack chains combining BYOVD techniques, DLL side-lo…
highperson_alertThreat ActorChinese-Speaking Actor Uses AI for Autonomous Vulnerability Exploitation
A Chinese-speaking threat actor operating under the aliases knaithe and KnYuan has demonstrated an end-to-end autonomous offensive capability by leveraging AI models for vulnerability scanning and exploitation.
criticalperson_alertThreat ActorLaundry Bear exploits Exchange OWA zero-day to deploy OWAReaper backdoor
Laundry Bear (also tracked as Void Blizzard, TA488 by Proofpoint) is a Russian state-sponsored threat actor focused on long-term email intelligence collection.
highperson_alertThreat ActorShinyHunters escalates vishing-driven data theft against healthcare sector
ShinyHunters is a financially motivated extortion gang specializing in data theft attacks against cloud SaaS and storage platforms. The group has gained notoriety over the past two years for conducting supply chain attacks on third-party integration…
highperson_alertThreat ActorNimbus Manticore Deploys NightLedger Backdoor in Middle East Campaign
Nimbus Manticore (also tracked as GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549) is an Iranian state-backed advanced persistent threat group conducting cyber espionage operations.
highperson_alertThreat ActorFraudulent Sparrow Wallet App on Apple App Store Steals $1.8M in Bitcoin
The threat actor behind this campaign remains unidentified. The operation involved publishing fraudulent cryptocurrency wallet applications on Apple's App Store that impersonated the legitimate Sparrow Wallet.
highperson_alertThreat ActorJackSkid Adopts Blockchain C2 and Relay Mesh After March Takedown
JackSkid is an IoT botnet operator linked to the Dysphoria botnet family, targeted in coordinated U.S., German, and Canadian law enforcement actions on March 19, 2026.
highperson_alertThreat ActorAnubis Ransomware Attacks Coca-Cola's Fairlife Subsidiary
Anubis is a ransomware operation that employs double extortion tactics, combining data encryption with exfiltration and threatened public release of stolen information.
highperson_alertThreat ActorShinyHunters Claims Ernst & Young Breach via Supply-Chain Attack
ShinyHunters is a financially motivated cybercrime extortion gang known for conducting data breaches and operating a data leak site to pressure victims into paying ransoms.
highperson_alertThreat ActorOperation BlueDash: Phishing Campaign Delivers RMM Tools via Fake Teams
Operation BlueDash is a phishing campaign attributed with moderate-to-high confidence to a threat actor group operating from Nigeria. The attribution is based on analysis of infrastructure, code history, and a GitHub environment used to operate the c…
highperson_alertThreat ActorChina-Linked Group Uses Cruciferra Crypter in Tax-Themed Phishing Campaigns
A China-linked cybercrime group, tracked as TA4922 by Proofpoint, has been conducting opportunistic phishing campaigns targeting Indian taxpayers, tax professionals, and corporate finance teams.
highperson_alertThreat ActorEast Asia-Linked Actor Deploys TELESHIM, MIXEDKEY, BINDCLOAK Against ME Gov
An unattributed threat actor assessed with moderate-to-high confidence to originate from East Asia, based on operational hours (4 a.m.–12 p.m. UTC, peaking 7–11 a.m.
highperson_alertThreat ActorClickFix Abuses Steam Forums to Deliver XMRig Cryptominer
ClickFix is a threat actor conducting social engineering campaigns that leverage fake technical support content to distribute malware. The actor exploits user trust in community-driven platforms, specifically targeting gaming communities through Stea…
highperson_alertThreat ActorSourTrade Campaign Delivers Malware via Browser-Assembled Executables
SourTrade is a malvertising campaign (not a named threat actor group) operating since late 2024. The campaign impersonates legitimate trading platforms—TradingView, Solana, and Luno—to distribute malware to retail traders and cryptocurrency investors…
highperson_alertThreat ActorShinyHunters-themed sextortion campaign exploits leaked breach data
ShinyHunters is a known extortion group that has leaked data from multiple high-profile breaches including Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, and McGraw Hill.
criticalperson_alertThreat ActorCl0p Affiliates Exploit PTC Windchill RCE for Manufacturing Data Extortion
Cl0p (also tracked as Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) is a financially-motivated ransomware operation known for systematically exploiting zero-day and N-day vulnerabilities in enterprise file transfer and business-critical…
highperson_alertThreat ActorDevMan RaaS Centralizes Affiliate Operations via Dedicated Portal
DevMan (tracked as Funky Mantis by PRODAFT) is a ransomware-as-a-service operation that emerged in April 2025, initially as an affiliate for Qilin, DragonForce, Apos, and RansomHub before transitioning to independent RaaS operations.
highperson_alertThreat ActorBlueNoroff Phishing Kit Profiles Crypto Wallets Before Malware Delivery
BlueNoroff (also tracked as APT38, NICKEL GLADSTONE, BeagleBoyz, Stardust Chollima) is a North Korean state-sponsored threat actor attributed to financially motivated operations targeting the cryptocurrency and technology sectors.
highperson_alertThreat ActorHermes AI Agent Used for Post-Exploitation at Thai Finance Ministry
The threat actor behind this intrusion remains unattributed. Hunt.io assesses with low-to-medium confidence that the operator is Chinese-speaking or fluent in Chinese, based on linguistic artifacts (password containing "Leishen," meaning thunder god)…
highperson_alertThreat ActorGolden Chickens MaaS Resurfaces With Four New Malware Families
Golden Chickens (also known as Venom Spider, tracked by Recorded Future as TAG-195) is a financially motivated malware-as-a-service (MaaS) developer that provides tooling to multiple cybercrime groups.
highperson_alertThreat ActorClop Ransomware Gang Exploits PTC Windchill and FlexPLM Vulnerabilities
Clop (also tracked as Cl0p) is a financially motivated ransomware and data extortion gang with a well-established pattern of targeting enterprise software platforms to steal sensitive data and extort victims.
highperson_alertThreat ActorUAC-0099 Deploys MATCHBOIL.V2 via Fake Notepad++ Plugin
UAC-0099 is a Russia-aligned threat group active since at least mid-2022. The actor conducts cyber espionage operations primarily targeting Ukrainian entities.
criticalperson_alertThreat ActorRussian Espionage Group Exploited Zimbra Zero-Day for Email Theft
A Russian state-sponsored espionage group conducted a sustained campaign exploiting a zero-day vulnerability in Zimbra's webmail client. The actor, tracked as TA488 by Proofpoint and CL-STA-1114 by Unit 42, operated undetected for at least five month…
highperson_alertThreat ActorLaundry Bear exploits Zimbra XSS zero-day for email theft
Laundry Bear (also tracked as Void Blizzard by Microsoft) is a Russian state-sponsored APT group first publicly attributed by Dutch intelligence agencies in May 2025 following their 2024 compromise of the Dutch National Police.
highperson_alertThreat ActorRussian cyberespionage campaign targets Zimbra via JavaScript injection
This campaign is attributed by Unit 42 to Russian cyberespionage interests. The actor's motivation centers on intelligence gathering through compromise of email infrastructure.
highperson_alertThreat ActorChaos Ransomware Group Deploys msaRAT Rust Implant via Headless Browsers
Chaos is a ransomware group that operates through spam floods, vishing campaigns, Quick Assist abuse, and RMM tools for initial access and persistence. The group deploys custom tooling including the msaRAT Rust-based implant as a pre-ransomware stage…