Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 112 results
highperson_alertThreat ActorNSO Group's Pegasus Used Against Serbian University Rector Before Election
NSO Group is an Israeli commercial surveillance vendor that develops and sells Pegasus spyware exclusively to government clients and state agencies. The company operates in the mercenary spyware market, providing sophisticated mobile surveillance cap…
highperson_alertThreat ActorAPT28 Breaches NATO Naval Shipbuilders with HOOKEDGE Backdoor
APT28 (also known as Fancy Bear, Forest Blizzard, BlueDelta, IRON TWILIGHT, SNAKEMACKEREL, and Swallowtail) is a Russian state-sponsored threat actor attributed to cyber espionage operations aligned with Russian foreign intelligence objectives.
highperson_alertThreat ActorUAT-11985 Targets Taiwan Researchers With AI-Driven AitM Phishing
UAT-11985 is an advanced persistent threat actor tracked by Cisco Talos, first observed in mid-2026. The actor demonstrates sophisticated social engineering capabilities, likely leveraging artificial intelligence-assisted content generation to rapidl…
highperson_alertThreat ActorAI-Powered Campaign Targets Government Linux Systems
CL-UNK-1211 is a cluster of activity tracked by Unit 42 whose affiliation with nation-state or cybercrime actors has not yet been determined. Active from October 2025 through April 2026, the campaign targeted government entities and state-affiliated…
highperson_alertThreat ActorCandiru Deploys Zero-Click Spyware via Targeted Ads at Al Jazeera
Candiru is an Israeli commercial surveillance vendor (mercenary spyware provider) that develops and sells government-grade spyware to state clients. The company was added to the U.S.
highperson_alertThreat ActorSilent Lynx Targets CIS Governments with Multi-Chain Espionage Campaign
Silent Lynx is a Kazakhstan-nexus threat actor active since at least 2020, conducting cyber espionage operations against government organizations across the Commonwealth of Independent States.
highperson_alertThreat ActorFamous Chollima DPRK IT Worker Scheme Disrupted in Texas Raids
Famous Chollima (also tracked as WageMole) is a North Korean state-sponsored threat actor conducting fraudulent IT worker schemes to generate revenue for the DPRK regime.
highperson_alertThreat ActorFlax Typhoon Exploits Five KEV Flaws for Initial Access
Flax Typhoon is a China-linked advanced persistent threat (APT) group attributed to conducting cyber espionage operations. The actor is assessed to be affiliated with the Chinese government and has been observed positioning itself within critical inf…
highperson_alertThreat ActorFBI Seizes Flax Typhoon Domains Hosting MicroScan and FishHub Tools
Flax Typhoon is a Chinese state-sponsored threat actor attributed to conducting cyber espionage operations against critical infrastructure and organizations globally.
highperson_alertThreat ActorIntegrity Technology Group: China-linked firm breached global targets
Integrity Technology Group is a China-based for-profit cybersecurity company with documented links to the Chinese government. According to the FBI and six partner agencies, the company's employees develop and acquire cyber tools for use and sale, hos…
highperson_alertThreat ActorUAC-0099 Deploys ASHVEIN RAT Against Ukrainian Government Targets
UAC-0099 is a Russia-aligned threat actor first documented by CERT-UA in June 2023, actively targeting Ukrainian government, defense, border guard, and logistics entities since at least mid-2022 following Russia's full-scale invasion of Ukraine.
highperson_alertThreat ActorChina-Linked Actors Target Global Networks via Integrity Tech
China-linked malicious cyber actors enabled by Integrity Technology Group (Integrity Tech), a China-based company with links to the Chinese Government. The company was sanctioned by the UK government in 2025 for malicious cyber activity against the U…
highperson_alertThreat ActorU.S. offers $10M reward for HAFNIUM actor Zhang Yu in Exchange attacks
HAFNIUM (also tracked as Silk Typhoon, Operation Exchange Marauder) is a Chinese state-sponsored APT group attributed by Microsoft and the U.S. government to China's Ministry of State Security (MSS).
highperson_alertThreat ActorShinyHunters Member "Rey" Detained in Jordan, Cooperating with FBI
ShinyHunters is a prolific cybercriminal group specializing in data theft, extortion, and breach operations. Originating around April-May 2020, the group evolved from earlier extortion-focused collectives TheDarkOverlord and GnosticPlayers.
highperson_alertThreat ActorTA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
TA419 is a China-aligned, espionage-motivated threat actor attributed by Proofpoint. Active since at least April 2025, the group conducts credential phishing campaigns targeting individuals at U.S.
highperson_alertThreat ActorShinyHunters Member "Rey" Detained in Jordan, Cooperating with FBI
ShinyHunters is a cybercrime group specializing in data theft and extortion operations. The group has gained notoriety for breaching organizations, exfiltrating sensitive data, and either selling stolen databases on underground forums or leveraging t…
highperson_alertThreat ActorChina-Nexus Actor UAT-11587 Deploys Antino Backdoor Across Asia
UAT-11587 is a China-nexus threat actor tracked by Cisco Talos, first detected in September 2025 targeting Taiwan's academic, think tank, and civil society policy community.
highperson_alertThreat ActorStar Blizzard deploys CosmicPulse backdoor via new RedFlick technique
Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor active since 2017. The group is attributed to Russian intelligence services and is motivated by espionage objectives aligned with R…
highperson_alertThreat ActorFBI warns ShinyHunters members to surrender after Dutch arrest
ShinyHunters is a financially motivated cybercrime group linked to extortion activities targeting organizations in the United States, Netherlands, and globally.
highperson_alertThreat ActorStar Blizzard Deploys CosmicPulse Backdoor via Fake Event Invitations
Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor attributed by U.S., U.K., Australian, Canadian, and New Zealand security agencies to Center 18 of Russia's Federal Security Service…
highperson_alertThreat ActorStorm-3068 Pivots from Identity Compromise to Cloud Infrastructure
Storm-3068 is a threat actor tracked by Microsoft that demonstrated sophisticated understanding of cloud-native attack paths. In this intrusion, the actor leveraged a compromised user identity obtained through self-service password reset to gain pers…
highperson_alertThreat ActorStar Blizzard Adopts RedFlick Delivery Technique in 2026 Campaigns
Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor attributed by CISA to the FSB Centre 18.
highperson_alertThreat ActorDutch Police Arrest 24-Year-Old Linked to ShinyHunters Group
ShinyHunters is a financially-motivated cybercrime group known for large-scale data breaches and extortion operations. The group has historically targeted organizations to steal sensitive data for sale or extortion.
highperson_alertThreat ActorDutch Police Arrest Amsterdam Man in ShinyHunters Investigation
ShinyHunters is a cybercrime group known for large-scale data breaches and extortion operations. The group has been active since at least 2020, targeting organizations across multiple sectors to steal and leak sensitive data.
highperson_alertThreat ActorNeedyMantis: Modular Post-Compromise Framework in Targeted Intrusions
NeedyMantis is a modular post-compromise malware framework, not a threat actor. It has been observed in use by at least one operator, Storm-3069 (linked to the DAEMON Tools supply chain compromise).
highperson_alertThreat ActorJADEPUFFER (Storm-3168) Deletes Azure Resources via Compromised Principals
JADEPUFFER (tracked by Microsoft as Storm-3168) is a threat actor notable for conducting the first documented ransomware operation orchestrated end-to-end using large language models (LLMs).
highperson_alertThreat ActorKiteworks Issues Precautionary Shutdown After Federal Threat Warning
No specific threat actor has been publicly identified in this incident. Federal intelligence authorities provided credible threat intelligence to Kiteworks indicating that an unspecified threat actor may attempt to target some Kiteworks systems.
highperson_alertThreat ActorStorm-3168 (JADEPUFFER) conducts agentic Azure cloud attacks
Storm-3168 is Microsoft's tracking designation for JADEPUFFER, a threat actor first documented by Sysdig in July 2026 as the first known agentic ransomware operation.
highperson_alertThreat ActorWaterPlum compromises 30K devices, steals $10.7M in cryptocurrency
WaterPlum is a North Korean state-sponsored hacking group attributed to operations between December 2025 and July 2026. The group is financially motivated, conducting large-scale compromise campaigns to generate revenue for the North Korean regime th…
highperson_alertThreat ActorTransparent Tribe Deploys Rust Backdoors via GitHub C2 Infrastructure
Transparent Tribe (also tracked as APT36, Earth Karkaddan, COPPER FIELDSTONE, Mythic Leopard, and ProjectM) is a Pakistan-aligned advanced persistent threat group with sustained focus on South Asian geopolitical targets.