Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
8 / 8 results
highperson_alertThreat ActorQilin and INC Ransomware Groups Exploit CVE-2026-0257 for MFA Bypass
Qilin (tracked by Unit 42 as Spikey Scorpius) and INC (tracked as Tarnished Scorpius) are financially-motivated ransomware operators actively exploiting authentication bypass vulnerabilities for initial access.
highperson_alertThreat ActorGermany arrests alleged Qilin ransomware core member after extradition
Qilin is a notorious ransomware-as-a-service (RaaS) operation that emerged in August 2022 under the name Agenda. The group operates a double-extortion model, exfiltrating sensitive data before encrypting victim systems.
highperson_alertThreat ActorStorm-2570 Ransomware Affiliate Operates Across Multiple RaaS Ecosystems
Storm-2570 is a ransomware affiliate tracked by Microsoft Threat Intelligence since April 2025. Unlike actors that consistently support a single ransomware operation, Storm-2570 operates as a cross-ecosystem threat actor working with multiple ransomw…
criticalbug_reportVulnerabilityCisco FMC auth bypass exploited by ransomware and state actors
Cisco Secure Firewall Management Center (FMC) software. CVE-2026-20079 (CVSS 10.0) allows unauthenticated remote authentication bypass and root access. CVE-2026-20316 (CVSS 5.3) enables low-privilege login for sensitive data access.
highperson_alertThreat ActorQilin Ransomware Exploits CVE-2026-0257 PAN-OS Flaw for Initial Access
Qilin is a ransomware-as-a-service (RaaS) operation that has been active in the cybercrime ecosystem, deploying file-encrypting malware against organizations for financial gain.
criticalperson_alertThreat ActorQilin Ransomware Gang Exploits PAN-OS GlobalProtect Vulnerability
Qilin is a ransomware-as-a-service (RaaS) operation that has emerged as a notable threat actor in the cybercrime ecosystem. The group operates a double-extortion model, encrypting victim data while exfiltrating sensitive information for leverage in r…
highperson_alertThreat ActorThe Gentlemen ransomware group claims 478 victims via multi-RaaS model
The Gentlemen is a financially motivated ransomware threat group that has claimed 478 victims through a hybrid operational model. Initially operating as an affiliate leveraging multiple ransomware-as-a-service (RaaS) platforms—including LockBit, Qili…
criticalbug_reportVulnerabilityCheck Point patches zero-day in VPN/Mobile Access exploited by Qilin
Check Point Remote Access VPN and Mobile Access deployments. Specific product versions not disclosed in summary; refer to vendor advisory for affected releases and patched versions.