Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 71 results
highperson_alertThreat ActorMicrosoft Teams External Chat Exploited for IT Support Impersonation
Unknown threat actors conducting a recurring social engineering campaign across hundreds of incidents. The activity shows overlap with STAC4749, a tracked cluster known for creating IT-themed cloud domains under the ".top" TLD and using plausible emp…
highperson_alertThreat ActorINC & The Gentlemen Affiliates Deploy AI-Driven Phantom Framework
INC and The Gentlemen are Russian-speaking ransomware affiliate groups operating an AI-driven intrusion ecosystem. These actors function both as intrusion and data-extortion operators and as infrastructure providers supporting multiple partners acros…
criticalperson_alertThreat ActorSafePay Ransomware Breaches 600+ Critical Infrastructure Orgs
SafePay is a private ransomware operation that emerged in August 2024, operating without an affiliate model. The group has rapidly become one of the most active ransomware operations globally, targeting critical infrastructure organizations across No…
highperson_alertThreat ActorQilin and INC Ransomware Groups Exploit CVE-2026-0257 for MFA Bypass
Qilin (tracked by Unit 42 as Spikey Scorpius) and INC (tracked as Tarnished Scorpius) are financially-motivated ransomware operators actively exploiting authentication bypass vulnerabilities for initial access.
highperson_alertThreat ActorGermany arrests alleged Qilin ransomware core member after extradition
Qilin is a notorious ransomware-as-a-service (RaaS) operation that emerged in August 2022 under the name Agenda. The group operates a double-extortion model, exfiltrating sensitive data before encrypting victim systems.
highperson_alertThreat ActorRansomware campaign disrupts IDCF Cloud, impacts Japanese govt clients
This campaign represents an unattributed ransomware operation targeting IDC Frontier's IDCF Cloud infrastructure-as-a-service platform in Japan. The threat actor demonstrated rapid compromise capabilities, claiming to breach the East Japan Region 1 i…
highperson_alertThreat ActorRansomware Groups Target Backup Infrastructure to Eliminate Recovery
This analysis covers a tactical shift across multiple ransomware groups rather than a single named threat actor. Groups including ALPHV/BlackCat, BlackMatter, and Gunra have adopted backup destruction as a standard component of their operations.
highperson_alertThreat ActorAdvantest Corporation Ransomware Attack Exposes PII Data
No specific threat actor or ransomware group has been publicly attributed to this incident. The attack occurred on February 15, 2026, when an unauthorized third party breached Advantest Corporation's network, deployed ransomware, and exfiltrated data…
highperson_alertThreat ActorInsider Sentenced for Ransomware-Style Extortion Against NJ Employer
Daniel Rhyne, a 57-year-old former core infrastructure engineer from Kansas City, Missouri, executed an insider threat attack against his New Jersey-based industrial employer in November-December 2023.
criticalperson_alertThreat ActorWarlock exploits SharePoint flaws to deploy ransomware in Iberia
Warlock (also tracked as Gold Salem, Longlegs, Storm-2603) is a suspected China-linked threat actor that gained prominence in mid-2025 through zero-day exploitation of Microsoft SharePoint vulnerabilities dubbed "ToolShell." The group is attributed b…
highperson_alertThreat ActorWarlock: China-Linked Ransomware Group Targets Critical Infrastructure
Warlock is a China-linked ransomware group that has demonstrated a focus on critical infrastructure and public sector targets. The actor's motivation appears to align with both financial gain through ransomware operations and potential strategic inte…
highperson_alertThreat ActorSpanish Police Arrest 16-Year-Old Administrator of KillSec Ransomware Group
KillSec is a ransomware-as-a-service (RaaS) operation attributed to a Spain-based 16-year-old suspected administrator and a distributed network of operators across Europe.
highperson_alertThreat ActorKillSec Ransomware Gang Dismantled in Operation KillSwitch
KillSec is a ransomware and data extortion gang active since approximately 2024. The group is allegedly led by a 16-year-old administrator, with other key members including an 18-year-old developer (who was a minor during some alleged crimes), a nego…
highperson_alertThreat ActorKeio Corporation ransomware attack disrupts Japanese rail operator
No specific threat actor has been identified or claimed responsibility for this incident as of the reporting date. The attack targeted Keio Corporation, a major Japanese private railway operator with 85 km of track, 69 stations, and a hospitality div…
criticalperson_alertThreat ActorJadePuffer Ransomware Targets Azure Tenants with Agentic AI Attacks
JadePuffer (tracked by Microsoft as Storm-3168) is a ransomware operator that emerged in July 2026, specializing in agent-driven attacks against cloud infrastructure.
highperson_alertThreat ActorStorm-2570 Ransomware Affiliate Operates Across Multiple RaaS Ecosystems
Storm-2570 is a ransomware affiliate tracked by Microsoft Threat Intelligence since April 2025. Unlike actors that consistently support a single ransomware operation, Storm-2570 operates as a cross-ecosystem threat actor working with multiple ransomw…
criticalperson_alertThreat ActorRansomware gangs exploit critical JetBrains TeamCity flaw vs US govt
No specific threat actor or ransomware gang has been named in this campaign. Multiple ransomware operators are exploiting a critical vulnerability in JetBrains TeamCity software to conduct operations targeting U.S. federal agencies.
highperson_alertThreat ActorRyuk Ransomware Operator Sentenced to 24 Months for U.S. Attacks
Karen Serobovich Vardanyan (aka "Maneeken" or "Karl Lagerfeld"), a 35-year-old Armenian national, served as an initial access specialist for the Ryuk ransomware-as-a-service (RaaS) operation.
criticalperson_alertThreat ActorCVE-2026-59310: VMware vCenter RCE exploited by ransomware gangs
No specific threat actor attribution is provided. The campaign involves multiple ransomware gangs actively exploiting CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter.
highperson_alertThreat ActorUkrainian National Sentenced to Four Years for Conti Ransomware Role
Conti is a prolific ransomware-as-a-service (RaaS) operation that emerged in 2020 and became one of the most active and damaging cybercrime groups globally.
highperson_alertThreat ActorMantax Otax: Android malware blends ransomware and spyware features
Mantax Otax is a newly identified Android malware family that exhibits hybrid functionality, combining ransomware encryption capabilities with spyware data exfiltration and victim harassment features.
highperson_alertThreat ActorRhysida ransomware gang breaches Berlin city administration
Rhysida is a ransomware-as-a-service (RaaS) operation active since mid-2023, conducting double-extortion attacks against high-value targets. The group exfiltrates sensitive data before deploying ransomware, then threatens public disclosure to pressur…
highperson_alertThreat ActorAurora Ransomware Operators Leverage Cursor AI for Network Intrusion
Aurora (aka Aur0ra) ransomware operators are a Russian-speaking cybercrime group operating a ransomware-as-a-service (RaaS) model with affiliates. The group has been active since at least April 2026, targeting organizations across nine countries with…
highperson_alertThreat ActorRansom Busters: Rogue Affiliate Impersonates Recovery Firm
Ransom Busters is a suspected ransomware affiliate operating across multiple Ransomware-as-a-Service (RaaS) platforms, including DragonForce, Settra, and Anubis.
criticalperson_alertThreat ActorMedusa Ransomware Gang Breaches 500+ US Critical Infrastructure Orgs
Medusa is a ransomware operation active since January 2021 that evolved from a closed ransomware variant into a Ransomware-as-a-Service (RaaS) model with an affiliate program.
highperson_alertThreat ActorCVE-2025-60710: Windows Task Host Flaw Exploited by Ransomware Gangs
No specific threat actor or ransomware gang has been publicly attributed to the exploitation of CVE-2025-60710. CISA confirmed that multiple ransomware operators are actively exploiting this vulnerability in the wild as of August 2026.
highperson_alertThreat ActorClop Ransomware Gang Exploits PTC Windchill Flaw to Breach GE, Philips
Clop is a financially motivated ransomware and extortion gang with a well-established history of exploiting zero-day and n-day vulnerabilities in enterprise file-sharing and product lifecycle management (PLM) platforms to conduct mass data theft camp…
highperson_alertThreat ActorAkira Ransomware Affiliate Uses Safe Mode to Evade EDR, Fails Encryption
Akira (also tracked as GOLD SAHARA, PUNK SPIDER, and Howling Scorpius) is a ransomware operation that emerged as a significant threat actor conducting double extortion attacks.
highperson_alertThreat ActorDeadLock ransomware uses blockchain infrastructure to evade takedown
DeadLock is a ransomware-as-a-service (RaaS) operation that emerged in mid-2025, employing double-extortion tactics combining data theft with file encryption.
highperson_alertThreat ActorDeadLock Ransomware Leverages Polygon Blockchain for Resilient Extortion
DeadLock is a ransomware group first detected in July 2025, operating double extortion campaigns that encrypt victim environments and threaten public data release.