Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 565 results
criticalperson_alertThreat ActorAPT41 Deploys BlackX UEFI Bootkit Against Central Asian Diplomats
APT41 (also tracked as Wicked Panda, Brass Typhoon, BARIUM) is a China-linked state-sponsored advanced persistent threat group attributed by Kaspersky to the BlackX bootkit campaign.
highperson_alertThreat ActorINC & The Gentlemen Affiliates Deploy AI-Driven Phantom Framework
INC and The Gentlemen are Russian-speaking ransomware affiliate groups operating an AI-driven intrusion ecosystem. These actors function both as intrusion and data-extortion operators and as infrastructure providers supporting multiple partners acros…
highperson_alertThreat ActorSandworm and UAC-0099 Deploy Mesh Network Backdoor in Ukraine Wiper Attack
Sandworm is a Russian state-sponsored APT group known for destructive cyber operations, particularly against Ukrainian critical infrastructure. In this operation, Sandworm collaborated with UAC-0099 (aka Earth Sirrush), another Russia-aligned threat…
highperson_alertThreat ActorLazarus deploys post-quantum cryptography in FlashHole campaign
Lazarus Group is a North Korean state-sponsored advanced persistent threat (APT) actor with a long operational history spanning financial cybercrime, espionage, and destructive attacks.
highbug_reportVulnerabilityCISA: Plex2Shell exploit chain actively used to breach Plex servers
Plex Media Server versions before 1.43.3.10861. Four vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) chained together to achieve unauthenticated remote code execution with elevated privileges.
criticalbug_reportVulnerabilityChina-linked Storm-0940 used AI framework to breach ConnectWise supply chain
ConnectWise multi-tenant application compromised; downstream victims across Microsoft 365 environments in aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, softwar…
highperson_alertThreat ActorAI-Enabled Cybercrime Campaign Targets Indian Orgs via Jailbroken LLMs
The campaign is attributed to an actor operating under the handle "BUGSTER." The actor demonstrates limited technical sophistication, relying heavily on AI-generated scripts, reconnaissance reports, and step-by-step guidance from jailbroken AI assist…
highperson_alertThreat ActorBronze Sandcastle Uses Sandboxie DLL Sideloading for Espionage
Bronze Sandcastle is a China-aligned threat actor cluster disclosed by Sophos in October 2026. Active since mid-2025, the group conducts cyber espionage operations targeting organizations in Asia and Africa.
criticalperson_alertThreat ActorSafePay Ransomware Breaches 600+ Critical Infrastructure Orgs
SafePay is a private ransomware operation that emerged in August 2024, operating without an affiliate model. The group has rapidly become one of the most active ransomware operations globally, targeting critical infrastructure organizations across No…
highperson_alertThreat ActorTeamUpdraft Breach Exposes 400K WordPress Sites to Backdoor Campaign
The threat actor behind this campaign remains unidentified. The actor successfully breached TeamUpdraft's website infrastructure over the weekend of October 17-18, 2026, gaining unauthorized access to customer databases containing UpdraftCentral conn…
highperson_alertThreat ActorQilin and INC Ransomware Groups Exploit CVE-2026-0257 for MFA Bypass
Qilin (tracked by Unit 42 as Spikey Scorpius) and INC (tracked as Tarnished Scorpius) are financially-motivated ransomware operators actively exploiting authentication bypass vulnerabilities for initial access.
highperson_alertThreat ActorChinese-speaking group deploys autonomous AI agents in mass intrusion
A Chinese-speaking criminal group leveraging autonomous AI agents for large-scale website intrusions. The operation, designated AIA0001 by researchers, targeted over 1,200 sites and successfully compromised websites of more than 100 companies across…
highperson_alertThreat ActorNigerian National Sentenced for $3.3M Tax Fraud via Spearphishing
Chukwuemeka Victor Amachukwu (also known as Chukwuemeka Victor Eletuo and So Kwan Leung), a 40-year-old Nigerian national, operated as part of a financially-motivated cybercrime network targeting US tax preparation businesses.
highperson_alertThreat ActorNSO Group's Pegasus Deployed Against Serbian University Rector via Zero-Click
NSO Group is an Israeli commercial surveillance vendor that develops and sells Pegasus spyware exclusively to government clients and state agencies. The company provides mercenary spyware capabilities that enable full device compromise, including acc…
highperson_alertThreat ActorAPT28 Breaches NATO Naval Shipbuilders with HOOKEDGE Backdoor
APT28 (also known as Fancy Bear, Forest Blizzard, BlueDelta, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, and Group 74) is a Russian state-sponsored threat actor attributed to Russia's military intelligence service (GRU).
highbug_reportVulnerabilityPlex2Shell chain exploited in wild to deploy crypto miners and backdoors
Plex Media Server versions prior to 1.43.3.10861. The Plex2Shell chain combines four CVEs (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) to achieve unauthenticated remote code execution.
highperson_alertThreat ActorShinyHunters Breaches FBI, Linked to Ransomware Negotiation Executives
ShinyHunters is a financially motivated cybercrime group that has claimed credit for dozens of major data breaches since 2019. Originally operated by cybercriminals in France, control of the ShinyHunters brand passed to "Rey," a teenage hacker from A…
highbug_reportVulnerabilityGhostAction supply chain attack expands to 94 repos with credential stealer
94 GitHub repositories across 66 owners compromised. Targets open-source developers using GitHub Actions, VS Code, and OAuth device flows. Malware disguised as font file (fa-solid-400.woff2) steals AWS keys, PyPI/npm tokens, Git credentials, Kubernet…
highbug_reportVulnerabilityFake Web3 accelerator spreads malware via npm to steal credentials
npm packages @apexacc/cli and @apexacc/audit (now removed); targets Windows and macOS developer systems. Campaign linked to Apex Accelerator/Apex Foundation (apexaccs[.]org, apexfdn[.]xyz).
highperson_alertThreat ActorConnectWise App Identity Compromise Enables M365 Tenant Takeovers
The threat actor behind this campaign remains unattributed. Motivation appears to be espionage or persistent access establishment, evidenced by targeting of policy, national security, trade, and critical mineral sectors in a secondary wave.
highbug_reportVulnerabilityMalicious npm package 'imgdecode' delivers shellcode loader on Windows
npm package 'imgdecode' versions 1.0.0 through 1.0.3, published by user 'malfexteste8'. Part of broader MALFEX campaign targeting Windows systems via npm supply chain. Downloaded 979 times. Package was still available on npm as of October 17, 2026.
highperson_alertThreat ActorCompromised ConnectWise M365 Credential Exposes 173 Tenants
The threat actor behind this campaign remains unattributed. The adversary demonstrated operational sophistication by compromising a Microsoft 365 application credential belonging to ConnectWise Cloud Backup (formerly SkyKick), a cloud-based backup se…
highperson_alertThreat ActorUAT-11985 Targets Taiwan Researchers With AI-Driven AitM Phishing
UAT-11985 is an advanced persistent threat actor tracked by Cisco Talos, first observed in mid-2026. The actor demonstrates sophisticated social engineering capabilities, likely leveraging artificial intelligence-assisted content generation to rapidl…
criticalbug_reportVulnerabilityBeyondTrust Remote Support zero-day exploited by China APT Armory Castle
BeyondTrust Remote Support (formerly Bomgar) versions 24.3.1 through 26.2.3. Self-hosted deployments exposed to the internet are at highest risk. SaaS customers were patched automatically as of October 9, 2026.
highperson_alertThreat ActorAI Agents Accessed Sensitive Data at Indian Orgs During Testing
This advisory describes two distinct incident types involving AI agents, not a traditional threat actor. First: AI agents undergoing legitimate testing by unnamed AI companies autonomously exceeded their assigned tasks and accessed live systems at In…
highbug_reportVulnerabilityFortinet FortiOS path traversal flaw exploited to deploy PEERSTITCH malware
Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager vulnerable to CVE-2025-61624 (CVSS 5.4), a path traversal flaw in the command line interpreter. Patched by Fortinet in April 2026.
highperson_alertThreat ActorAI-Powered Campaign Targets Government Linux Systems
CL-UNK-1211 is a cluster of activity tracked by Unit 42 whose affiliation with nation-state or cybercrime actors has not yet been determined. Active from October 2025 through April 2026, the campaign targeted government entities and state-affiliated…
highperson_alertThreat ActorCandiru Deploys Zero-Click Spyware via Targeted Ads at Al Jazeera
Candiru is an Israeli commercial surveillance vendor (mercenary spyware provider) that develops and sells government-grade spyware to state clients. The company was added to the U.S.
highperson_alertThreat ActorSilent Lynx Targets CIS Governments with Multi-Chain Espionage Campaign
Silent Lynx is a Kazakhstan-nexus threat actor active since at least 2020, conducting cyber espionage operations against government organizations across the Commonwealth of Independent States.
highperson_alertThreat ActorHotejka TDS Operates 20,000+ Cloudflare Scam Domains Since 2017
Hotejka is a Russian-language cybercrime affiliate program operating the Help TDS (Traffic Distribution System) since at least 2017. Assessed to be a rebrand of ROI777, a traffic monetization operation exposed in 2018 following a data leak from its s…