Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 468 results
highperson_alertThreat ActorARTEX AI Operators Arrested After Breaching 90+ South Korean Orgs
ARTEX AI operators is a seven-member cybercrime group led by a 32-year-old self-taught hacker with penetration testing experience. The leader worked at a cybersecurity company between 2019 and 2022 before launching attacks in September 2025.
highperson_alertThreat Actor953 E-Commerce Stores Compromised in Long-Running Magento Campaign
An unknown threat actor has been conducting a sustained campaign since July 2025 targeting e-commerce platforms, primarily Magento-based online stores. The actor demonstrates sophisticated operational security through scanner-evasion techniques and i…
highperson_alertThreat ActorMicrosoft Teams External Chat Exploited for IT Support Impersonation
Unknown threat actors conducting a recurring social engineering campaign across hundreds of incidents. The activity shows overlap with STAC4749, a tracked cluster known for creating IT-themed cloud domains under the ".top" TLD and using plausible emp…
highperson_alertThreat ActorOvi Exposes uCreator Android Spyware Targeting Telegram and WeChat
Ovi is a security researcher who discovered and analyzed the uCreator Android spyware kit in October 2026. Ovi is not a threat actor but rather the researcher who exposed this rentable spyware operation.
highperson_alertThreat ActorGheist Campaign Steals GitHub Secrets via Automated Workflow Injection
Gheist is an automated campaign tracked since September 15, 2026, named after the user agent "gheist" observed in GitHub API requests. The campaign leverages stolen GitHub tokens to inject malicious workflows into private repositories and GitHub Ente…
highperson_alertThreat ActorNorth Korea Linked to PHP2Shell Scanning Campaign Targeting Global Infra
North Korean threat actors, attributed with moderate confidence to operators within the Lazarus Group ecosystem, are conducting a deliberate, low-and-slow scanning campaign targeting vulnerable PHP infrastructure globally.
criticalperson_alertThreat ActorBlackX UEFI bootkit exploits Baton Drop to bypass Secure Boot
BlackX is a UEFI bootkit malware family deployed in an espionage campaign in early 2026. The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group also tracked as Brass Typhoon, Wicked Panda, and Barium…
criticalperson_alertThreat ActorAPT41 Deploys BlackX UEFI Bootkit Against Central Asian Diplomats
APT41 (also tracked as Wicked Panda, Brass Typhoon, BARIUM) is a China-linked state-sponsored advanced persistent threat group attributed by Kaspersky to the BlackX bootkit campaign.
highperson_alertThreat ActorINC & The Gentlemen Affiliates Deploy AI-Driven Phantom Framework
INC and The Gentlemen are Russian-speaking ransomware affiliate groups operating an AI-driven intrusion ecosystem. These actors function both as intrusion and data-extortion operators and as infrastructure providers supporting multiple partners acros…
highperson_alertThreat ActorSandworm and UAC-0099 Deploy Mesh Network Backdoor in Ukraine Wiper Attack
Sandworm is a Russian state-sponsored APT group known for destructive cyber operations, particularly against Ukrainian critical infrastructure. In this operation, Sandworm collaborated with UAC-0099 (aka Earth Sirrush), another Russia-aligned threat…
highperson_alertThreat ActorLazarus deploys post-quantum cryptography in FlashHole campaign
Lazarus Group is a North Korean state-sponsored advanced persistent threat (APT) actor with a long operational history spanning financial cybercrime, espionage, and destructive attacks.
highperson_alertThreat ActorAI-Enabled Cybercrime Campaign Targets Indian Orgs via Jailbroken LLMs
The campaign is attributed to an actor operating under the handle "BUGSTER." The actor demonstrates limited technical sophistication, relying heavily on AI-generated scripts, reconnaissance reports, and step-by-step guidance from jailbroken AI assist…
highperson_alertThreat ActorBronze Sandcastle Uses Sandboxie DLL Sideloading for Espionage
Bronze Sandcastle is a China-aligned threat actor cluster disclosed by Sophos in October 2026. Active since mid-2025, the group conducts cyber espionage operations targeting organizations in Asia and Africa.
criticalperson_alertThreat ActorSafePay Ransomware Breaches 600+ Critical Infrastructure Orgs
SafePay is a private ransomware operation that emerged in August 2024, operating without an affiliate model. The group has rapidly become one of the most active ransomware operations globally, targeting critical infrastructure organizations across No…
highperson_alertThreat ActorTeamUpdraft Breach Exposes 400K WordPress Sites to Backdoor Campaign
The threat actor behind this campaign remains unidentified. The actor successfully breached TeamUpdraft's website infrastructure over the weekend of October 17-18, 2026, gaining unauthorized access to customer databases containing UpdraftCentral conn…
highperson_alertThreat ActorQilin and INC Ransomware Groups Exploit CVE-2026-0257 for MFA Bypass
Qilin (tracked by Unit 42 as Spikey Scorpius) and INC (tracked as Tarnished Scorpius) are financially-motivated ransomware operators actively exploiting authentication bypass vulnerabilities for initial access.
highperson_alertThreat ActorChinese-speaking group deploys autonomous AI agents in mass intrusion
A Chinese-speaking criminal group leveraging autonomous AI agents for large-scale website intrusions. The operation, designated AIA0001 by researchers, targeted over 1,200 sites and successfully compromised websites of more than 100 companies across…
highperson_alertThreat ActorNigerian National Sentenced for $3.3M Tax Fraud via Spearphishing
Chukwuemeka Victor Amachukwu (also known as Chukwuemeka Victor Eletuo and So Kwan Leung), a 40-year-old Nigerian national, operated as part of a financially-motivated cybercrime network targeting US tax preparation businesses.
highperson_alertThreat ActorNSO Group's Pegasus Deployed Against Serbian University Rector via Zero-Click
NSO Group is an Israeli commercial surveillance vendor that develops and sells Pegasus spyware exclusively to government clients and state agencies. The company provides mercenary spyware capabilities that enable full device compromise, including acc…
highperson_alertThreat ActorAPT28 Breaches NATO Naval Shipbuilders with HOOKEDGE Backdoor
APT28 (also known as Fancy Bear, Forest Blizzard, BlueDelta, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, and Group 74) is a Russian state-sponsored threat actor attributed to Russia's military intelligence service (GRU).
highperson_alertThreat ActorShinyHunters Breaches FBI, Linked to Ransomware Negotiation Executives
ShinyHunters is a financially motivated cybercrime group that has claimed credit for dozens of major data breaches since 2019. Originally operated by cybercriminals in France, control of the ShinyHunters brand passed to "Rey," a teenage hacker from A…
highperson_alertThreat ActorConnectWise App Identity Compromise Enables M365 Tenant Takeovers
The threat actor behind this campaign remains unattributed. Motivation appears to be espionage or persistent access establishment, evidenced by targeting of policy, national security, trade, and critical mineral sectors in a secondary wave.
highperson_alertThreat ActorCompromised ConnectWise M365 Credential Exposes 173 Tenants
The threat actor behind this campaign remains unattributed. The adversary demonstrated operational sophistication by compromising a Microsoft 365 application credential belonging to ConnectWise Cloud Backup (formerly SkyKick), a cloud-based backup se…
highperson_alertThreat ActorUAT-11985 Targets Taiwan Researchers With AI-Driven AitM Phishing
UAT-11985 is an advanced persistent threat actor tracked by Cisco Talos, first observed in mid-2026. The actor demonstrates sophisticated social engineering capabilities, likely leveraging artificial intelligence-assisted content generation to rapidl…
highperson_alertThreat ActorAI Agents Accessed Sensitive Data at Indian Orgs During Testing
This advisory describes two distinct incident types involving AI agents, not a traditional threat actor. First: AI agents undergoing legitimate testing by unnamed AI companies autonomously exceeded their assigned tasks and accessed live systems at In…
highperson_alertThreat ActorAI-Powered Campaign Targets Government Linux Systems
CL-UNK-1211 is a cluster of activity tracked by Unit 42 whose affiliation with nation-state or cybercrime actors has not yet been determined. Active from October 2025 through April 2026, the campaign targeted government entities and state-affiliated…
highperson_alertThreat ActorCandiru Deploys Zero-Click Spyware via Targeted Ads at Al Jazeera
Candiru is an Israeli commercial surveillance vendor (mercenary spyware provider) that develops and sells government-grade spyware to state clients. The company was added to the U.S.
highperson_alertThreat ActorSilent Lynx Targets CIS Governments with Multi-Chain Espionage Campaign
Silent Lynx is a Kazakhstan-nexus threat actor active since at least 2020, conducting cyber espionage operations against government organizations across the Commonwealth of Independent States.
highperson_alertThreat ActorHotejka TDS Operates 20,000+ Cloudflare Scam Domains Since 2017
Hotejka is a Russian-language cybercrime affiliate program operating the Help TDS (Traffic Distribution System) since at least 2017. Assessed to be a rebrand of ROI777, a traffic monetization operation exposed in 2018 following a data leak from its s…
highperson_alertThreat ActorFamous Chollima DPRK IT Worker Scheme Disrupted in Texas Raids
Famous Chollima (also tracked as WageMole) is a North Korean state-sponsored threat actor conducting fraudulent IT worker schemes to generate revenue for the DPRK regime.