Intelligence Feed

3mo ago · static-urls

Cavalry Werewolf conducted targeted phishing campaigns from May to August 2025, primarily against Russian public sector entities and critical infrastructure organizations. The attackers impersonated Kyrgyz government officials and delivered custom malware, including FoalShell reverse shells and StallionRAT, via malicious RAR attachments. These tools enabled remote command execution, data exfiltration, and persistence through registry modifications, with command and control communications routed through Telegram bots and proxy tools.

3mo ago · welivesecurity

ESET Research has uncovered the first known collaboration between two Russian FSB-affiliated APT groups, Gamaredon and Turla, targeting high-profile entities in Ukraine. Gamaredon provided initial access and infrastructure to Turla, enabling the deployment and reactivation of Turla's Kazuar backdoor on compromised systems. This cooperation suggests a strategic alignment between the two groups, with Gamaredon acting as an access provider for Turla's more targeted espionage operations.

3mo ago · hacker-news

The EvilAI campaign involves threat actors distributing malware disguised as legitimate AI and productivity tools to infiltrate organizations globally. These trojans use valid digital signatures and professional interfaces to evade detection, enabling reconnaissance, data exfiltration, and command-and-control communication. The malware acts as a stager for follow-on payloads, with different variants like BaoLoader and TamperedChef linked to distinct but overlapping infrastructure and objectives.

3mo ago · fortinet

The Confucius threat group, a state-aligned cyber-espionage actor, has evolved its tactics from using document stealers like WooperStealer to deploying Python-based backdoors such as AnonDoor. Initially targeting organizations in Pakistan via spear-phishing and malicious Office documents, the group has advanced to using LNK files, DLL side-loading, and scheduled tasks for persistence. Their campaigns now feature layered obfuscation, custom Python RATs, and sophisticated data exfiltration techniques, indicating a growing level of operational sophistication.

3mo ago · talos

Cisco Talos identified a new attack campaign linked to the DPRK-aligned threat group Famous Chollima, which uses social engineering through fake job offers to distribute trojanized Node.js applications. The campaign leverages malicious npm packages like 'node-nvm-ssh' and combines the BeaverTail and OtterCookie malware tools to steal credentials, cryptocurrency wallets, and system information. Recent evolution includes merged functionality between BeaverTail and OtterCookie, with new capabilities such as keylogging, screenshot capture, and clipboard monitoring delivered via a modular JavaScript-based framework.

3mo ago · cn-cert

3mo ago · dark-trace

Salt Typhoon, a China-linked advanced persistent threat (APT) group also known as Earth Estries or UNC2286, conducted a cyber espionage intrusion targeting a European telecommunications organization. The attack began with exploitation of CVE-2025-5777 in Citrix NetScaler Gateway appliances, followed by lateral movement and DLL sideloading using legitimate antivirus software to execute the SNAPPYBEE (Deed RAT) backdoor. Command-and-control communications were observed using suspicious domains and IPs, with activity detected and contained early by Darktrace’s AI-driven systems.

3mo ago · hacker-news

China's Ministry of State Security (MSS) accused the U.S. National Security Agency (NSA) of conducting a multi-stage cyber attack on the National Time Service Center (NTSC), starting in March 2022. The attack involved compromising mobile devices via a foreign SMS service, using stolen credentials, and deploying a cyber warfare platform with 42 specialized tools to target internal systems. The MSS claims the attack aimed to disrupt 'Beijing Time' infrastructure and was ultimately thwarted, with the U.S. accused of using global infrastructure to conceal its activities.

3mo ago · google-threat-intel

Russian state-sponsored threat group COLDRIVER rapidly deployed new malware families following the public disclosure of its LOSTKEYS malware in May 2025. The group introduced a new infection chain centered around the NOROBOT DLL, delivered via a 'ClickFix' CAPTCHA-themed lure, leading to deployment of the YESROBOT and later MAYBEROBOT backdoors. COLDRIVER has shown aggressive development tempo, frequently evolving delivery mechanisms and evasion techniques to maintain access to high-value targets such as NGOs, policy advisors, and dissidents.

3mo ago · Kaspersky-labs

The PassiveNeuron campaign is a sophisticated cyberespionage operation targeting government, financial, and industrial organizations in Asia, Africa, and Latin America. It primarily compromises Windows Server machines, often through SQL server exploitation, and deploys custom APT implants such as Neursite and NeuralExecutor. The attackers use a multi-stage DLL loader chain with anti-sandbox techniques and have shifted to using GitHub-based dead drop resolvers for C2 configuration in newer variants. Attribution remains challenging, but TTPs suggest a Chinese-speaking threat actor with low confidence.

3mo ago · security.com

China-based threat actors exploited the ToolShell vulnerability (CVE-2025-53770) to compromise a telecoms company in the Middle East and multiple government agencies globally shortly after the patch was released in July 2025. The attackers deployed backdoors such as Zingdoor and ShadowPad, used DLL sideloading techniques, and leveraged tools like KrustyLoader and Sliver for post-exploitation. Activities indicate espionage motives, with credential theft and lateral movement observed across compromised networks.

3mo ago · hacker-news

A critical remote code execution vulnerability in Microsoft WSUS, tracked as CVE-2025-59287, is under active exploitation with public proof-of-concept code available. The flaw stems from unsafe deserialization of AuthorizationCookie objects via the BinaryFormatter, allowing unauthenticated attackers to execute arbitrary code with SYSTEM privileges. Exploitation has been observed in the wild, with threat actors targeting publicly exposed WSUS instances to deploy PowerShell payloads for reconnaissance and potential supply chain attacks. Organizations are urged to apply emergency patches immediately, as unpatched systems are at high risk of compromise.

3mo ago · hacker-news

APT36, also known as Transparent Tribe, has targeted Indian government entities using spear-phishing emails delivering a Golang-based DeskRAT malware. The campaign primarily targets BOSS Linux systems, leveraging malicious Desktop files and cloud storage services to distribute payloads. DeskRAT establishes persistence through multiple methods and communicates with C2 servers via WebSockets, enabling file exfiltration and remote execution. The group has evolved to use custom malware, indicating increased sophistication.

3mo ago · talos

The Qilin ransomware group, active since 2022 and operating as a Ransomware-as-a-Service (RaaS), has intensified its global operations in 2025, targeting primarily the manufacturing, professional services, and wholesale trade sectors. The group employs a double-extortion strategy, combining file encryption with data exfiltration, leveraging tools such as Mimikatz, Cyberduck, and Cobalt Strike. Initial access is suspected via compromised credentials on exposed VPNs without MFA, followed by extensive reconnaissance, credential dumping, lateral movement, and deployment of dual encryptors to maximize impact.

3mo ago · Kaspersky-labs

In March 2025, Kaspersky identified a sophisticated cyber espionage campaign dubbed Operation ForumTroll, targeting Russian and Belarusian organizations via spear phishing emails with personalized links. The attack exploited a zero-day vulnerability in Google Chrome (CVE-2025-2783) to escape the browser sandbox, leveraging a logical flaw in Windows IPC handling of pseudo-handles. The threat actor used LeetAgent, a custom spyware, and was linked to the commercial Dante spyware developed by Memento Labs (formerly Hacking Team), indicating a well-resourced and persistent threat actor conducting long-term surveillance operations.

3mo ago · krebsonsecurity

The Aisuru botnet, initially known for launching massive DDoS attacks exceeding 30 terabits per second, has shifted its operations to support a residential proxy business by leveraging hundreds of thousands of compromised IoT devices. The botnet's operators have updated their malware to allow renting infected devices to proxy services, which are increasingly used for large-scale data scraping to feed AI training models. This shift has caused significant disruption to ISPs and raised concerns about abuse of residential proxies for cybercrime and unauthorized content scraping.

3mo ago · lab52

In August 2025, the Lazarus group conducted a targeted campaign using trojanized tools and DLL sideloading techniques as part of their DreamJob operations. The attackers deployed multiple variants of modular loaders, collectively termed 'DreamLoaders', including TSVIPSrv.dll and HideFirstLetter.dll, to execute malicious payloads and extract credentials. These loaders leveraged legitimate system binaries and encrypted resources to evade detection, while communicating with attacker-controlled SharePoint domains. The campaign demonstrates a high degree of code reuse and operational sophistication aimed at compromising organizational administrators.

3mo ago · security.com

Russian-linked attackers continue to target Ukrainian organizations with a focus on espionage and persistent access. The intrusions involved the use of webshells, living-off-the-land tactics, and minimal malware deployment to harvest credentials and sensitive data. Techniques included memory dumping, registry exfiltration, and disabling security tools, indicating a highly skilled and stealthy threat actor.

3mo ago · bleeping-computer

OnTrac, a U.S.-based parcel delivery company, disclosed a data breach that occurred between March 20 and 22, 2026, where attackers accessed customer data. The breach was detected on March 23, and the company engaged a third-party specialist to investigate. While the exact data compromised is redacted, the company offered credit monitoring services to affected customers. No ransomware group has claimed responsibility, and there is no evidence of data leakage or fraud at this time.

3mo ago · bleeping-computer

Hackers are hijacking hotel and conference center Wi-Fi DNS settings to redirect users to fake Microsoft 365 login pages, enabling theft of credentials and bypassing multi-factor authentication via OAuth token authorization. The campaign, active since at least June 2026, targets traveling employees across multiple sectors including finance, healthcare, and legal services. The attack technique resembles previous router-based campaigns linked to the APT28 group. Researchers observed malicious domains and attempted abuse of WPAD for traffic interception.

3mo ago · bleeping-computer

A threat actor leveraged the open-source Hermes AI agent in unattended 'YOLO' mode to automate post-exploitation activities during an alleged cyberattack on Thailand's Ministry of Finance. Evidence from exposed web directories indicates deployment of web shells, custom scripts, and a previously undocumented Go-based implant named Hades. The attackers targeted internal systems including Hadoop, Apache Ambari, GlassFish, and mail servers, using AI to perform privilege escalation, enumeration, and file traversal. While the Ministry has not confirmed a breach, artifacts suggest active intrusion and lateral movement within the network.

3mo ago · socket-dev

A malicious website at corepack[.]org impersonates the legitimate Corepack Node.js tool to distribute malware, targeting developers searching for the package after its removal from Node.js distributions. The site delivers an infostealer and enrolls victims in a proxyware network through a fake VPN installer, while a secondary path distributes adware and trojanized software. The operation leverages AI-generated content and deceptive infrastructure, indicating a low-effort, high-volume monetization scheme exploiting developer trust.

3mo ago · step-security

On July 24, 2026, a compromised PyPI package, mrmustard 0.7.4, was found to contain a credential-stealing payload that activates upon import. The attacker hijacked a maintainer's GitHub account, stole CI secrets to gain PyPI publishing rights, and uploaded the malicious version without modifying the public source repository. The payload exfiltrates SSH keys, cloud credentials (AWS, Kubernetes), and system information, while establishing multiple persistence mechanisms on the infected host.

3mo ago · hacker-news

A security researcher from XBOW discovered two critical vulnerabilities in Microsoft's Bing Images service that allowed remote command execution as SYSTEM on Windows and root on Linux servers by exploiting crafted SVG files. The flaws, tracked as CVE-2026-32194 and CVE-2026-32191, stemmed from improper handling of SVG image references that led to command injection via ImageMagick delegates. Microsoft patched the issues server-side before public disclosure, with no evidence of exploitation in the wild.

3mo ago · hacker-news

Researchers H0j3n and Aniq Fakhrul disclosed a working exploit named Certighost that enables low-privileged Active Directory users to impersonate a Domain Controller by obtaining a certificate via a vulnerable AD CS enrollment fallback mechanism. The exploit abuses improper validation of the chase target during certificate enrollment, allowing attackers to relay authentication and obtain a certificate for a Domain Controller. This can lead to privilege escalation via DCSync to extract sensitive account secrets such as krbtgt, even without administrator rights.

3mo ago · hacker-news

North Korean threat actor BlueNoroff is conducting targeted phishing campaigns using typosquatted Zoom and Microsoft Teams domains to deliver the ClickFix malware. The attackers hijack trusted Telegram accounts in the cryptocurrency space to distribute lures, enabling social engineering attacks that profile victims' cryptocurrency wallets before delivering malware. The phishing kit uses AI-generated headshots and real body movements from prior meetings to create convincing fake calls, and operators selectively target high-value individuals by fingerprinting browser wallets. The campaign demonstrates a self-propagating attack chain leveraging compromised identities and infrastructure for sustained operations.

3mo ago · bleeping-computer

Slopsquatting, Phantom Domains, and HalluSquatting represent a class of AI-driven attacks exploiting the predictability of hallucinated identifiers in AI coding agents. Attackers register these predicted names—such as fake package names, domains, or repositories—before they are requested, enabling malicious code delivery without phishing or credential theft. The core vulnerability lies in agents automatically fetching and executing unverified resources, creating scalable attack vectors for botnet-style compromise. This pattern highlights a systemic design flaw in late binding of untrusted AI-generated outputs.

3mo ago · bleeping-computer

Chick-fil-A confirmed a data breach affecting over 13,000 customers due to credential stuffing attacks on its website and mobile app between June 17 and June 19, 2026. Attackers used credentials obtained from third-party sources to gain unauthorized access to Chick-fil-A One loyalty accounts. Compromised data includes names, email addresses, membership numbers, partial payment details, and potentially birth dates, phone numbers, and addresses.

3mo ago · bleeping-computer

A massive Microsoft 365 and Azure outage occurred on July 23, 2026, beginning at 10:44 AM ET, primarily affecting services in the West US Azure region. The incident was caused by a bug in Microsoft's automated network maintenance system that incorrectly removed IP routes from more devices than intended, disrupting connectivity. Services including SharePoint, OneDrive, Teams, Power BI, and Microsoft Defender were impacted, with traffic rerouting and recovery efforts completed by 2:26 PM ET. Microsoft confirmed resolution of the incident and is conducting a full internal review of its maintenance processes.

3mo ago · hacker-news

The Golden Chickens threat actor, tracked as TAG-195, has resurged with four new malware families: TinyEgg, ChonkyChicken, a modular variant of ChonkyChicken, and ChromEggscalator. These tools represent an evolution toward modular, operator-driven malware architectures designed for defense evasion and flexible post-compromise operations. The group uses ClickFix-style social engineering to deploy payloads, establishing persistent access and enabling browser theft, surveillance, and remote execution. The malware communicates via WebSockets to C2 servers and leverages shared infrastructure and techniques across families.