LATEST

Aggregated cybersecurity reporting, advisories and research. 326 matching records.

AUTO-POLL // 2026-10-18 04:40 UTC

CYBER INTEL TEMPERATURE

TODAY'S AGGREGATED INTELLIGENCE

NO DATA

NO INTELLIGENCE AGGREGATED TODAY

7-DAY C.I.T. REPORT

CYBER CONDITIONS // DAILY C.I.T. READINGS

TODAY → 6 DAYS AGO

TODAY

Oct 18

NO DATA

NO INTEL

SAT

Oct 17

ACTIVE EXPLOITATION

COOL // 12 ARTICLES

FRI

Oct 16

RANSOMWARE

COOL // 56 ARTICLES

THU

Oct 15

ACTIVE EXPLOITATION

COOL // 87 ARTICLES

WED

Oct 14

RANSOMWARE

COOL // 74 ARTICLES

TUE

Oct 13

ACTIVE EXPLOITATION

COOL // 73 ARTICLES

MON

Oct 12

RANSOMWARE

COOL // 42 ARTICLES

C.I.T. = Cyber Intel Temperature // Cyber Conditions describe notable activity observed in that day's aggregated intelligence.

RESET

2026-09-01 07:22 UTC
Security Journalism

Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-01 08:00 UTC

Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck. The vulnerabilities in question are listed below - CVE-2026-0768 (CVSS score: 9.8) - A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of the root user. CVE-2026-66066 aka

Cloud Security Threat Actors Vulnerabilities CVE-2026-0768 CVE-2026-66066

P15

2026-09-01 04:00 UTC
Security Journalism

RMM Tools for MSPs: Features, Risks & How to Stay Secure

Huntress · indexed 2026-09-07 17:30 UTC

Four years after the Kaseya supply chain attack, a recent incident shows how threat actors still successfully target MSPs’ downstream customers through RMM software.

Threat Actors

2026-08-31 21:08 UTC
Security Journalism

Anthropic Users Hit by Infostealer Attacks, Session Thefts

Dark Reading · Jai Vijayan · indexed 2026-08-31 21:35 UTC

A threat actor used a variety of infostealers to collect session information and access Claude accounts belonging to an unknown number of users.

Malware Threat Actors

2026-08-31 17:24 UTC
Security Journalism

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-08-31 18:05 UTC

Threat actors with ties to the Democratic People's Republic of Korea (aka DPRK or North Korea) have been observed seeking job opportunities beyond the information technology (IT) sector, with recent investigations identifying suspected workers employed in sales and marketing and the medical profession. The ongoing insider threat is part of what has been described as the IT worker scheme,

Cybercrime DFIR Threat Actors

2026-08-31 12:14 UTC
Security Journalism

ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-08-31 12:30 UTC

The threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application, running the malware under a trusted process to slip past users who add such software to their antivirus exclusions. Russian cybersecurity vendor Kaspersky said the attackers built the disguise around QN Wallpaper, a genuine Chinese desktop-wallpaper tool

Malware Threat Actors

2026-08-31 11:47 UTC
Security Journalism

Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-08-31 12:30 UTC

Threat actors associated with Aurora (aka Aur0ra) ransomware have been observed using SpaceX's artificial intelligence (AI)-powered coding assistant Cursor to break into target networks, according to findings from CloudSEK and Gambit Security. The two independent analyses are based on exposed infrastructure associated with the Russian-speaking cybercrime group, leading to the discovery of its

AI Security Cybercrime Ransomware Threat Actors

P15

2026-08-31 07:56 UTC
Security Journalism

DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-08-31 08:40 UTC

The U.S. Department of Justice (DoJ) on Friday corrected a previously issued press statement that several of its agencies were victims of attacks carried out by Chinese threat actors, instead now pointing out that they were among those targeted. Last week, the DoJ said the National Aeronautics and Space Administration, Federal Reserve, Department of Energy, Department of Justice, Department

Law Enforcement Threat Actors

2026-08-28 15:56 UTC
Security Journalism

ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-08-28 18:30 UTC

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities (KEV) catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in the Philippines. The vulnerability, tracked as CVE-2023-49105 (CVSS score: 9.8), is a case of

Threat Actors Vulnerabilities CVE-2023-49105

P35

2026-08-27 13:51 UTC
Vendor Research

Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs

Rapid7 · Alexandra Blia · indexed 2026-08-27 14:25 UTC

IntroductionDespite modern verification controls, identity theft remains one of the most pervasive threats to both individuals and enterprise organizations. U.S. Federal Trade Commission statistics show over 1 million identity theft reports annually, with related fraud and imposter scams accounting for billions in financial losses each year. While stolen credit cards enable rapid, short-term monetization, Social Security numbers (SSNs) represent a far more permanent and dangerous tier within th…

APT / Nation-State Cybercrime Data Breaches Malware Microsoft Phishing Threat Actors

2026-08-27 09:33 UTC
Security Journalism

GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-08-27 10:15 UTC

Threat actors linked by Arctic Wolf to Dark Caracal with medium confidence deployed a previously undocumented Go-based malware framework, GoCaracal, during a June 2026 intrusion at an unnamed communications organization in Venezuela. GoCaracal provides operators with remote shell access and payload execution, while the extended profile adds browser data theft, keylogging, remote desktop control

Malware Threat Actors

2026-08-27 04:00 UTC
Security Journalism

The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms

Huntress · indexed 2026-09-07 17:30 UTC

Threat actors are targeting the AI attack surface to deliver malware and steal data. See how trusted AI tools are being exploited today.

Malware Threat Actors

2026-08-26 17:33 UTC
Security Journalism

Android Malware Hijacks Update System for Car Head Units

Dark Reading · Rob Wright · indexed 2026-08-26 18:50 UTC

Threat actors behind a notorious click-fraud botnet have set their sights on vehicle infotainment modules and are abusing legitimate functionality to spread infections.

Cybercrime Malware Mobile Security Threat Actors

2026-08-26 16:42 UTC
Security Journalism

FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-08-26 17:50 UTC

The U.S. Department of Justice (DoJ) on Wednesday announced the disruption of two hacking platforms named QScan and QTRouter operated by Chinese threat actors to target critical infrastructure and other sensitive networks in the country. The activity has been attributed to a Chinese state-sponsored group known as QTFY, employed by Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司).&

APT / Nation-State Law Enforcement Network Security Threat Actors

2026-08-26 13:17 UTC
Security Journalism

Ubiquiti patches three max severity security vulnerabilities

BleepingComputer · Sergiu Gatlan · indexed 2026-08-26 13:20 UTC

Ubiquiti has released security patches for three new maximum-severity vulnerabilities that threat actors can exploit remotely without privileges. [...]

Threat Actors

2026-08-26 09:00 UTC
Vendor Research

Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter

Tenable Cyber Exposure Alerts · Research Special Operations · indexed 2026-08-26 13:15 UTC

A joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs reveals that both state-sponsored actors and cybercriminals independently converge on the same edge infrastructure. Special thanks to SentinelOne® Incident Readiness & Response for their contributions to this publication.It is the shared attack surface where state-sponsored threat actors and financially motivated criminal groups independently converge — not the province of a single adversary category, and not exclusively a n…

APT / Nation-State Data Breaches DFIR Microsoft Network Security Phishing Ransomware Threat Actors Threat Intelligence Vulnerabilities

P45

2026-08-25 21:39 UTC
Security Journalism

Hackers abuse npm mirrors to host phishing redirect pages

BleepingComputer · Lawrence Abrams · indexed 2026-08-25 21:40 UTC

Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites. [...]

Phishing Threat Actors

2026-08-25 12:04 UTC
Security Journalism

Hackers breached over 270 Zimbra servers in ongoing attacks

BleepingComputer · Sergiu Gatlan · indexed 2026-08-25 12:10 UTC

Threat actors have already compromised over 270 Zimbra instances in remote code execution attacks targeting a high-severity Zimbra Collaboration Suite (ZCS) vulnerability. [...]

Threat Actors Vulnerabilities

P15

2026-08-25 11:52 UTC
Security Journalism

24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-08-25 12:45 UTC

Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAPTCHA pages. "While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn't do harm, the threat actor’s use of npm isn't to infect developers who install it, but to use the

Malware Phishing Security Research Threat Actors

2026-08-25 11:33 UTC
Security Journalism

E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-08-25 12:45 UTC

Cybersecurity researchers are calling attention to a new campaign that employs FTP banners as dead drop resolvers (DDRs) to deliver two previously unreported remote access trojans (RATs) tracked as E4del and PINHOLE. While threat actors are known to abuse legitimate services to point to additional command-and-control (C2) infrastructure and blend in with regular network traffic, the development

Malware Security Research Threat Actors

2026-08-24 11:51 UTC
Security Journalism

Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-08-24 12:10 UTC

Cybersecurity researchers have flagged a cyber espionage campaign targeting Myanmar that uses graduation ceremony invitation lures to deliver a Go backdoor called QUICAgent. The campaign, codenamed Operation QUICSILVER, has been found to target government and information technology sectors, per Seqrite Labs. The activity is assessed to be the work of a China-nexus threat actor with moderate

APT / Nation-State Malware Security Research Threat Actors

2026-08-22 07:17 UTC
Other

U.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog

Security Affairs · Pierluigi Paganini · indexed 2026-08-22 08:20 UTC

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Zimbra Collaboration Suite (ZCS) flaw CVE-2026-73570 to its Known Exploited Vulnerabilities (KEV) catalog. CERT Polska, Poland’s national computer emergency response team, confirmed this week that threat actors […]

Threat Actors Vulnerabilities CVE-2026-73570

P35

2026-08-21 11:11 UTC
Other

Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics

Security Affairs · Pierluigi Paganini · indexed 2026-08-21 11:40 UTC

Google tracks three Russia-linked espionage clusters using phishing and legitimate authentication tools to target researchers, diplomats and defense staff. Google’s Threat Intelligence Group tracked three separate suspected Russia-linked cyber espionage clusters. All three focus on the same thing: abusing authentication features that are supposed to protect accounts to access them instead. Threat actors target researchers, […]

APT / Nation-State Phishing Threat Actors Threat Intelligence

2026-08-21 11:00 UTC
Security Journalism

Hackers abuse FTP server banners to deliver new Windows malware

BleepingComputer · Bill Toulas · indexed 2026-08-21 11:10 UTC

Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans named E4del and PINHOLE. [...]

Malware Microsoft Threat Actors

2026-08-21 09:14 UTC
Other

Poland’s CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw

Security Affairs · Pierluigi Paganini · indexed 2026-08-21 09:40 UTC

CERT Polska confirmed active exploitation of CVE-2026-73570, a critical unauthenticated RCE in Zimbra Collaboration Suite patched on July 20. CERT Polska, Poland’s national computer emergency response team, confirmed this week that threat actors are actively exploiting a critical vulnerability in Zimbra Collaboration Suite tracked as CVE-2026-73570. The flaw allows unauthenticated remote code execution and was […]

Threat Actors Vulnerabilities CVE-2026-73570

P30

2026-08-20 14:59 UTC
Security Journalism

Pakistan's Transparent Tribe Refreshes Toolset for Afghan Cyberattacks

Dark Reading · Nate Nelson · indexed 2026-08-20 14:35 UTC

A nation-state threat actor is picking on immature organizations run by the Taliban, but failing against more prepared government agencies in India.

APT / Nation-State Threat Actors

2026-08-20 11:06 UTC
Security Journalism

CISA warns of hackers exploiting critical MLflow vulnerability

BleepingComputer · Sergiu Gatlan · indexed 2026-08-20 11:15 UTC

The Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that threat actors are now exploiting a critical vulnerability in the MLflow open-source AI engineering platform. [...]

Threat Actors Vulnerabilities

P10

2026-08-20 10:01 UTC
Vendor Research

Frequently asked questions about the active threat to Siemens S7 Series PLCs

Tenable Cyber Exposure Alerts · Research Special Operations · indexed 2026-08-20 14:10 UTC

A joint cybersecurity advisory released by multiple U.S. government agencies warns that threat actors are using AI-generated exploitation scripts to target exposed Siemens S7 Series PLCs across critical infrastructure sectors.Key TakeawaysUnattributed threat actors are exploiting known weaknesses and unnecessary internet exposure to conduct reconnaissance and possible pre-positioning for future disruptive attacks against Siemens S7 Series PLCs.The attackers are leveraging AI to build and refine…

DFIR ICS / OT Law Enforcement Microsoft Threat Actors Vulnerabilities

P25

2026-08-19 17:50 UTC
Security Journalism

US warns of AI-powered attacks on Siemens PLCs in critical infrastructure

BleepingComputer · Lawrence Abrams · indexed 2026-08-19 17:55 UTC

U.S. cybersecurity agencies warn that threat actors are using AI-generated scripts to exploit Siemens S7 Series programmable logic controllers (PLCs) in U.S. critical infrastructure. [...]

Threat Actors

2026-08-19 16:46 UTC
Vendor Research

CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway

Rapid7 · Rapid7 · indexed 2026-08-19 17:30 UTC

OverviewOn August 19, 2026, a security advisory was published for CVE-2026-19490, a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. The vulnerability carries a CVSS v4.0 base score of 9.3 and can be exploited remotely by an unauthenticated attacker over the network without user interaction or elevated privileges.NetScaler ADC and NetScaler Gateway are widely deployed enterprise networking products commonly positioned at or near the network peri…

Network Security Threat Actors Vulnerabilities CVE-2026-19490

P65

2026-08-17 19:35 UTC
Security Journalism

Hacker claims 3.6 million Azure account records stolen from major companies

BleepingComputer · Ionut Ilascu · indexed 2026-08-17 19:45 UTC

A threat actor is selling employee databases allegedly stolen from the Microsoft Azure infrastructure of multiple Fortune 500 companies after gaining access using compromised credentials. [...]

Cloud Security Microsoft Threat Actors