LATEST

Aggregated cybersecurity reporting, advisories and research. 326 matching records.

AUTO-POLL // 2026-10-18 05:35 UTC

CYBER INTEL TEMPERATURE

TODAY'S AGGREGATED INTELLIGENCE

NO DATA

NO INTELLIGENCE AGGREGATED TODAY

7-DAY C.I.T. REPORT

CYBER CONDITIONS // DAILY C.I.T. READINGS

TODAY → 6 DAYS AGO

TODAY

Oct 18

NO DATA

NO INTEL

SAT

Oct 17

ACTIVE EXPLOITATION

COOL // 12 ARTICLES

FRI

Oct 16

RANSOMWARE

COOL // 56 ARTICLES

THU

Oct 15

ACTIVE EXPLOITATION

COOL // 87 ARTICLES

WED

Oct 14

RANSOMWARE

COOL // 74 ARTICLES

TUE

Oct 13

ACTIVE EXPLOITATION

COOL // 73 ARTICLES

MON

Oct 12

RANSOMWARE

COOL // 42 ARTICLES

C.I.T. = Cyber Intel Temperature // Cyber Conditions describe notable activity observed in that day's aggregated intelligence.

RESET

2026-05-15 14:00 UTC
Vendor Research

Welcome to BlackFile: Inside a Vishing Extortion Operation

Google Threat Intelligence / Mandiant · Google Threat Intelligence Group · indexed 2026-08-15 18:55 UTC

Written by: Austin Larsen, Tyler McLellan, Genevieve Stark, Dan Ebreo Introduction Google Threat Intelligence Group (GTIG) has continued to track an expansive extortion campaign by UNC6671, a threat actor operating under the "BlackFile" brand, that targets organizations via sophisticated voice phishing (vishing) and single sign-on (SSO) compromise. By leveraging adversary-in-the-middle (AiTM) techniques to bypass traditional perimeter defenses and multi-factor authentication (MFA), UNC6671 gain…

Data Breaches Microsoft Network Security Phishing Threat Actors Threat Intelligence Vulnerabilities

2026-05-11 14:00 UTC
Vendor Research

GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access

Google Threat Intelligence / Mandiant · Google Threat Intelligence Group · indexed 2026-08-15 18:55 UTC

Executive Summary Since our February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has continued to track a maturing transition from nascent AI-enabled operations to the industrial-scale application of generative models within adversarial workflows. This report, based on insights derived from Mandiant incident response engagements, Gemini, and GTIG’s proactive research, highlights the dual nature of the current threat environment where AI serves as both a so…

AI Security Apple APT / Nation-State Cloud Security DFIR Malware Microsoft Network Security Ransomware Security Research Threat Actors Threat Intelligence Vulnerabilities

P60

2026-05-07 23:00 UTC
Security Journalism

Threat Actors Weaponize Tiflux RMMs in Malspam Attacks

Huntress · indexed 2026-09-07 17:30 UTC

We dug into a recent malspam campaign that involved an installer for a commercially sold remote monitoring and management (RMM) tool called Tiflux.

Threat Actors

2026-05-06 08:07 UTC
Other

The Architecture of Deception: How a $187 Million Fraud Ecosystem Exploits Trust Across Australia and the United States

Group-IB · indexed 2026-09-07 17:30 UTC

This blog examines how threat actors use deepfake impersonation and social media to manipulate real stocks, how a network of 208 connected fake investment platforms steals millions in cryptocurrency, and what a new approach to defence can do about it.

Cybercrime Threat Actors

2026-04-30 00:00 UTC
Security Journalism

Komari Red: The Monitoring Tool with a Built-in Reverse Shell

Huntress · indexed 2026-09-07 17:30 UTC

Huntress found threat actors using the Komari monitoring agent as a SYSTEM-level backdoor. Learn how they abused GitHub and what defenders should hunt for.

Malware Microsoft Threat Actors

2026-04-23 21:38 UTC
Vendor Research

AI threats in the wild: The current state of prompt injections on the web

Google Online Security Blog · Kimberly Samra · indexed 2026-08-15 14:33 UTC

Posted by Thomas Brunner, Yu-Han Liu, Moni PandeAt Google, our Threat Intelligence teams are dedicated to staying ahead of real-world adversarial activity, proactively monitoring emerging threats before they can impact users. Right now, Indirect Prompt Injection (IPI) is a top priority for the security community, anticipating it as a primary attack vector for adversaries to target and compromise AI agents. But while the danger of IPI is widely discussed, are threat actors actually exploiting th…

AI Security Microsoft Security Research Threat Actors Threat Intelligence

P20

2026-04-23 14:00 UTC
Vendor Research

Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite

Google Threat Intelligence / Mandiant · Mandiant · indexed 2026-08-15 18:55 UTC

Written by: JP Glab, Tufail Ahmed, Josh Kelley, Muhammad Umair Introduction Google Threat Intelligence Group (GTIG) identified a multistage intrusion campaign by a newly tracked threat group, UNC6692, that leveraged persistent social engineering, a custom modular malware suite, and deft pivoting inside the victim’s environment to achieve deep network penetration. As with many other intrusions in recent years, UNC6692 relied heavily on impersonating IT helpdesk employees, convincing their victim…

Cloud Security Malware Microsoft Phishing Threat Actors Threat Intelligence

2026-04-17 14:00 UTC
Security Journalism

Disrupting Attacks on Endpoints | Attack Disruption Engine

Huntress · indexed 2026-09-07 17:30 UTC

Standard EDR creates a gap between detection and action. Huntress closes it. Learn how our Attack Disruption Engine automatically disrupts threat actors and reduces the impact of endpoint attacks.

Threat Actors

2026-04-16 14:00 UTC
Vendor Research

Defending Your Enterprise When AI Models Can Find Vulnerabilities Faster Than Ever

Google Threat Intelligence / Mandiant · Francis deSouza · indexed 2026-08-15 18:55 UTC

Introduction Advances in AI model-powered exploitation have demonstrated that general-purpose AI models can excel at vulnerability discovery, even without being purpose-built for the task. Eventually, capabilities such as these will be integrated directly into the development cycle, and code will be more difficult to exploit than ever; however, this transition creates a critical window of risk. As we harden existing software with AI, threat actors will use it to discover and exploit novel vulne…

AI Security APT / Nation-State Cloud Security DFIR Microsoft Ransomware Threat Actors Vulnerabilities

P60

2026-04-15 14:00 UTC
Vendor Research

The German Cyber Criminal Überfall: Shifts in Europe's Data Leak Landscape

Google Threat Intelligence / Mandiant · Google Threat Intelligence Group · indexed 2026-08-15 18:55 UTC

Written by: Jamie Collier, Robin Grunewald Germany has reclaimed its position as a primary focus for cyber extortion in Europe. While data leak site (DLS) posts rose almost 50% globally in 2025, Google Threat Intelligence (GTI) data shows that the surge is hitting German infrastructure harder and faster than its regional neighbors, marking a significant return to the high-pressure levels previously observed in the country during 2022 and 2023. Cyber Criminals Pivoting Back to Germany Germany mo…

Cybercrime Data Breaches Ransomware Threat Actors Threat Intelligence

P15

2026-04-09 17:07 UTC
Vendor Research

Protecting Cookies with Device Bound Session Credentials

Google Online Security Blog · Google · indexed 2026-08-15 14:33 UTC

Posted by Ben Ackerman, Chrome team, Daniel Rubery, Chrome team and Guillaume Ehinger, Google Account Security team Following our April 2024 announcement, Device Bound Session Credentials (DBSC) is now entering public availability for Windows users on Chrome 146, and expanding to macOS in an upcoming Chrome release. This project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape. Session theft t…

Apple Cybercrime Malware Microsoft Threat Actors

2026-04-08 14:00 UTC
Security Journalism

The ADWS Architecture That Hides PowerShell AD Enumeration

Huntress · indexed 2026-09-07 17:30 UTC

A threat actor enumerated our entire AD with Get-ADComputer, and none of our detections fired. The problem wasn't their evasion - it was an architectural blind spot in how PowerShell talks to Active Directory.

Threat Actors

2026-04-08 07:30 UTC
Other

Cyber Saga: In the Footsteps of the DPRK IT Workers

Group-IB · indexed 2026-09-07 17:30 UTC

Discover how North Korean threat actors use synthetic identities, AI-assisted workflows, and overlapping infrastructure to infiltrate companies, and learn actionable strategies to mitigate this insider threat.

Threat Actors

2026-04-07 09:00 UTC
Other

As breakout time accelerates, prevention-first cybersecurity takes center stage

ESET · indexed 2026-09-07 17:30 UTC

Threat actors are using AI to supercharge tried-and-tested TTPs. When attacks move this fast, cyber-defenders need to rethink their own strategy.

Microsoft Threat Actors Threat Intelligence

2026-04-01 10:32 UTC
Other

Hooking the Archipelago: Dissecting a Phishing Campaign Targeting Philippine Banking Users

Group-IB · indexed 2026-09-07 17:30 UTC

Group-IB researchers uncover an ongoing phishing campaign targeting major banks in the Philippines. This blog details how threat actors abuse trusted and legitimate platforms to deceive users and evade detection. It highlights a significant threat escalation with the successful hijacking of a legitimate domain to host malicious infrastructure, enabling threat actors to operate with even greater credibility and reduced detection.

Phishing Threat Actors

2026-03-23 21:00 UTC
Security Journalism

Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure

Huntress · indexed 2026-09-07 17:30 UTC

Railway PaaS is being weaponized as a clean token replay engine in an active AiTM and device code phishing campaign impacting 268+ M365 organizations and 100+ MSPs.

Microsoft Phishing Threat Actors

2026-03-12 14:00 UTC
Security Journalism

Data Exfiltration and Threat Actor Infrastructure Exposed

Huntress · indexed 2026-09-07 17:30 UTC

Threat actors are people, too, and like everyone else, make mistakes. These mistakes can reveal insights into the threat actor, or even expose access to their infrastructure.

Threat Actors

2026-03-11 14:00 UTC
Security Journalism

How Threat Actors Abuse Remote Management Tools | Huntress

Huntress · indexed 2026-09-07 17:30 UTC

The abuse of remote monitoring and management (RMM) tools is surging. See how threat actors daisy chain RMM software for initial access, persistence, and detection evasion.

Threat Actors

2026-03-06 21:00 UTC
Security Journalism

A Threat Actor Abuses Another Free Trial

Huntress · indexed 2026-09-07 17:30 UTC

A deep dive into a threat actor who exploited SolarWinds Web Help Desk, abused an Elastic Cloud SIEM free trial for exfiltration and triage, revealing key infrastructure.

Threat Actors

2026-03-04 10:00 UTC
Other

Protecting education: How MDR can tip the balance in favor of schools

ESET · indexed 2026-09-07 17:30 UTC

The education sector is notoriously short on cash, but rich in assets for threat actors to target. How can managed detection and response (MDR) help learning institutions regain the initiative?

Threat Actors

2026-02-28 10:00 UTC
Other

This month in security with Tony Anscombe – February 2026 edition

ESET · indexed 2026-09-07 17:30 UTC

In this roundup, Tony looks at how opportunistic threat actors are taking advantage of weak authentication, unmanaged exposure, and popular AI tools

Threat Actors

2026-01-16 10:00 UTC
Other

Why LinkedIn is a hunting ground for threat actors – and how to protect yourself

ESET · indexed 2026-09-07 17:30 UTC

The business social networking site is a vast, publicly accessible database of corporate information. Don’t believe everyone on the site is who they say they are.

Threat Actors

2026-01-15 06:07 UTC
Other

DeadLock Ransomware: Smart Contracts for Malicious Purposes

Group-IB · indexed 2026-09-07 17:30 UTC

This blog uncovers DeadLock’s stealthy usage of Polygon smart contracts for proxy address storage, a poorly-documented and under-reported technique that Group-IB analysts have observed increased usage in the wild. Variants of this technique are very wide and offer great alternatives to threat actors for bypassing traditional defenses by abusing decentralized blockchains available worldwide.

Microsoft Ransomware Threat Actors

P35

2025-12-22 05:00 UTC
Security Journalism

Trial, Error & Typos: Malware Isn't Always 'Sophisticated' | Huntress

Huntress · indexed 2026-09-07 17:30 UTC

Think all threat actors are pros? This post reveals how 'unsophisticated' malware and attacker errors help defenders stop attacks before damage is done.

Malware Microsoft Threat Actors

2025-12-18 23:00 UTC
Security Journalism

Gladinet CentreStack/Triofox: Cryptography Vulnerability | Huntress

Huntress · indexed 2026-09-07 17:30 UTC

Threat actors are exploiting a vulnerability in Gladinet’s CentreStack and Triofox products that stems from hardcoded cryptographic keys in the AES implementation.

Threat Actors Vulnerabilities

2025-12-18 08:00 UTC
Security Journalism

A Series of Unfortunate (RMM) Events

Huntress · indexed 2026-09-07 17:30 UTC

Recently, the Huntress SOC has observed threat actors increasingly use PDQ and GoTo Resolve to deploy further remote monitoring and management (RMM) tools in attacks.

Threat Actors

2025-12-10 05:00 UTC
Security Journalism

PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182

Huntress · indexed 2026-09-07 17:30 UTC

Huntress is seeing threat actors exploit React2Shell (CVE-2025-55182) to deploy a Linux backdoor, a reverse proxy tunnel, and a Go-based post-exploitation implant.

Linux Malware Threat Actors Vulnerabilities CVE-2025-55182

2025-12-03 05:00 UTC
Security Journalism

Velociraptor Misuse, Pt. II: The Eye of the Storm

Huntress · indexed 2026-09-07 17:30 UTC

Huntress reports an uptick in threat actors abusing the Velociraptor open-source DFIR tool, linked to incidents involving WSUS exploitation, VS Code tunnels, and more.

DFIR Threat Actors

2025-11-24 06:00 UTC
Security Journalism

ClickFix Gets Creative: Malware Buried in Images

Huntress · indexed 2026-09-07 17:30 UTC

Huntress uncovered an attack utilizing a ClickFix lure to initiate a multi-stage malware execution chain. This analysis reveals how threat actors use steganography to conceal infostealers like LummaC2 and Rhadamanthys within seemingly harmless PNGs.

Malware Threat Actors

2025-11-20 15:00 UTC
Security Journalism

Velociraptor WSUS Exploitation, Pt. I: WSUS-Up?

Huntress · indexed 2026-09-07 17:30 UTC

Huntress has seen an uptick in threat actors abusing the Velociraptor open-source DFIR tool in a range of attacks, including a recent incident involving WSUS exploitation.

DFIR Threat Actors