LATEST

Aggregated cybersecurity reporting, advisories and research. 305 matching records.

AUTO-POLL // 2026-10-09 21:40 UTC

CYBER INTEL TEMPERATURE

TODAY'S AGGREGATED INTELLIGENCE

COOL

COOL WARM ELEVATED HOT CRITICAL

P5 / P100

7-DAY C.I.T. REPORT

CYBER CONDITIONS // DAILY C.I.T. READINGS

TODAY → 6 DAYS AGO

TODAY

Oct 9

RANSOMWARE

COOL // 62 ARTICLES

THU

Oct 8

RANSOMWARE

COOL // 62 ARTICLES

WED

Oct 7

RANSOMWARE

COOL // 86 ARTICLES

TUE

Oct 6

RANSOMWARE

COOL // 61 ARTICLES

MON

Oct 5

RANSOMWARE

COOL // 48 ARTICLES

SUN

Oct 4

RANSOMWARE

P10

WARM // 11 ARTICLES

SAT

Oct 3

RANSOMWARE

COOL // 14 ARTICLES

C.I.T. = Cyber Intel Temperature // Cyber Conditions describe notable activity observed in that day's aggregated intelligence.

RESET

2026-09-21 08:39 UTC
Security Journalism

ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-21 08:45 UTC

Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. "ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint Adversary Pursuit Group (APG)

Malware Microsoft Threat Actors

2026-09-21 06:06 UTC
Security Journalism

Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-21 06:15 UTC

The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based "much smaller organization" in the information technology (IT) services industry, once again highlighting how the adversary continues to target developers to breach target networks. Cybersecurity company SentinelOne, which disclosed details of the activity, said it involved the use of Apple

Apple Malware Threat Actors

2026-09-20 14:11 UTC
Security Journalism

Malicious npm packages evade install-script defenses at runtime

BleepingComputer · Bill Toulas · indexed 2026-09-20 14:20 UTC

An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts. [...]

Malware Threat Actors

2026-09-18 09:18 UTC
Security Journalism

Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-18 09:30 UTC

A financially motivated threat actor has been linked to the development and distribution of a JavaScript (JS)-based information stealer known as PhantomRaven via the npm package registry. "The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns,"

AI Security Malware Threat Actors

2026-09-18 07:00 UTC
Security Journalism

AI Agent Breaches Spanish Organization, Modifies Personal Data

Dark Reading · Nate Nelson · indexed 2026-09-18 07:10 UTC

AI-driven cyberattacks used to be exotic. Soon, it'll be odd if threat actors aren't using agents to do all of their bidding.

AI Security Threat Actors

2026-09-18 06:17 UTC
Security Journalism

RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-18 06:30 UTC

Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices. "Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses

AI Security Malware Mobile Security Phishing Security Research Threat Actors

2026-09-17 10:05 UTC
Security Journalism

China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-17 13:45 UTC

The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025. "SparroWocky is a modular, C++ backdoor," ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker News

APT / Nation-State Malware Security Research Threat Actors

2026-09-17 07:20 UTC
Other

HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack

Group-IB · indexed 2026-09-17 08:35 UTC

Group-IB Threat Intelligence analyzes HEAVYGRAM, a Telegram-based Windows backdoor attributed with moderate confidence to the Iran-linked threat actor Handala Hack. Active since Fall 2023, it has been used to surveil Iranian dissidents, journalists and government opponents, enabling remote command execution, data exfiltration, and persistence over Telegram command-and-control.

Malware Microsoft Threat Actors Threat Intelligence

2026-09-16 15:27 UTC
Security Journalism

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-16 16:25 UTC

Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy Ghouls, according to multiple reports from Kaspersky. The cybersecurity vendor said it has identified attacks mounted by NightEagle (aka APT-Q-95), a threat actor known to be active since at least 2023, that involve new techniques for persistence and lateral movement.

APT / Nation-State Malware Ransomware Threat Actors

P15

2026-09-16 13:09 UTC
Other

Revolut Data Leak May Trace Back to Compromised Italian Government Accounts

Security Affairs · Pierluigi Paganini · indexed 2026-09-16 14:15 UTC

A suspected compromise of an Italian government PEC account may have allowed threat actors to impersonate law enforcement and obtain sensitive data from hundreds of Revolut customers. The Revolut data exposure may be part of a much broader cyber incident involving compromised Italian government infrastructure. Revolut has confirmed that its systems were not breached. Instead, […]

Data Breaches Threat Actors

2026-09-16 11:58 UTC
Security Journalism

N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-16 12:45 UTC

N0va is targeting organizations across North America and Europe with phishing campaigns that impersonate trusted services and abuse legitimate authentication flows. Successful attacks can give threat actors access to valid accounts without relying on obvious malware activity. From there, a single compromised identity can open the door to sensitive data, business systems, and additional cloud

Malware Phishing Threat Actors

2026-09-16 05:48 UTC
Security Journalism

Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-16 06:40 UTC

Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution," Wordfence said. The WordPress security company said it has blocked over

Malware Threat Actors Vulnerabilities

P15

2026-09-15 20:34 UTC
Security Journalism

Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites

BleepingComputer · Bill Toulas · indexed 2026-09-15 20:35 UTC

Malicious versions of the Admin Menu Editor Pro plugin for WordPress have been distributed to more than 200 customers after a threat actor compromised the maintainer's website and pushed updates that created a hidden user account. [...]

Malware Threat Actors

2026-09-15 18:54 UTC
Security Journalism

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-15 19:10 UTC

Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on Google Chrome and

Malware Security Research Threat Actors

2026-09-15 12:22 UTC
Vendor Research

CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild

Rapid7 · Rapid7 · indexed 2026-09-15 12:55 UTC

OverviewOn September 14, 2026, Cisco published a security advisory for CVE-2026-76461, a critical SQL injection vulnerability affecting Cisco AsyncOS Software for Cisco Secure Email Gateway. The vulnerability has a reported CVSS v3.1 base score of 9.8 and could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on an affected appliance.Cisco Secure Email Gateway, formerly known as IronPort Email Security Appliance, is an enterprise email security produc…

Malware Phishing Threat Actors Vulnerabilities CVE-2026-76461

P80

2026-09-15 11:52 UTC
Security Journalism

Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-15 12:25 UTC

With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access. In one instance highlighted by the cloud security company, the threat actor pivoted from a vulnerable Marimo notebook to an SSH

AI Security Cloud Security Threat Actors Vulnerabilities

2026-09-15 10:17 UTC
Other

One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire

Security Affairs · Pierluigi Paganini · indexed 2026-09-15 11:30 UTC

Two China-linked groups ran identical Chrome/Windows zero-day exploits against NGOs, before Chrome’s patch shipped, deploying different backdoors each. Two China-linked threat actors used the same Chrome/Windows zero-day against NGOs starting September 1, 2026, Volexity’s new report lays out the whole chain in detail. On September 1, Volexity detected a spear-phishing campaign by UTA0560 targeting several […]

APT / Nation-State Malware Microsoft Phishing Threat Actors Vulnerabilities

P25

2026-09-15 07:31 UTC
Security Journalism

Cisco patches Secure Email Gateway zero-day exploited in attacks

BleepingComputer · Sergiu Gatlan · indexed 2026-09-15 07:35 UTC

Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. [...]

Threat Actors Vulnerabilities

P45

2026-09-15 05:31 UTC
Security Journalism

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-15 06:25 UTC

A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE. Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026. "The

Cloud Security Malware Microsoft Phishing Threat Actors Vulnerabilities

P25

2026-09-14 19:40 UTC
Security Journalism

Members of ‘Black Axe’ cybercriminal group extradited from South Africa

The Record · indexed 2026-09-14 20:00 UTC

Prosecutors unsealed a 2021 indictment accusing the five men of conducting lucrative romance scams that stole thousands of dollars from more than 100 people.

Threat Actors

2026-09-14 16:56 UTC
Security Journalism

Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-14 17:30 UTC

A suspected Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign. "Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems," Acronis Threat Research Unit (TRU)

Threat Actors Vulnerabilities

P15

2026-09-14 08:48 UTC
Security Journalism

Revolut discloses data breach exposing financial info, passports

BleepingComputer · Sergiu Gatlan · indexed 2026-09-14 08:55 UTC

Fintech company Revolut has disclosed a data breach after sharing data from an undisclosed number of customers with a threat actor impersonating a government agency. [...]

Data Breaches Threat Actors

2026-09-13 14:26 UTC
Security Journalism

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

BleepingComputer · Bill Toulas · indexed 2026-09-13 14:45 UTC

Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. [...]

APT / Nation-State Malware Microsoft Threat Actors Vulnerabilities CVE-2026-51990

P15

2026-09-13 10:11 UTC
Security Journalism

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-13 10:25 UTC

Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments. The first campaign, per the tech giant, involved sending over a million scam emails between August 3 and 5, 2026, by masquerading as chief executive officers

Cybercrime Microsoft Phishing Threat Actors

2026-09-12 11:10 UTC
Security Journalism

BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days

Security Week · Ionut Arghire · indexed 2026-09-12 11:10 UTC

Multiple espionage-motivated threat actors have adopted BlueMoon in opportunistic, rushed deployments. The post BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days appeared first on SecurityWeek.

APT / Nation-State Microsoft Threat Actors Vulnerabilities

P25

2026-09-11 19:21 UTC
Security Journalism

Threat Actor Generates 1M Personalized Fraud Emails in 3 Days

Dark Reading · Nate Nelson · indexed 2026-09-11 19:50 UTC

Cybercriminals behind malicious email campaigns no longer have to compromise volume for credibility, or vice versa, thanks to AI.

Cybercrime Threat Actors

2026-09-11 18:40 UTC
Security Journalism

Microsoft sees some new wrinkles in invoice-scam emails

The Record · indexed 2026-09-11 17:50 UTC

Researchers analyzed a flood of fraudulent business emails and found that the threat actors had doubled-up on tactics to make them appear legitimate, including help from AI.

Cybercrime Microsoft Threat Actors

2026-09-11 17:26 UTC
Security Journalism

Passkey-themed phishing attacks lead to Microsoft 365 data theft

BleepingComputer · Lawrence Abrams · indexed 2026-09-11 17:35 UTC

Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single sign-on-themed social engineering attacks to compromise corporate Microsoft accounts and steal data from Microsoft 365 services. [...]

Microsoft Phishing Threat Actors

2026-09-11 16:29 UTC
Security Journalism

Artifactory flaws chained in attacks deploying backdoor malware

BleepingComputer · Bill Toulas · indexed 2026-09-11 16:40 UTC

Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers. [...]

Cloud Security Malware Threat Actors

2026-09-11 14:29 UTC
Security Journalism

Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

The Hacker News · info@thehackernews.com (The Hacker News) · indexed 2026-09-11 15:30 UTC

Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026. The threat actors, which the artificial intelligence (AI) company has branded Generative Threat Groups (GTGs), span state-sponsored groups, financially motivated criminals, commercial

AI Security APT / Nation-State Threat Actors