LATEST

Aggregated cybersecurity reporting, advisories and research. 305 matching records.

AUTO-POLL // 2026-10-09 23:45 UTC

CYBER INTEL TEMPERATURE

TODAY'S AGGREGATED INTELLIGENCE

COOL

COOL WARM ELEVATED HOT CRITICAL

P4 / P100

7-DAY C.I.T. REPORT

CYBER CONDITIONS // DAILY C.I.T. READINGS

TODAY → 6 DAYS AGO

TODAY

Oct 9

RANSOMWARE

COOL // 67 ARTICLES

THU

Oct 8

RANSOMWARE

COOL // 62 ARTICLES

WED

Oct 7

RANSOMWARE

COOL // 86 ARTICLES

TUE

Oct 6

RANSOMWARE

COOL // 61 ARTICLES

MON

Oct 5

RANSOMWARE

COOL // 48 ARTICLES

SUN

Oct 4

RANSOMWARE

P10

WARM // 11 ARTICLES

SAT

Oct 3

RANSOMWARE

COOL // 14 ARTICLES

C.I.T. = Cyber Intel Temperature // Cyber Conditions describe notable activity observed in that day's aggregated intelligence.

RESET

2026-06-05 19:19 UTC
Vendor Research

CVE-2025-12829 - Integer Overflow issue in Amazon Ion-C

AWS Security Bulletins · aws@amazon.com · indexed 2026-08-15 18:58 UTC

Bulletin ID: AWS-2025-027 Scope: Amazon Content Type: Important (requires attention) Publication Date: 2025/11/7 10:15 AM PDT Description: Amazon's Ion-C is a library for the C language that is used to read and write Amazon Ion data. We Identified CVE-2025-12829, which describes an uninitialized stack read issue in Ion-C versions < v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be exposed through UTF-8 escape seq…

Cloud Security Threat Actors Vulnerabilities CVE-2025-12829

2026-06-05 19:19 UTC
Vendor Research

[Redirected] Memory Dump Issue in AWS CodeBuild

AWS Security Bulletins · aws@amazon.com · indexed 2026-08-15 18:58 UTC

Bulletin ID: AWS-2025-016 Scope: AWS Content Type: Important (requires attention) Publication Date: 2025/07/25 6:00 PM PDT Description: AWS CodeBuild is a fully managed on-demand continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy. Security researchers reported a CodeBuild issue that could be leveraged for unapproved code modification absent sufficient repository controls and credential scoping. The researchers demonstrat…

Cloud Security DFIR Security Research Threat Actors Vulnerabilities CVE-2025-8217

2026-06-05 14:00 UTC
Vendor Research

Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms

Google Threat Intelligence / Mandiant · Mandiant · indexed 2026-08-15 18:55 UTC

Written by: Chad Reams, Tufail Ahmed, Keith Knapp, Ashley Frazer, Tyler McLellan Introduction From January through May 2026, Mandiant identified a financially motivated data theft extortion campaign executed by the threat cluster UNC3753 (also tracked as "Luna Moth," “Chatty Spider,” and "Silent Ransom Group") targeting dozens of organizations across professional, legal, and financial services in the United States. UNC3753 leverages voice phishing (vishing) and social engineering deception tech…

Data Breaches DFIR Microsoft Phishing Threat Actors Threat Intelligence

2026-05-29 13:56 UTC
Vendor Research

Microsoft Entra ID 1-Click Open Redirection via OAuth Error Handling Abuse

Tenable Research Advisories · Ben Smith · indexed 2026-08-15 18:55 UTC

Microsoft Entra ID 1-Click Open Redirection via OAuth Error Handling Abuse Researchers associated with Tenable have discovered new techniques to trigger 1-click open redirection attacks in Microsoft Entra ID by abusing the OAuth error-handling mechanism. The attack relies on an initial setup phase where a threat actor registers an OAuth application in an actor-controlled tenant and configures its redirect_uri to point to an attacker-controlled domain. When a victim clicks on a specifically craf…

Apple Malware Microsoft Phishing Security Research Threat Actors

2026-05-27 06:57 UTC
Other

The GHOST STADIUM Score: Billions At Stake At The World’s Largest Football Tournament

Group-IB · indexed 2026-09-07 17:30 UTC

With the 2026 FIFA World Cup just weeks away, Group-IB researchers have uncovered six distinct fraud schemes, four independent threat actors, and over 4,300 fraudulent domains impersonating FIFA's official web presence — including a sophisticated phishing operation run by the Chinese-speaking threat actor GHOST STADIUM, whose campaign could cause losses reaching billions of dollars.

Cybercrime Phishing Threat Actors

2026-05-25 14:00 UTC
Vendor Research

Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability

Google Threat Intelligence / Mandiant · Mandiant · indexed 2026-08-15 18:55 UTC

Written by: Takahiro Sugiyama, Peter Revelant, Mathew Potaczek Introduction In late 2025, Mandiant responded to a security incident involving a compromised web server running KnowledgeDeliver. KnowledgeDeliver is a Learning Management System (LMS) developed by Digital Knowledge commonly used in Japan. Mandiant identified a critical vulnerability that allowed unauthenticated Remote Code Execution (RCE). An unknown threat actor leveraged this access to inject malicious code into the LMS platform,…

Apple DFIR Malware Microsoft Threat Actors Threat Intelligence Vulnerabilities CVE-2026-5426

P55

2026-05-25 14:00 UTC
Vendor Research

2 PhaaS 2 Furious: The Evolution of Chinese-Language Phishing Services

Google Threat Intelligence / Mandiant · Google Threat Intelligence Group · indexed 2026-08-15 18:55 UTC

While Russian-speaking threat actors have historically dominated the phishing-as-a-service (PhaaS) landscape, a rival ecosystem is rapidly growing within the Chinese-language underground. Google Threat Intelligence Group (GTIG) analyzed a dozen current PhaaS offerings in the Chinese underground, all of them mature services and many likely tied intricately to the broader criminal ecosystem in that region. These services not only lower the barrier to entry for Chinese cyber criminals, but reveal …

Apple Cybercrime Phishing Threat Actors Threat Intelligence

2026-05-19 17:49 UTC
Vendor Research

Continued Evolution of Persistence Mechanism Against Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense

Cisco Security Advisories · indexed 2026-08-15 14:33 UTC

On April 23, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an update to V1: Emergency Directive (ED) 25-03: Identify and Mitigate Potential Compromise of Cisco Devices related to Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) products. According to the update, the ArcaneDoor threat actor has developed a previously unknown persistence mechanism that is preserved across upgrading to the fixed releases that wer…

Network Security Threat Actors Vulnerabilities CVE-2025-20333 CVE-2025-20362

P20

2026-05-18 14:00 UTC
Security Journalism

Threat Actor Defense Evasion: How Attackers Disable AV & EDR

Huntress · indexed 2026-09-07 17:30 UTC

Threat actors are actively targeting your security tools. Learn how threat actors disable antivirus and EDR through vulnerable drivers, tampering attacks, and malicious firewall rules, and how Huntress detects.

Network Security Threat Actors

2026-05-15 14:00 UTC
Vendor Research

Welcome to BlackFile: Inside a Vishing Extortion Operation

Google Threat Intelligence / Mandiant · Google Threat Intelligence Group · indexed 2026-08-15 18:55 UTC

Written by: Austin Larsen, Tyler McLellan, Genevieve Stark, Dan Ebreo Introduction Google Threat Intelligence Group (GTIG) has continued to track an expansive extortion campaign by UNC6671, a threat actor operating under the "BlackFile" brand, that targets organizations via sophisticated voice phishing (vishing) and single sign-on (SSO) compromise. By leveraging adversary-in-the-middle (AiTM) techniques to bypass traditional perimeter defenses and multi-factor authentication (MFA), UNC6671 gain…

Data Breaches Microsoft Network Security Phishing Threat Actors Threat Intelligence Vulnerabilities

2026-05-11 14:00 UTC
Vendor Research

GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access

Google Threat Intelligence / Mandiant · Google Threat Intelligence Group · indexed 2026-08-15 18:55 UTC

Executive Summary Since our February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has continued to track a maturing transition from nascent AI-enabled operations to the industrial-scale application of generative models within adversarial workflows. This report, based on insights derived from Mandiant incident response engagements, Gemini, and GTIG’s proactive research, highlights the dual nature of the current threat environment where AI serves as both a so…

AI Security Apple APT / Nation-State Cloud Security DFIR Malware Microsoft Network Security Ransomware Security Research Threat Actors Threat Intelligence Vulnerabilities

P60

2026-05-07 23:00 UTC
Security Journalism

Threat Actors Weaponize Tiflux RMMs in Malspam Attacks

Huntress · indexed 2026-09-07 17:30 UTC

We dug into a recent malspam campaign that involved an installer for a commercially sold remote monitoring and management (RMM) tool called Tiflux.

Threat Actors

2026-05-06 08:07 UTC
Other

The Architecture of Deception: How a $187 Million Fraud Ecosystem Exploits Trust Across Australia and the United States

Group-IB · indexed 2026-09-07 17:30 UTC

This blog examines how threat actors use deepfake impersonation and social media to manipulate real stocks, how a network of 208 connected fake investment platforms steals millions in cryptocurrency, and what a new approach to defence can do about it.

Cybercrime Threat Actors

2026-04-30 00:00 UTC
Security Journalism

Komari Red: The Monitoring Tool with a Built-in Reverse Shell

Huntress · indexed 2026-09-07 17:30 UTC

Huntress found threat actors using the Komari monitoring agent as a SYSTEM-level backdoor. Learn how they abused GitHub and what defenders should hunt for.

Malware Microsoft Threat Actors

2026-04-23 21:38 UTC
Vendor Research

AI threats in the wild: The current state of prompt injections on the web

Google Online Security Blog · Kimberly Samra · indexed 2026-08-15 14:33 UTC

Posted by Thomas Brunner, Yu-Han Liu, Moni PandeAt Google, our Threat Intelligence teams are dedicated to staying ahead of real-world adversarial activity, proactively monitoring emerging threats before they can impact users. Right now, Indirect Prompt Injection (IPI) is a top priority for the security community, anticipating it as a primary attack vector for adversaries to target and compromise AI agents. But while the danger of IPI is widely discussed, are threat actors actually exploiting th…

AI Security Microsoft Security Research Threat Actors Threat Intelligence

P20

2026-04-23 14:00 UTC
Vendor Research

Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite

Google Threat Intelligence / Mandiant · Mandiant · indexed 2026-08-15 18:55 UTC

Written by: JP Glab, Tufail Ahmed, Josh Kelley, Muhammad Umair Introduction Google Threat Intelligence Group (GTIG) identified a multistage intrusion campaign by a newly tracked threat group, UNC6692, that leveraged persistent social engineering, a custom modular malware suite, and deft pivoting inside the victim’s environment to achieve deep network penetration. As with many other intrusions in recent years, UNC6692 relied heavily on impersonating IT helpdesk employees, convincing their victim…

Cloud Security Malware Microsoft Phishing Threat Actors Threat Intelligence

2026-04-17 14:00 UTC
Security Journalism

Disrupting Attacks on Endpoints | Attack Disruption Engine

Huntress · indexed 2026-09-07 17:30 UTC

Standard EDR creates a gap between detection and action. Huntress closes it. Learn how our Attack Disruption Engine automatically disrupts threat actors and reduces the impact of endpoint attacks.

Threat Actors

2026-04-16 14:00 UTC
Vendor Research

Defending Your Enterprise When AI Models Can Find Vulnerabilities Faster Than Ever

Google Threat Intelligence / Mandiant · Francis deSouza · indexed 2026-08-15 18:55 UTC

Introduction Advances in AI model-powered exploitation have demonstrated that general-purpose AI models can excel at vulnerability discovery, even without being purpose-built for the task. Eventually, capabilities such as these will be integrated directly into the development cycle, and code will be more difficult to exploit than ever; however, this transition creates a critical window of risk. As we harden existing software with AI, threat actors will use it to discover and exploit novel vulne…

AI Security APT / Nation-State Cloud Security DFIR Microsoft Ransomware Threat Actors Vulnerabilities

P60

2026-04-15 14:00 UTC
Vendor Research

The German Cyber Criminal Überfall: Shifts in Europe's Data Leak Landscape

Google Threat Intelligence / Mandiant · Google Threat Intelligence Group · indexed 2026-08-15 18:55 UTC

Written by: Jamie Collier, Robin Grunewald Germany has reclaimed its position as a primary focus for cyber extortion in Europe. While data leak site (DLS) posts rose almost 50% globally in 2025, Google Threat Intelligence (GTI) data shows that the surge is hitting German infrastructure harder and faster than its regional neighbors, marking a significant return to the high-pressure levels previously observed in the country during 2022 and 2023. Cyber Criminals Pivoting Back to Germany Germany mo…

Cybercrime Data Breaches Ransomware Threat Actors Threat Intelligence

P15

2026-04-09 17:07 UTC
Vendor Research

Protecting Cookies with Device Bound Session Credentials

Google Online Security Blog · Google · indexed 2026-08-15 14:33 UTC

Posted by Ben Ackerman, Chrome team, Daniel Rubery, Chrome team and Guillaume Ehinger, Google Account Security team Following our April 2024 announcement, Device Bound Session Credentials (DBSC) is now entering public availability for Windows users on Chrome 146, and expanding to macOS in an upcoming Chrome release. This project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape. Session theft t…

Apple Cybercrime Malware Microsoft Threat Actors

2026-04-08 14:00 UTC
Security Journalism

The ADWS Architecture That Hides PowerShell AD Enumeration

Huntress · indexed 2026-09-07 17:30 UTC

A threat actor enumerated our entire AD with Get-ADComputer, and none of our detections fired. The problem wasn't their evasion - it was an architectural blind spot in how PowerShell talks to Active Directory.

Threat Actors

2026-04-08 07:30 UTC
Other

Cyber Saga: In the Footsteps of the DPRK IT Workers

Group-IB · indexed 2026-09-07 17:30 UTC

Discover how North Korean threat actors use synthetic identities, AI-assisted workflows, and overlapping infrastructure to infiltrate companies, and learn actionable strategies to mitigate this insider threat.

Threat Actors

2026-04-07 09:00 UTC
Other

As breakout time accelerates, prevention-first cybersecurity takes center stage

ESET · indexed 2026-09-07 17:30 UTC

Threat actors are using AI to supercharge tried-and-tested TTPs. When attacks move this fast, cyber-defenders need to rethink their own strategy.

Microsoft Threat Actors Threat Intelligence

2026-04-01 10:32 UTC
Other

Hooking the Archipelago: Dissecting a Phishing Campaign Targeting Philippine Banking Users

Group-IB · indexed 2026-09-07 17:30 UTC

Group-IB researchers uncover an ongoing phishing campaign targeting major banks in the Philippines. This blog details how threat actors abuse trusted and legitimate platforms to deceive users and evade detection. It highlights a significant threat escalation with the successful hijacking of a legitimate domain to host malicious infrastructure, enabling threat actors to operate with even greater credibility and reduced detection.

Phishing Threat Actors

2026-03-23 21:00 UTC
Security Journalism

Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure

Huntress · indexed 2026-09-07 17:30 UTC

Railway PaaS is being weaponized as a clean token replay engine in an active AiTM and device code phishing campaign impacting 268+ M365 organizations and 100+ MSPs.

Microsoft Phishing Threat Actors

2026-03-12 14:00 UTC
Security Journalism

Data Exfiltration and Threat Actor Infrastructure Exposed

Huntress · indexed 2026-09-07 17:30 UTC

Threat actors are people, too, and like everyone else, make mistakes. These mistakes can reveal insights into the threat actor, or even expose access to their infrastructure.

Threat Actors

2026-03-11 14:00 UTC
Security Journalism

How Threat Actors Abuse Remote Management Tools | Huntress

Huntress · indexed 2026-09-07 17:30 UTC

The abuse of remote monitoring and management (RMM) tools is surging. See how threat actors daisy chain RMM software for initial access, persistence, and detection evasion.

Threat Actors

2026-03-06 21:00 UTC
Security Journalism

A Threat Actor Abuses Another Free Trial

Huntress · indexed 2026-09-07 17:30 UTC

A deep dive into a threat actor who exploited SolarWinds Web Help Desk, abused an Elastic Cloud SIEM free trial for exfiltration and triage, revealing key infrastructure.

Threat Actors

2026-03-04 10:00 UTC
Other

Protecting education: How MDR can tip the balance in favor of schools

ESET · indexed 2026-09-07 17:30 UTC

The education sector is notoriously short on cash, but rich in assets for threat actors to target. How can managed detection and response (MDR) help learning institutions regain the initiative?

Threat Actors

2026-02-28 10:00 UTC
Other

This month in security with Tony Anscombe – February 2026 edition

ESET · indexed 2026-09-07 17:30 UTC

In this roundup, Tony looks at how opportunistic threat actors are taking advantage of weak authentication, unmanaged exposure, and popular AI tools

Threat Actors