1+ mon, 1+ day ago   (448+ words) Sandworm-linked threat actors are using fake job interviews to trick IT professionals into installing a trojanized WireGuard VPN client. Ukraine’s CERT-UA attributes the activity to UAC-0145, a subcluster of UAC-0002, also known as Sandworm, APT44, and Seashell Blizzard. The campaign has…...

1+ mon, 3+ week ago   (345+ words) In July 2026, researchers observed post-compromise activity linked with moderate-to-high confidence to an East Asia-based threat actor. The group has not yet been tied to a known APT, but its operational timing, infrastructure evidence, and system locale indicators support the assessment....

2+ mon, 3+ day ago   (378+ words) They progressed through privilege escalation, rogue administrator account creation, remote management tool deployment, and, in one confirmed case, the deployment of the DragonForce ransomware. The activity is assessed with high confidence to involve an Initial Access Broker, or possibly a…...

2+ mon, 3+ day ago   (394+ words) Microsoft has warned of a new destructive malware platform called GigaWiper, a Golang-based backdoor designed to give attackers persistent access, remote control, data collection, and several options for destroying Windows systems. Researchers found both standalone wiper samples and larger backdoor…...

2+ mon, 1+ week ago   (531+ words) A sprawling ClickFix campaign that abuses fake Google and Cloudflare verification pages to trick users into infecting their own machines. Documented by Malwarebytes, the operation delivers a wide range of payloads including HijackLoader, StealC, Remus, Amatera Stealer, CastleLoader, NetSupport, and…...

2+ mon, 2+ week ago   (316+ words) The malware functions as a highly evasive loader explicitly designed to deploy Cobalt Strike Beacons onto victim networks. Victimology reveals a broad geographic footprint, with confirmed infections spanning Taiwan, Hong Kong, Lebanon, Syria, Colombia, and Serbia. Due to the wide…...

2+ mon, 3+ week ago   (296+ words) Cybersecurity researchers at ESET have uncovered a major shift in the tactics of FishMonger, a Chinese cyberespionage group linked to the contractor I-SOON. The threat actors have developed two previously undocumented Windows versions of SprySOCKS, a backdoor previously thought to…...

2+ mon, 3+ week ago   (465+ words) A compromised WordPress website used a traffic filtering system and blockchain-hosted payload delivery to push a ClickFix lure at Windows visitors, leading to an attempted GULoader infection that was stopped by endpoint protection in less than 300300 milliseconds. The intrusion was…...

3+ mon, 1+ day ago   (407+ words) Russian state-sponsored threat actor APT28, also known as Fancy Bear or Forest Blizzard, has aggressively shifted its cyber espionage tactics to focus on zero-click vulnerabilities and edge infrastructure. Recent threat intelligence reveals that the group, publicly attributed to the GRU’s Unit…...

3+ mon, 1+ day ago   (406+ words) A sophisticated cyber espionage campaign tracked as SHEETCREEP is actively turning Google Sheets into a covert command-and-control (C2) center. Originally spotted earlier this year, this newly evolved variant uses diplomatic phishing lures to deploy a C# remote access trojan (RAT). Security…...