News
Critical Marimo Python Notebook RCE Vulnerability (CVE-2026-39987) Exploited Within 10 Hours of Disclosure
2+ week, 3+ day ago (350+ words) The technical root cause is a classic case of CWE-306: Missing Authentication for Critical Function. The endpoint only verifies the running mode and platform support, failing to restrict access based on user credentials or session state. This oversight exposes the…...
Intuitive Surgical Administrative Network Breach: 2026 Phishing Attack Exposes Employee and Customer Data
1+ mon, 1+ week ago (395+ words) The technical evidence supporting these findings is of high quality, as all claims are corroborated by official statements and independent media reports. However, the absence of forensic details, such as logs or malware samples, limits the depth of technical analysis....
Chinese Cyber Espionage Targets Southeast Asian Military C4 I Systems Using Apple Chris and Mem Fun Malware
1+ mon, 2+ week ago (227+ words) The campaign employs a multi-stage infection chain, advanced persistence mechanisms, and custom malware designed for stealth and flexibility. Getpass is a custom variant of Mimikatz designed for credential harvesting. It targets lsass. exe to extract plaintext passwords, NTLM hashes, and…...
FBI Pen Register and Trap and Trace System Breach: Investigation into Suspicious Cyber Activity Targeting Sensitive Surveillance Data
1+ mon, 3+ week ago (596+ words) No specific malware, tool names, or indicators of compromise (IOCs) have been disclosed by the FBI or in public reporting as of March 6, 2026. The lack of technical artifacts limits the ability to perform a detailed forensic analysis or to confirm…...
Muddy Water's Dindoor Backdoor: Iranian APT Targets U. S. Organizations via Deno Runtime and Cloud Storage
1+ mon, 3+ week ago (851+ words) Executive Summary A newly identified campaign orchestrated by the Iranian state-sponsored advanced persistent threat group Muddy Water (also known as Seedworm and attributed to Iran's Ministry of Intelligence and Security, MOIS) is actively targeting U. S. organizations with a sophisticated malware arsenal....
AI-Powered Cyberattack Using Claude Code Compromises Mexico's Tax Authority and Government Agencies in Massive Data Breach
1+ mon, 3+ week ago (282+ words) The attackers also utilized AI chaining, orchestrating workflows between Claude Code and GPT-4. 1 to maximize automation and evade detection. Behavioral indicators included high-frequency automated scripting, anomalous code generation activity, and the use of AI coding assistants from within government networks....
Rusty Water: Iranian Muddy Water APT Targets Israeli Government and Infrastructure With Advanced Rust-Based Malware Amid Rising Tensions
2+ mon, 5+ day ago (593+ words) Rescana Yes, subscribe me to your newsletter. The Iranian state-sponsored advanced persistent threat group Muddy Water (also tracked as Mango Sandstorm, TA450, Seedworm, and G0069) has escalated its cyber-espionage operations in early 2026, deploying a sophisticated new malware family as geopolitical tensions in…...
Unsolicited Booker APT Targets Kyrgyzstan and Tajikistan Telecoms With Luci Door and Mars Snake Backdoors
2+ mon, 5+ day ago (486+ words) Executive Summary The China-aligned advanced persistent threat (APT) group Unsolicited Booker has recently intensified its cyber-espionage operations against telecommunications providers in Central Asia, specifically targeting organizations in Kyrgyzstan and Tajikistan. Leveraging highly tailored spear-phishing campaigns, the group deploys two rare…...
Technical Analysis of CANFAIL Malware Targeting Ukrainian Defense and Energy Sectors by Suspected Russian Threat Actor
2+ mon, 2+ week ago (731+ words) Rescana Yes, subscribe me to your newsletter. Google's Threat Analysis Group (TAG) has recently attributed a series of highly targeted cyberattacks against Ukrainian organizations to a suspected Russian state-aligned threat actor. These attacks are characterized by the deployment of a…...
Lazarus Group Targets npm, Py PI, and Git Hub Developers With Fake Job Recruiter Malware Campaign
2+ mon, 2+ week ago (126+ words) The malware is often delivered via indirect dependencies, making detection challenging. The campaign demonstrates patience and operational security, with attackers publishing benign packages to gain downloads and trust before switching to malicious versions. The infrastructure is modular, allowing attackers to…...