Threat actors, campaigns and techniques.
Analysis4 min read
Enea says SilentAir hijacked mobile network nodes to intercept calls and messages, with Taiwanese subscribers the primary targets. It also reports blocking Liminal Panda's GTPDoor backdoor at operator customers.
ExploitedCVE-2026-84869CVSS 9.94 min read
Huntress and Blackpoint Cyber say the worm-like toolkit attempted to exploit a patched ScreenConnect client flaw, but neither has seen that step succeed. The initial access came through a third-party extension, not the CVE.
ExploitedCVE-2026-123158CVSS 8.11 min read
Cowrie sensors saw long-password logins climb from 23 on November 1 to 713 on November 6, with the first real exploit attempt arriving November 5.
Brief2 min read
A Group-IB blog post says infostealer logs are resold across several crimes and that a stolen session cookie walks past the login and one-time code a bank already paid for.
Brief2 min read
Push Security found registration pages promising free AI subscriptions and other rewards, then routing visitors into two phishing-as-a-service platforms that grab tokens, passwords and session cookies.
Brief2 min read
XLab found a fake updater script that swaps the legitimate cwpsrv binary for a malicious one, then waits for an encrypted HTTP header before running anything.
Brief2 min read
A joint advisory says attackers are going after unpatched or internet-facing temperature controllers in grocery and cold storage sites, after attacks on European supermarkets and blood storage.
Brief2 min read
Researchers say the group planted malicious code on legitimate sites and a Ukrainian analytics service, then used known vulnerabilities to pull data from vulnerable phones.
Brief2 min read
Layer3 Intel says proxy nodes were beaconing from the Executive Office of the President's network, and that 28 separate proxy services could exit through it.
ExploitedCVE-2025-43529CVSS 8.82 min read
Sekoia attributes a large-scale watering hole operation to APT29 with moderate-to-high confidence. The payloads chained already-patched browser and OS flaws, and none of them established persistence.
CVE-2026-40217CVSS 8.82 min read
GTIG and Mandiant describe two clusters: one scanning for exposed LLM endpoints, another stealing valid API keys and selling access through "LLM mixers".
ExploitedCVE-2025-8088CVSS 8.42 min read
The Russia-aligned group has been active since at least February 2025, stealing documents and credentials from law enforcement, local councils and a transport hub for foreign military aid.
