Threat actors, campaigns and techniques.
ExploitedCVE-2025-8875CVSS 9.42 min read
Black Lotus Labs says the Chinese state-linked group chained compromised routers and modems to mask attacks on edge and management systems, then wiped its tooling after each operation.
Brief2 min read
A threat cluster Group-IB calls CyberDakait has used smishing and vishing to push malicious APKs that impersonate Indian banks, harvest banking credentials and mine cryptocurrency on infected phones.
Brief2 min read
Solar attributes the activity to Partisan Zmiy, also called the Cyber Partisans, a Belarus-aligned group it says has been active since at least 2020.
Brief1 min read
Rapid7's Q3 2026 threat report tracked 43 newly exploited high- and critical-severity vulnerabilities, with most exploitation happening inside the first week.
Brief2 min read
Version 20 of the framework tracks prompt injection, theft of app-specific passwords, and attacks on internet-exposed PLCs at Minnesota water utilities, where MITRE says attribution remains unconfirmed.
Brief2 min read
Elastic reported that a fake Web3 accelerator used malicious npm packages, pitched with free AI credits and security audits, to deliver information stealers and backdoors to Windows and macOS machines.
Brief1 min read
OpenSourceMalware says the group behind the GhostAction supply chain attack has moved from malicious GitHub Actions workflows to phishing developers with a stealer disguised as a font file.
Brief2 min read
Symantec's Threat Hunter Team tracks the cluster as Swallowtail and attributes it to the Russia-linked group also known as BlueDelta, Fancy Bear and Forest Blizzard.
Brief2 min read
The University of Belgrade rector, a backer of Serbia's student protests, was reportedly hit through a zero-click exploit six days before the October 25 snap parliamentary election.
Brief2 min read
Researchers describe a previously undocumented cluster targeting organizations in Asia and Africa since mid-2025, with Sandboxie DLL sideloading as its most distinctive technical marker.
Brief2 min read
Aikido researchers say the campaign behind fake crypto recruiter tasks now ships through the HashiCorp Terraform Registry and Go packages, putting developer malware next to cloud credentials.
Brief1 min read
Rapid7's Q3 threat analysis found high-severity vulnerabilities exploited within three days of disclosure on average, ransomware still dominant, and AI cited in only 8% of tracked incidents.
