Threat actors, campaigns and techniques.
Brief2 min read
Semperis says the Iranian government-linked group, quiet for three months, resumed data theft in May and later hid a Tornado second-stage server on Namecheap shared hosting, its first US-based C&C since 2016.
Brief2 min read
The report says UAC-0099 gained access through a spear-phishing email with a malicious attachment, and the intrusion later involved a previously unseen mesh network backdoor.
Brief2 min read
The bootkit is reported to bypass Secure Boot on patched Windows systems that lack revocations, with activity against diplomatic entities in Tajikistan, Uzbekistan and Turkmenistan in early 2026.
ExploitedCVE-2024-47575CVSS 9.82 min read
A suspected state-sponsored group used a FortiManager flaw for initial access, then a path traversal bug to gain root and deploy the PeerStitch implant, researchers say.
Brief1 min read
A joint investigation describes bulk scanning of FortiGate, FortiWeb and Palo Alto GlobalProtect appliances, credential theft and hands-on-keyboard intrusions, with victim overlaps seen at Qilin and The Gentlemen.
Brief2 min read
A joint advisory says SafePay has hit at least 600 critical infrastructure organizations worldwide since August 2024, and warns that paying a ransom doesn't guarantee files come back.
