Cybercriminals Archives • Daily CyberSecurity

Liquid Network Security Incident: The White Hat Dilemma Liquid Network hack diagram showing Bitcoin transfer and white hat bounty negotiation

Liquid Network hack diagram showing Bitcoin transfer and white hat bounty negotiation

Liquid Network Security Incident: The White Hat Dilemma

Do Son September 8, 2026

Recently, the Bitcoin sidechain Liquid Network suffered a monumental security incident, resulting in a comprehensive suspension of...

Mirage Kitten Malware Targets Aviation and Fintech Sectors Mirage Kitten malware campaign delivering NodeRabbit

Mirage Kitten Malware Targets Aviation and Fintech Sectors

Do Son September 7, 2026

At a Glance Actor or group Allegedly Mirage Kitten (UNC1549, Smoke Sandstorm) Activity type Cyberespionage and remote...

US Offers $10M for IRGC Cyber Leader US Rewards for Justice poster offering $10 million for information on Iranian IRGC cyber commander Amir Yaryab

US Rewards for Justice poster offering $10 million for information on Iranian IRGC cyber commander Amir Yaryab

US Offers $10M for IRGC Cyber Leader

Do Son September 5, 2026

The United States government is prepared to pay up to 10 million dollars for actionable intelligence concerning...

Coder Registry Attack: Hijacked Cloudflare Pool Served Malicious Terraform Modules Coder registry attack serving malicious Terraform modules from a hijacked Cloudflare pool

Coder registry attack serving malicious Terraform modules from a hijacked Cloudflare pool

Coder Registry Attack: Hijacked Cloudflare Pool Served Malicious Terraform Modules

Do Son September 5, 2026

Attackers needed no counterfeit website to slip malicious Terraform modules to developers. Unknown intruders gained access to...

Toy Ghouls Backdoor Uses HiveMQ and Element for C2 Rust supply chain attack on arrayref crate with proc-macro1 typosquat and DPRK infrastructure overlap

Rust supply chain attack on arrayref crate with proc-macro1 typosquat and DPRK infrastructure overlap

Toy Ghouls Backdoor Uses HiveMQ and Element for C2

Do Son September 4, 2026

At a glance Actor or group Toy Ghouls (aka Bearlyfy, Labubu, Laboo.boo, Feral Wolf) Activity type Custom...

AWS Password Spraying Campaign Targets Root Accounts Chart showing an AWS password spraying campaign targeting root logins with AWS password spraying

Chart showing an AWS password spraying campaign targeting root logins with AWS password spraying

AWS Password Spraying Campaign Targets Root Accounts

Do Son September 4, 2026

At a glance Actor or group Unidentified threat actors Activity type Password spraying Targets or victims AWS...

Spring Ring Vishing Campaign Targets Microsoft Teams Anatomy of the Spring Ring vishing campaign and Microsoft Teams phishing attacks

Spring Ring Vishing Campaign Targets Microsoft Teams

Do Son September 4, 2026

At a glance Actor or group Unidentified attackers Activity type Voice phishing via Microsoft Teams Targets or...

AiTM Phishing Campaign Targets Healthcare via Account Takeovers Layoff Phishing Scam Remcos RAT Malware Aruba Phishing, Phishing-as-a-Service PyPI, phishing CVE-2024-25608 PyPI Phishing, Credential Theft

Layoff Phishing Scam Remcos RAT Malware Aruba Phishing, Phishing-as-a-Service PyPI, phishing CVE-2024-25608 PyPI Phishing, Credential Theft

AiTM Phishing Campaign Targets Healthcare via Account Takeovers

Do Son September 4, 2026

At a Glance Category Details Threat Actor / Kit Sneaky 2FA (suspected Phishing-as-a-Service kit) Activity Type Adversary-in-the-Middle...

BraZetsu Malware Framework Powers Initial Access Sales BraZetsu malware framework and BraZetsu malware framework operations diagram

BraZetsu Malware Framework Powers Initial Access Sales

Do Son September 4, 2026

At a glance Actor or group: Exilware Activity type: Initial Access Broker (IAB) malware, reconnaissance Targets or...

Gryxa Toolkit: AI-Built Malware Watches Defenders Gryxa toolkit AI-built malware diagram showing RMM abuse and crypto credential theft across 324 hosts

Gryxa toolkit AI-built malware diagram showing RMM abuse and crypto credential theft across 324 hosts

Gryxa Toolkit: AI-Built Malware Watches Defenders

Do Son September 3, 2026

At a Glance Actor / group Unnamed financially motivated actor; assessed as a likely single operator Activity...

Russian National Indicted in Freelance Malware Scheme A Russian national indicted for malware targeting freelance workers

Russian National Indicted in Freelance Malware Scheme

Do Son September 3, 2026

At a Glance Actor Searzhudin Tamirlanovich Aktulaev Activity Type Malware distribution, wire fraud, identity theft Targets Users...

Virtualizor Hit By BGP Hijack Attack A graphic showing BGP routing hijacking redirecting a server update to a malicious source

Virtualizor Hit By BGP Hijack Attack

Do Son September 2, 2026

The server management panel Virtualizor recently suffered a devastating supply chain attack. Hackers maliciously manipulated Border Gateway...

METR Security Breach: Stolen API Key Burns $600K in Credits METR security breach where a stolen API key consumed roughly $600K in AI credits via an exposed agent dashboard

METR security breach where a stolen API key consumed roughly $600K in AI credits via an exposed agent dashboard

METR Security Breach: Stolen API Key Burns $600K in Credits

Do Son September 2, 2026

The AI safety-evaluation organization METR, the very research body that investigated OpenAI agents attacking Hugging Face, recently...

HOOKEDGE Malware: BlueDelta Hits EU Diplomatic Targets HOOKEDGE malware infection chain diagram showing BlueDelta APT28 phishing and webhook C2 abuse

HOOKEDGE malware infection chain diagram showing BlueDelta APT28 phishing and webhook C2 abuse

HOOKEDGE Malware: BlueDelta Hits EU Diplomatic Targets

Do Son September 2, 2026

At a Glance Actor / group BlueDelta (overlaps with APT28, Fancy Bear, Forest Blizzard) Activity type State-sponsored...

Virtualizor supply-chain attack via BGP hijack delivering a malicious update that plants a root backdoor on VPS hosts

Virtualizor Supply-Chain Attack: BGP Hijack Plants Backdoors

Do Son September 1, 2026

The veteran VPS server management panel Virtualizor has confirmed a serious supply-chain attack. Between 28 and 30...

Dark Caracal Deploys New GoCaracal Malware Framework Diagram showing the Dark Caracal GoCaracal malware attack chain and GoCaracal malware framework

Diagram showing the Dark Caracal GoCaracal malware attack chain and GoCaracal malware framework

Dark Caracal Deploys New GoCaracal Malware Framework

Do Son September 1, 2026

At a Glance Category Details Threat Actor Dark Caracal (suspected connection to Lebanese GDGS) Activity Type Cyberespionage,...

Cambodia Malware Campaign Uses PNG Files to Deliver SparkRAT Cambodia malware campaign infection chain diagram showing SparkRAT delivery and BYOVD driver abuse

Cambodia malware campaign infection chain diagram showing SparkRAT delivery and BYOVD driver abuse

Cambodia Malware Campaign Uses PNG Files to Deliver SparkRAT

Do Son September 1, 2026

At a Glance Actor/Group Unattributed cluster; low-confidence overlap with SilverFox-associated activity Activity Multi-stage malware campaign delivering SparkRAT...

BREEZE COMET Threat Actor Attacks Brazilian Banks BREEZE COMET threat actor executing BREEZE COMET threat actor attacks on payment systems

BREEZE COMET Threat Actor Attacks Brazilian Banks

Do Son September 1, 2026

At a Glance Actor or group: BREEZE COMET (formerly UNC5669, Plump Spider, SHADOW-AETHER-064) Activity type: Banking fraud,...

AnonyMousKIT Uses AI Voice Calls to Unlock Stolen iPhones AnonyMousKIT AI-powered PhaaS platform dashboard used to unlock stolen iPhones and bypass Apple Activation Lock

AnonyMousKIT AI-powered PhaaS platform dashboard used to unlock stolen iPhones and bypass Apple Activation Lock

AnonyMousKIT Uses AI Voice Calls to Unlock Stolen iPhones

Do Son September 1, 2026

At a Glance Actor/Group AnonyMousKIT; a reseller supply chain with a developer, buyers, and hundreds of operators...

ValleyRAT Backdoor Spread via Signed Chinese Adware ValleyRAT backdoor adware campaign infection chain diagram

ValleyRAT Backdoor Spread via Signed Chinese Adware

Do Son August 31, 2026

At a Glance Actor or group: Silver Fox Activity type: Backdoor delivery, spyware, DLL sideloading Targets or...

UAT-10147 Deploys SPECTRE Cross-Platform Implant Diagram showing how the UAT-10147 SPECTRE cross-platform implant bypasses EDR systems

UAT-10147 Deploys SPECTRE Cross-Platform Implant

Do Son August 31, 2026

At a glance Factor Details Actor or Group UAT-10147 (Suspected Chinese-speaking group) Activity Type SEO fraud monetization,...

Kimsuky Spear Phishing Abuses Remote Control Tools Kimsuky spear phishing campaigns abusing remote control tools

Kimsuky Spear Phishing Abuses Remote Control Tools

Do Son August 31, 2026

At a glance Actor / Group Kimsuky (suspected North Korea-linked threat actor) Activity Type Spear phishing, email...