Cybercriminals Archives • Page 2 of 38 • Daily CyberSecurity

Fire Ant Threat Actor Targets Trusted Infrastructure Fire Ant threat actor executing a trusted infrastructure compromise

Fire Ant Threat Actor Targets Trusted Infrastructure

Do Son August 31, 2026

At a Glance Actor: Fire Ant (suspected UNC3886 overlap) Activity Type: Espionage, network infrastructure breach, credential theft...

TeamPCP Hackers Arrested in Joint Operation Australian Federal Police arresting TeamPCP hackers in Perth for cybercrimes

TeamPCP Hackers Arrested in Joint Operation

Do Son August 28, 2026

Australian news outlets and law enforcement agencies recently announced a significant breakthrough. On August 26, 2026, the...

FBI Seizes QScan and QTRouter Platforms Run by China State Hackers JADEPUFFER agentic ransomware attack chain diagram from Langflow RCE to database extortion

JADEPUFFER agentic ransomware attack chain diagram from Langflow RCE to database extortion

FBI Seizes QScan and QTRouter Platforms Run by China State Hackers

Do Son August 27, 2026

At a Glance Actor/Group QTFY, a PRC state-sponsored group tied to Nanjing Xinjiuwei Network Technology Company Activity...

SilkParasite APT Hits Central Asian Governments With 7 RATs SilkParasite APT diagram showing China-nexus cyberespionage attack chain with DLL sideloading and RAT deployment across Central Asia

SilkParasite APT diagram showing China-nexus cyberespionage attack chain with DLL sideloading and RAT deployment across Central Asia

SilkParasite APT Hits Central Asian Governments With 7 RATs

Do Son August 27, 2026

At a Glance Actor / group SilkParasite (activity cluster; China-nexus assessed at medium confidence) Activity type Cyberespionage...

Operation CameraSwarm: 14,500 Dahua Cameras Compromised Across Ukraine and Russia Diagram showing how prompt injection attacks and prompt injection techniques threaten AI security.

Diagram showing how prompt injection attacks and prompt injection techniques threaten AI security.

Operation CameraSwarm: 14,500 Dahua Cameras Compromised Across Ukraine and Russia

Do Son August 26, 2026

At a Glance Actor A single unattributed operator (Russian-language code comments observed) Activity Mass compromise of Dahua...

Core Werewolf Deploys New CoreRAT Malware Against Russian Targets CoreRAT malware decoy PDF used in Core Werewolf phishing attack on Russian defense targets

CoreRAT malware decoy PDF used in Core Werewolf phishing attack on Russian defense targets

Core Werewolf Deploys New CoreRAT Malware Against Russian Targets

Do Son August 25, 2026

At a glance Actor / group Core Werewolf (suspected cyberespionage cluster) Activity type Phishing, remote access trojan,...

Balonx Sistema: Mexican PhaaS Adds AI Vishing and RAT Balonx Sistema PhaaS platform diagram showing real-time phishing, Android RAT, and AI vishing targeting Mexican banks

Balonx Sistema PhaaS platform diagram showing real-time phishing, Android RAT, and AI vishing targeting Mexican banks

Balonx Sistema: Mexican PhaaS Adds AI Vishing and RAT

Do Son August 25, 2026

At a glance Actor or group Mexico-based operator known as “balonx” and affiliates (alleged) Activity type Phishing-as-a-Service,...

StopAndProtect Malware Turns Hacked WordPress Sites Into a Botnet StopAndProtect malware ClickFix fake CAPTCHA prompt on hacked WordPress sites

StopAndProtect malware ClickFix fake CAPTCHA prompt on hacked WordPress sites

StopAndProtect Malware Turns Hacked WordPress Sites Into a Botnet

Do Son August 24, 2026

At a glance Actor / group Unnamed operator behind “StopAndProtect” (internal project names “0a_botnet” and “fake-captcha”) Activity...

Cisco Talos Exposes UAT-10147 Agentic AI Attacks Diagram showing UAT-10147 agentic AI attacks and automated intrusion workflows

Cisco Talos Exposes UAT-10147 Agentic AI Attacks

Do Son August 21, 2026

At a glance Factor Details Actor UAT-10147 (Suspected Chinese-speaking cybercrime threat group) Activity Type Search engine optimization...

Operation ASTERIX: Crypto Scam Used AI and Fake Wallets Operation ASTERIX crypto fraud attack chain showing vishing calls and fake wallet apps stealing seed phrases

Operation ASTERIX crypto fraud attack chain showing vishing calls and fake wallet apps stealing seed phrases

Operation ASTERIX: Crypto Scam Used AI and Fake Wallets

Do Son August 21, 2026

At a glance Actor Unnamed crypto fraud operator (single host) Activity type Phishing, vishing, fake wallet malware,...

Operation QUICSILVER Targets Myanmar Government With Go Backdoor Operation QUICSILVER infection chain showing VHD lure delivering the QUICAgent Go backdoor to Myanmar government targets

Operation QUICSILVER infection chain showing VHD lure delivering the QUICAgent Go backdoor to Myanmar government targets

Operation QUICSILVER Targets Myanmar Government With Go Backdoor

Do Son August 21, 2026

At a glance Actor or group Unnamed China-nexus actor (moderate confidence) Activity type Cyber espionage, custom Go...

arrayref Rust Crate Hijacked in Supply Chain Attack With DPRK Infrastructure Overlap Rust supply chain attack on arrayref crate with proc-macro1 typosquat and DPRK infrastructure overlap

Rust supply chain attack on arrayref crate with proc-macro1 typosquat and DPRK infrastructure overlap

arrayref Rust Crate Hijacked in Supply Chain Attack With DPRK Infrastructure Overlap

Do Son August 20, 2026

At a Glance Actor Unattributed; infrastructure overlaps with DPRK-linked activity (Wiz) Activity Software supply chain attack via...

Jewelbug APT Group Operations Combine Espionage and Fraud CVE-2024-3393 - Zservers sanctions

Jewelbug APT Group Operations Combine Espionage and Fraud

Do Son August 20, 2026

At a glance Actor or group: Jewelbug (suspected China-based threat group) Activity type: Cyber espionage and cryptocurrency...

Cisco Talos Discovers JWR Phishing Framework JWR phishing framework architecture and JWR phishing framework analysis diagram

Cisco Talos Discovers JWR Phishing Framework

Do Son August 20, 2026

At a glance Actor or group: Suspected Chinese-speaking cybercriminals. Activity type: Phishing-as-a-Service (PhaaS). Targets or victims: Shoppers...

US Agencies Warn of AI-Generated Exploits Targeting Siemens S7 PLCs Siemens PLC cyber threat with AI-generated exploit scripts targeting S7 series controllers in critical infrastructure

Siemens PLC cyber threat with AI-generated exploit scripts targeting S7 series controllers in critical infrastructure

US Agencies Warn of AI-Generated Exploits Targeting Siemens S7 PLCs

Do Son August 19, 2026

WarnAt a glance Actor / group Unattributed threat actors (no group named in this advisory) Activity type...

PATCHCORD Malware Hits Afghan Telecom in New APT36 Campaign PATCHCORD malware APT36 SHEETCORD malware Afghan telecom diagram

PATCHCORD Malware Hits Afghan Telecom in New APT36 Campaign

Do Son August 19, 2026

At a glance Actor/Group APT36 / Transparent Tribe (moderate confidence) Activity Type Cyber espionage; custom backdoor delivery...

HoneyMyte CoolClient Rootkit Deploys Kernel Driver Diagram of the new HoneyMyte CoolClient rootkit showing kernel driver deployment

HoneyMyte CoolClient Rootkit Deploys Kernel Driver

Do Son August 19, 2026

At a Glance Actor or Group: HoneyMyte (also known as Mustang Panda) Activity Type: Cyber-espionage and rootkit...

DOJ Charges 17 Iranians in Mabna Institute Cyber Theft Mabna Institute cyber theft indictment chart showing IRGC-linked hacking of universities and companies

Mabna Institute cyber theft indictment chart showing IRGC-linked hacking of universities and companies

DOJ Charges 17 Iranians in Mabna Institute Cyber Theft

Do Son August 19, 2026

At a glance Actor or group Mabna Institute (Iran-based), allegedly for the IRGC Activity type Spearphishing, credential...

Armored Likho Still Toolkit Deploys Covert Spying Implants Armored Likho Still Toolkit architecture and Armored Likho Still Toolkit analysis flow

Armored Likho Still Toolkit architecture and Armored Likho Still Toolkit analysis flow

Armored Likho Still Toolkit Deploys Covert Spying Implants

Do Son August 19, 2026

At a glance Actor or group: Armored Likho (also known as Eagle Werewolf) Activity type: Cyber espionage...

Kimsuky AI Operations Reveal New Cyber Tactics Kimsuky AI operations flow diagram by North Korea threat actor

Kimsuky AI Operations Reveal New Cyber Tactics

Do Son August 18, 2026

At a glance Actor: Kimsuky (suspected North Korea threat actor) Activity type: Spear phishing and AI experimentation...

Head Mare APT Exploits TrueConf Server Flaws to Deploy PhantomCore Backdoor Head Mare TrueConf attack PhantomCore backdoor diagram

Head Mare APT Exploits TrueConf Server Flaws to Deploy PhantomCore Backdoor

Do Son August 17, 2026

At a glance Actor/group Head Mare (tracked by Kaspersky; reclassified from hacktivist group to APT) Activity type...

DEF CON Attendee Suspected in Fake WiFi Attack Targeting Delta Flight 591 Passengers DEF CON hacker fake WiFi hotspot attack Delta flight 591 phishing Google credentials deauthentication

DEF CON hacker fake WiFi hotspot attack Delta flight 591 phishing Google credentials deauthentication

DEF CON Attendee Suspected in Fake WiFi Attack Targeting Delta Flight 591 Passengers

Do Son August 15, 2026

Delta Air Lines is currently investigating the appearance of an unauthorized wireless network aboard Flight 591, which...