Cybercriminals Archives • Page 2 of 41 • Daily CyberSecurity

Attackers Exploit Citrix NetScaler Zero-Day CVE-2026-88772 to Plant Hidden Web Shells

Citrix NetScaler zero-day CVE-2026-88772 exploited to deploy WHIPSHOT web shell and SLAPSHOT tunneler

Attackers Exploit Citrix NetScaler Zero-Day CVE-2026-88772 to Plant Hidden Web Shells

Do Son October 1, 2026

Since at least early September 2026, attackers have taken root-level control of Citrix NetScaler appliances without a...

Russia’s Star Blizzard Scales Up Phishing With RedFlick to Deliver CosmicPulse Backdoor Star Blizzard RedFlick phishing campaign using scheduled tasks to install the CosmicPulse backdoor

Star Blizzard RedFlick phishing campaign using scheduled tasks to install the CosmicPulse backdoor

Russia’s Star Blizzard Scales Up Phishing With RedFlick to Deliver CosmicPulse Backdoor

Do Son September 30, 2026

Since January 2026, a Russian state hacking group has sent at least 13 large phishing waves to...

Nigeria-Based Fraudsters Hijack .edu Accounts to Run University Job Scams University job scams using edu account takeover to send fake job offers to college students

University job scams using edu account takeover to send fake job offers to college students

Nigeria-Based Fraudsters Hijack .edu Accounts to Run University Job Scams

Do Son September 30, 2026

A fake IT form told students to type their password into a field labeled “WORDWORD.” The trick...

SVG Phishing Attacks Return in August as Symantec Logs 222,000 Detections SVG phishing attacks using SVG smuggling to hide fake login pages inside image attachments

SVG phishing attacks using SVG smuggling to hide fake login pages inside image attachments

SVG Phishing Attacks Return in August as Symantec Logs 222,000 Detections

Do Son September 30, 2026

Symantec blocked 26,433 malicious SVG files in August 2026, nearly double its six-month average. That jump marks...

Microsoft Links JADEPUFFER Azure Attack to Agentic Ransomware Actor Storm-3168 JADEPUFFER Azure attack by agentic ransomware actor Storm-3168 using compromised service principals

JADEPUFFER Azure attack by agentic ransomware actor Storm-3168 using compromised service principals

Microsoft Links JADEPUFFER Azure Attack to Agentic Ransomware Actor Storm-3168

Do Son September 30, 2026

Two stolen Azure identities gave one attacker control over an entire cloud tenant in June 2026. According...

ShinyHunters Renews Oracle PeopleSoft Attacks With One-Character WAF Bypass North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

ShinyHunters Renews Oracle PeopleSoft Attacks With One-Character WAF Bypass

Do Son September 29, 2026

Changing one letter to its URL code let attackers walk past firewall rules meant to block a...

Operation Master Turns GlobalProtect Breaches Into Brazilian Invoice Fraud Operation Master invoice fraud pipeline from GlobalProtect VPN breach to fake utility bills

Operation Master invoice fraud pipeline from GlobalProtect VPN breach to fake utility bills

Operation Master Turns GlobalProtect Breaches Into Brazilian Invoice Fraud

Do Son September 29, 2026

Fake energy bills went out to Brazilian customers more than 2.4 million times this summer. Each one...

Konni Launches Operation Conflict Compass Against Ukraine Diagram of Konni Operation Conflict Compass showing the Operation Conflict Compass infection chain

Diagram of Konni Operation Conflict Compass showing the Operation Conflict Compass infection chain

Konni Launches Operation Conflict Compass Against Ukraine

Do Son September 28, 2026

At a Glance Attribute Details Actor or Group Konni (also tracked as TA406 and Opal Sleet; suspected...

Kiteworks Mandates Global Precautionary Server Shutdown Kiteworks secure file transfer interface depicting a precautionary server shutdown

Kiteworks Mandates Global Precautionary Server Shutdown

Do Son September 28, 2026

Kiteworks urgently instructed its entire clientele to temporarily disconnect their secure file transfer servers. This followed a...

TraderTraitor macOS Backdoors Target IT Service Firms CloudComputating - QSC framework

TraderTraitor macOS Backdoors Target IT Service Firms

Do Son September 28, 2026

At a Glance Attribute Details Actor or Group TraderTraitor (aka UNC4899, Jade Sleet, PUKCHONG) Activity Type Fake...

TeamFiltration Password Spray Campaign Hits Chile illegal streaming networks complex criminal enterprises UAT-7290 China-nexus Espionage Adversarial Misuse of Generative AI

illegal streaming networks complex criminal enterprises UAT-7290 China-nexus Espionage Adversarial Misuse of Generative AI

TeamFiltration Password Spray Campaign Hits Chile

Do Son September 25, 2026

At a Glance Attribute Details Actor or Group UNK_Condor Filtration (unattributed cybercrime operator) Activity Type Password spraying,...

Chinese Hackers Deploy UTA0565 Zero-Day Exploits Diagram of Chinese UTA0565 zero-day exploits showing how UTA0565 zero-day exploits drop CLEANGULP malware

Diagram of Chinese UTA0565 zero-day exploits showing how UTA0565 zero-day exploits drop CLEANGULP malware

Chinese Hackers Deploy UTA0565 Zero-Day Exploits

Do Son September 24, 2026

At a Glance Attribute Details Actor or Group UTA0565 (suspected Chinese state-sponsored espionage group) Activity Type Spear-phishing,...

Italian Phishing Campaign Delivering an iOS Exploit Chain

Do Son September 24, 2026

At a Glance Attribute Details Malware Family Coruna Pro V2 (modified variant) Threat Actor Unknown (Telegram handle:...

SideCopy APT Campaign Targets Academic Institutions CoreRAT malware decoy PDF used in Core Werewolf phishing attack on Russian defense targets

CoreRAT malware decoy PDF used in Core Werewolf phishing attack on Russian defense targets

SideCopy APT Campaign Targets Academic Institutions

Do Son September 23, 2026

At a Glance Attribute Details Actor or Group SideCopy (suspected Pakistan-nexus threat group) Activity Type Spear-phishing, living-off-the-land...

The WaterPlum Cyber Actor Group Targets Global IT Professionals A diagram detailing the North Korean WaterPlum cyber actor group infection chain

A diagram detailing the North Korean WaterPlum cyber actor group infection chain

The WaterPlum Cyber Actor Group Targets Global IT Professionals

Do Son September 23, 2026

At a Glance Summary Attribute Details Actor or Group North Korean WaterPlum cyber actor group (Contagious Interview)...

Microsoft Disrupts EvilTokens Cybercrime Platform Disrupting EvilTokens cybercrime platform infrastructure and the EvilTokens cybercrime platform portal

Disrupting EvilTokens cybercrime platform infrastructure and the EvilTokens cybercrime platform portal

Microsoft Disrupts EvilTokens Cybercrime Platform

Do Son September 22, 2026

At a Glance Attribute Details Actor or Group Storm-2992 and associated cybercrime subscribers Activity Type Phishing-as-a-Service, device...

Operation RapidRust APT36 Campaign Targets Governments Half-click exploits chain showing webmail zero-days used by TA488 and TA458 against Zimbra, SOGo and Roundcube mailservers

Half-click exploits chain showing webmail zero-days used by TA488 and TA458 against Zimbra, SOGo and Roundcube mailservers

Operation RapidRust APT36 Campaign Targets Governments

Do Son September 22, 2026

At a Glance Attribute Details Actor or Group APT36 (also known as Transparent Tribe) Activity Type Cyber...

Kapibala WordPress Exploitation Attacks Hit Governments Diagram showing Kapibala WordPress exploitation attacks and Kapibala WordPress exploitation timeline

Diagram showing Kapibala WordPress exploitation attacks and Kapibala WordPress exploitation timeline

Kapibala WordPress Exploitation Attacks Hit Governments

Do Son September 22, 2026

At a Glance Attribute Details Actor or Group Suspected Chinese cyber actor (associated with Red Heron) Activity...

NightEagle APT GhostContainer Attacks Target Russia

NightEagle APT GhostContainer attacks on Exchange servers

NightEagle APT GhostContainer Attacks Target Russia

Do Son September 21, 2026

At a Glance Actor or group: NightEagle (also tracked as APT-Q-95). Activity type: Cyberespionage, tunneling, and Active...

Google Undercover Analyst Infiltrates Hacking Gang

Google undercover analyst infiltrating the TeamPCP hacking gang network

Google Undercover Analyst Infiltrates Hacking Gang

Do Son September 21, 2026

The Google Threat Intelligence team recently disclosed at a security conference that a security researcher from its...

PAPERMILL Cybercrime Cluster Delivers VenomRAT via Tax Lures Rust supply chain attack on arrayref crate with proc-macro1 typosquat and DPRK infrastructure overlap