Cybercriminals Archives • Page 3 of 35 • Daily CyberSecurity

Microsoft GDID Tracking: How Windows Caught a Hacker Microsoft GDID tracking visualization identifying Scattered Spider hacker Peter Stokes

Microsoft GDID tracking visualization identifying Scattered Spider hacker Peter Stokes

Microsoft GDID Tracking: How Windows Caught a Hacker

Do Son July 6, 2026

On July 1, 2026, the US Department of Justice and the FBI announced the extradition of a...

TAG-182 Threat Cluster Spreads MarkiRAT Malware Diagram of TAG-182 threat cluster spreading MarkiRAT malware

TAG-182 Threat Cluster Spreads MarkiRAT Malware

Do Son July 6, 2026

At a glance: Actor/Group: TAG-182 threat cluster (suspected Iran-nexus) Activity Type: Cyber surveillance and malware distribution Targets/Victims:...

The Fall of HiAnime: Vietnamese Police Arrest Piracy Ring Vietnamese police conduct HiAnime piracy arrests, dismantling a massive illegal anime streaming syndicate.

Vietnamese police conduct HiAnime piracy arrests, dismantling a massive illegal anime streaming syndicate.

The Fall of HiAnime: Vietnamese Police Arrest Piracy Ring

Do Son July 6, 2026

In March 2026, HiAnime abruptly announced its closure and issued a farewell statement. This platform was arguably...

FBI Warns of TeamPCP Supply Chain Attack TeamPCP supply chain attack and software supply chain compromise alert

FBI Warns of TeamPCP Supply Chain Attack

Do Son July 4, 2026

At a glance Actor TeamPCP Activity type Software supply chain compromise Targets Enterprise developers, security tools Scale...

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills Lazarus npm malware masquerading as Rollup polyfill packages in a supply chain attack

Lazarus npm malware masquerading as Rollup polyfill packages in a supply chain attack

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

Do Son July 3, 2026

At a glance Actor Suspected North Korean Lazarus-linked group (attribution by TTP similarity) Activity npm supply chain...

ToddyCat APT Umbrij Tool Steals Cloud Email Tokens Diagram of ToddyCat APT Umbrij tool performing OAuth token theft from Chrome

ToddyCat APT Umbrij Tool Steals Cloud Email Tokens

Do Son July 3, 2026

Security analysts recently discovered the ToddyCat APT Umbrij tool. It hijacks corporate Gmail accounts without triggering standard...

Mustang Panda Abuses Zoho WorkDrive in Espionage Attacks on India’s Government AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

Mustang Panda Abuses Zoho WorkDrive in Espionage Attacks on India’s Government

Do Son July 2, 2026

At a glance Group Mustang Panda (China-aligned APT; also tracked as Hive0154) Activity Cyberespionage, spear-phishing, cloud-service C2...

The Gentlemen Ransomware Group Expands With New Lockers and Custom Tools SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

The Gentlemen Ransomware Group Expands With New Lockers and Custom Tools

Do Son July 2, 2026

At a glance Group The Gentlemen (ransomware-as-a-service) Activity Ransomware, data-leak extortion, custom tool development Targets Large firms...

Pro-Russia Influence Ecosystem Expands Global Reach Diagram showing the pro-Russia influence ecosystem and information operations

Pro-Russia Influence Ecosystem Expands Global Reach

Do Son July 2, 2026

At a glance Actor: Suspected Russian state-sponsored actors and proxies Activity type: Covert information operations and hacktivism...

Scattered Spider Arrest: Teen Extradited in $100M Scheme Scattered Spider arrest suspect Peter Stokes extradition

Scattered Spider Arrest: Teen Extradited in $100M Scheme

Do Son July 2, 2026

At a glance Actor or Group: Scattered Spider (Octo Tempest, UNC3944, 0ktapus) Activity Type: Data extortion, computer...

UNC1151 Phishing Campaign Targets Belarus and Ukraine UNC1151 phishing campaign login page created by the Ghostwriter threat actor.

UNC1151 Phishing Campaign Targets Belarus and Ukraine

Do Son July 1, 2026

At a glance Actor: UNC1151 (Ghostwriter / Frosty Neighbor) Activity type: Spear-phishing and credential theft Targets: Belarusian...

Operation DragonReturn Targets Indian Tax Infrastructure WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

Operation DragonReturn Targets Indian Tax Infrastructure

Do Son July 1, 2026

At a glance Actor: Suspected China-nexus threat cluster Activity type: Spear-phishing and cyber espionage Targets: Indian taxpayers,...

Hospitality Malware Campaign Deploys Node.js Implant digital-hacker

Hospitality Malware Campaign Deploys Node.js Implant

Do Son June 30, 2026

At a glance Actor: Unknown threat actor Activity type: Phishing and multi-stage intrusion Targets: Hospitality and hotel...

TinyRCT Backdoor Attacks Target Asian Critical Infrastructure digital-hacker

TinyRCT Backdoor Attacks Target Asian Critical Infrastructure

Do Son June 30, 2026

At a glance Actor or Group: CL-STA-1062 (suspected Chinese-speaking actors) Activity Type: Cyber espionage and network infiltration...

Thailand Healthcare Malware Exploits RAR Archives Diagram showing the Thailand healthcare malware infection chain via RAR archive phishing

Diagram showing the Thailand healthcare malware infection chain via RAR archive phishing

Thailand Healthcare Malware Exploits RAR Archives

Do Son June 29, 2026

At a glance Actor: Suspected unknown threat cluster (tracked by Seqrite Lab) Activity Type: Spear-phishing, credential theft,...

US Seizes Domains to Stop Illegal World Cup Streaming Law enforcement officials announce domain seizures to stop illegal World Cup streaming.

US Seizes Domains to Stop Illegal World Cup Streaming

Do Son June 27, 2026

At a Glance Actor or Group: Unnamed digital piracy networks Activity Type: Copyright infringement Targets or Victims:...

US Offers $10 Million Reward for Russian Hacker Group UNC5792 UNC5792 Rewards for Justice $10 million reward Russian Signal phishing group

US Offers $10 Million Reward for Russian Hacker Group UNC5792

Do Son June 27, 2026

At a Glance Actor / group UNC5792 (linked to FSB Border Guards); UNC4221 (Russian military) Activity Phishing...

Cisco SD-WAN Zero-Day Exploited in Attacks Diagram explaining the Cisco SD-WAN zero-day and CVE-2026-20245 exploitation

Cisco SD-WAN Zero-Day Exploited in Attacks

Do Son June 26, 2026

At a glance Actor: Unknown threat actor Activity Type: Privilege escalation and zero-day exploitation Targets: Service provider...

WhatsApp Malware Campaign Spreads RMM Software

Diagram showing the WhatsApp malware campaign and VBScript infection chain

WhatsApp Malware Campaign Spreads RMM Software

Do Son June 26, 2026

At a glance Actor: Suspected Chinese-speaking threat actor (low confidence) Activity Type: Malware distribution and silent RMM...

Fake Shop Campaigns Target Europe Fake shop campaigns selling counterfeit goods in Europe

Fake Shop Campaigns Target Europe

Do Son June 26, 2026

At a glance Actor: Suspected cybercriminal networks (e.g., “Supplier Carl” and “Homborg Online Handel”) Activity Type: Fake...

Laravel Livewire Vulnerability Exposes Over 6,000 Apps Diagram showing the Laravel Livewire vulnerability and CVE-2025-54068 exploit flow

Laravel Livewire Vulnerability Exposes Over 6,000 Apps

Do Son June 25, 2026

At a glance Actor: Suspected Indonesian-origin threat actor (“Wong Gen Deng”) Activity Type: Unauthenticated Remote Code Execution...

Operation Endgame Takes Down SocGholish, Amadey, and StealC Malware Operation Endgame takedown disrupting the SocGholish malware network

Operation Endgame Takes Down SocGholish, Amadey, and StealC Malware

Do Son June 25, 2026

At a Glance Actor / group SocGholish operator (TA569), linked to Russia’s Evil Corp; Amadey and StealC...

Critical Alert 1 Active Exploit Detected Today