Do Son Zyxel firewalls are under a coordinated attack exploiting critical RCE flaw CVE-2023-28771 (CVSS 9.8) via UDP port 500, likely by Mirai botnets. Patch immediately
Malware
A critical RCE flaw (CVE-2025-3248) in Langflow is being actively exploited to deploy the stealthy Flodrix botnet for reconnaissance and diverse DDoS attacks on AI app servers.
Insikt Group reveals Predator spyware's resurgence, with new infrastructure, obfuscation, and a previously unreported customer in Mozambique, despite sanctions.
Anubis, a new RaaS, combines ECIES encryption with a "wipe mode" that permanently destroys files. It's actively targeting healthcare, construction, and engineering sectors.
Katz Stealer, a new stealthy MaaS, is actively stealing data from browsers, crypto wallets, and apps, using advanced evasion tactics like steganography and Discord hijacking.
HijackLoader and DeerStealer are surging, using ClickFix social engineering and sophisticated evasion to bypass defenses and exfiltrate sensitive data.
Spectra Ransomware, an evolution of Chaos, encrypts Windows files with AES-RSA, demands $5,000 in Bitcoin, and uses double extortion tactics with system evasion
Symantec reports a Fog ransomware attack on an Asian bank that used unusual tools like employee monitoring software and an APT-linked backdoor, suggesting possible espionage.
Paragon's Graphite mercenary spyware exploited a zero-click iOS flaw (CVE-2025-43200) via iMessage, targeting journalists, confirmed by Citizen Lab
CyberEye, a modular .NET RAT, offers widespread data theft and surveillance using a builder, Telegram C2, and anti-analysis features, making it a new threat.
DanaBot's "DanaBleed" memory leak, active for 3 years, exposed C2 server data, aiding law enforcement in Operation Endgame takedown.
Seqrite Labs uncovers Operation DRAGONCLONE, a sophisticated APT campaign targeting China Mobile Tietong with VELETRIX and VShell malware.
Beware 'imad213,' a fake Instagram booster stealing credentials via social engineering and bot services. Learn how to protect your account.
ESET uncovers BladedFeline, an Iran-aligned APT group, targeting KRG, Iraq, and Uzbekistan in a sophisticated cyberespionage campaign.
A new info-stealer, SoraAI.lnk, is leveraging OpenAI's Sora popularity to infect users. Learn how this sophisticated malware works and how to protect your data.
Akamai reports active exploitation of critical Wazuh RCE (CVE-2025-24016) by multiple Mirai botnets, targeting IoT devices since March 2025.
Blitz malware infects gamers via backdoored Standoff 2 cheats, stealing data and cryptojacking. It uses Hugging Face for C2 and targets Windows users globally.
CYFIRMA uncovers DuplexSpy, a powerful C# RAT on GitHub with surveillance, persistence, and anti-analysis features, posing a significant cybercrime threat.
Two malicious npm packages, express-api-sync and system-health-sync-api, act as remote-controlled time bombs, wiping entire directories with a single POST request.
An old Microsoft Office vulnerability (CVE-2017-0199) is being exploited in a new phishing campaign to deploy the FormBook infostealer malware. Update now!
"EnigmaCyberSecurity" is a new multi-stage cybercrime campaign hitting Brazil and beyond, using phishing, malicious extensions, and RATs to steal banking data.
A new Mirai botnet variant is exploiting CVE-2024-3721 to infect vulnerable DVRs. Learn how this sophisticated attack works and if your surveillance system is at risk.