Arctic Wolf Archives • Daily CyberSecurity

CastleLoader Malware Now Delivers NeedleStealer Wallet and Browser Spoofers

CastleLoader malware infection chain delivering NeedleStealer crypto wallet spoofer and NetSupport RAT

CastleLoader Malware Now Delivers NeedleStealer Wallet and Browser Spoofers

Do Son August 3, 2026

CastleLoader malware now delivers NeedleStealer, a Rust crypto wallet spoofer and Golang browser hijacker. Arctic Wolf tracks three new campaigns.

Qilin Ransomware Deployed via Palo Alto GlobalProtect Flaw CVE-2026-0257 Qilin ransomware attack chain starting with a Palo Alto GlobalProtect CVE-2026-0257 authentication bypass

Qilin ransomware attack chain starting with a Palo Alto GlobalProtect CVE-2026-0257 authentication bypass

Qilin Ransomware Deployed via Palo Alto GlobalProtect Flaw CVE-2026-0257

Do Son July 21, 2026

Arctic Wolf links Qilin ransomware attacks to CVE-2026-0257, a Palo Alto GlobalProtect auth bypass used for initial access. Patch PAN-OS now.

292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users Fake GitHub repositories BoryptGrab infostealer attack chain diagram

292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users

Do Son July 17, 2026

Arctic Wolf found 292 fake GitHub repositories impersonating software vendors to deliver a BoryptGrab-lineage infostealer via DLL side-loading.

Critical FortiClient EMS Exploitation Campaign Spreads New EKZ Infostealer Payload

FortiClient EMS exploitation Cisco FIRESTARTER Backdoor Arcane Door Campaign Dell RecoverPoint Zero-Day UNC6201 Espionage Notepad++ Compromise Supply Chain Attack Magento SessionReaper CVE-2025-54236 ShadowRay 2.0, AI-Generated Malware WordPress Auth Bypass, CVE-2025-5947 Exploited EcoStruxure Vulnerabilities, Industrial Control System UNC5820 - CVE-2014-2120 - CVE-2021-44207

Critical FortiClient EMS Exploitation Campaign Spreads New EKZ Infostealer Payload

Do Son May 28, 2026

Arctic Wolf warns of a new FortiClient EMS exploitation campaign using CVE-2026-35616 to deploy the stealthy EKZ Infostealer malware.

Inside BlueNoroff’s “Self-Reinforcing” Deepfake Meeting Trap BlueNoroff Deepfakes Crypto Deepfake Phishing

Inside BlueNoroff’s “Self-Reinforcing” Deepfake Meeting Trap

Do Son April 28, 2026

BlueNoroff uses a "self-reinforcing" deepfake pipeline to target crypto CEOs. Fake Zoom meetings and stolen footage lead to a 5-minute system compromise.

Critical Quest KACE Flaw Exploited for Total Network Takeover Quest KACE Vulnerability CVE-2025-32975 FortiGate SSO Bypass, Active Exploitation GoAnywhere RCE, Storm-1175 Cisco VPN RCE, ASA Zero-Day TinyColor Supply Chain Attack SK Telecom, data breach Erlang/OTP RCE, OT Network Security Ivanti CSA Attacks WordPress RCE, Theme Vulnerability

Quest KACE Vulnerability CVE-2025-32975 FortiGate SSO Bypass, Active Exploitation GoAnywhere RCE, Storm-1175 Cisco VPN RCE, ASA Zero-Day TinyColor Supply Chain Attack SK Telecom, data breach Erlang/OTP RCE, OT Network Security Ivanti CSA Attacks WordPress RCE, Theme Vulnerability

Critical Quest KACE Flaw Exploited for Total Network Takeover

Do Son March 20, 2026

Arctic Wolf warns that hackers are actively exploiting a critical Quest KACE vulnerability (CVE-2025-32975) to completely take over enterprise networks.

The BurrowShell Threat: Inside ‘Sloppy Lemming’s’ Stealthy Cyber Espionage Campaign in South Asia Sloppy Lemming BurrowShell Malware

The BurrowShell Threat: Inside ‘Sloppy Lemming’s’ Stealthy Cyber Espionage Campaign in South Asia

Do Son March 4, 2026

Arctic Wolf details a year-long cyber espionage campaign by Sloppy Lemming, deploying the custom BurrowShell malware against Pakistan and Bangladesh.

Exploited in the Wild: Critical BeyondTrust Flaw (CVSS 9.9) Opens Door to Network Takeover BeyondTrust Vulnerability CVE-2026-1731

Exploited in the Wild: Critical BeyondTrust Flaw (CVSS 9.9) Opens Door to Network Takeover

Do Son February 15, 2026

Arctic Wolf warns of CVE-2026-1731, a critical BeyondTrust flaw exploited in the wild. Attackers use it to deploy backdoors. Patch self-hosted instances now.

“New” Path of Attack: Fully Upgraded Fortinet Devices Hit by SSO Exploits Fortinet patch bypass 2026, FortiGate SSO authentication exploit SharePoint Zero-Day, China APTs Exploited Vulnerabilities 2023

Fortinet patch bypass 2026, FortiGate SSO authentication exploit SharePoint Zero-Day, China APTs Exploited Vulnerabilities 2023

“New” Path of Attack: Fully Upgraded Fortinet Devices Hit by SSO Exploits

Do Son January 23, 2026

Fortinet warns of a new Jan 2026 attack path bypassing December’s patches. Attackers use FortiCloud SSO to hijack firewalls. Learn the critical fix.

New Campaign Targets FortiGate Firewalls with Unauthorized Config Changes BingX cyberattack FortiGate SSO Attacks Firewall Config Theft

New Campaign Targets FortiGate Firewalls with Unauthorized Config Changes

Do Son January 22, 2026

Arctic Wolf warns of automated FortiGate SSO attacks stealing configs and creating backdoors. Disable admin-forticloud-sso-login immediately.

CVE-2024-7399: Samsung MagicINFO Vulnerability Now Actively Exploited in the Wild Samsung MagicINFO, remote code execution

CVE-2024-7399: Samsung MagicINFO Vulnerability Now Actively Exploited in the Wild

Do Son May 5, 2025

CVE-2024-7399 vulnerability actively exploited in Samsung MagicINFO 9 Server allows remote code execution. Arctic Wolf reports in-the-wild attacks. Upgrade now!

Venom Spider Evolves: Arctic Wolf Exposes More_eggs Campaign Targeting HR More_eggs, Venom Spider

Venom Spider Evolves: Arctic Wolf Exposes More_eggs Campaign Targeting HR

Do Son May 5, 2025

Arctic Wolf exposes Venom Spider’s More_eggs campaign, where fake resumes and polymorphic JavaScript target HR to deploy a stealthy backdoor.