Do Son A new report reveals the return of Gayfemboy, a Mirai-based IoT malware strain. It now uses advanced evasion techniques and targets multiple vendors to launch attacks.
threat intelligence
A new RaaS operation called BQTLock is targeting victims with sophisticated malware, aggressive ransom demands, and a tiered subscription model for affiliates.
A dangerous Go package, disguised as a fast SSH brute-force tool, is secretly stealing login credentials and sending them to an attacker via a Telegram bot.
UNC5518 is using "ClickFix," a new technique that weaponizes fake CAPTCHAs to trick users into launching malware and providing access to other criminal groups.
A new report reveals a sophisticated spear-phishing campaign targeting finance executives. The attack uses social engineering and legitimate tools to evade detection.
A new report from Trend Micro details how the Warlock ransomware group is exploiting a vulnerability in unpatched Microsoft SharePoint servers to attack organizations.
A targeted phishing campaign against Israeli organizations uses a PowerShell-based RAT and compromised internal emails for delivery, making detection difficult.
Mustang Panda, a China-aligned APT, is using the ToneShell backdoor to target government and military sectors with phishing and DLL sideloading, masquerading as a legitimate Chrome component.
APT37, a North Korea-linked group, is using a new RoKRAT backdoor to target South Korea. The malware uses stealthy LNK files and steganography to evade detection.
A new report reveals APT36 (Transparent Tribe) is escalating cyber-espionage against India, using phishing and .desktop files to deploy the Poseidon backdoor for long-term access.
Cisco Talos' Q2 2025 report reveals phishing is the top access method. Ransomware, including Qilin, dominated, with a surprising trend of attackers abusing PowerShell 1.0 to evade security.
Trend Micro reports Gunra ransomware has expanded to Linux, employing 100 parallel encryption threads, partial encryption, and stealthy keystore methods to target global enterprises.
Security researcher Vasilis Orlof exposes QWINS LTD, a suspected bulletproof hosting provider registered in the UK, allegedly fueling global malware campaigns with Lumma, Mirai, and more.
Aqua Security's Nautilus team discovered Koske, an advanced Linux cryptojacker likely crafted by AI, hiding in panda images and using rootkits for stealthy operations.
Weeks after a major takedown, Lumma Stealer has resurfaced with new stealth tactics, exploiting cracked software, fake CAPTCHAs, and GitHub to resume its credential-stealing operations.
Kaspersky Labs reveals GhostContainer, a sophisticated backdoor targeting Microsoft Exchange infrastructure in Asia's government and high-tech sectors, using advanced evasion tactics.
Google's GTIG uncovers UNC6148 using stolen credentials and a new rootkit, OVERSTEP, to gain persistent access to end-of-life SonicWall SMA 100 series appliances.
Trellix has uncovered SquidLoader, a highly obfuscated malware targeting Hong Kong financial institutions to deploy Cobalt Strike beacons for persistent control.
The Rainbow Hyena threat cluster is unleashing PhantomRemote, a new backdoor, in phishing attacks against Russia's healthcare and IT sectors, leveraging compromised emails.
Unit 42 exposes SLOW#TEMPEST, a new malware variant using advanced CFG obfuscation and indirect function calls to evade static analysis, making it nearly impossible to detect.
AMOS malware just leveled up—now a backdoor, it poses a serious threat to macOS with persistent access and remote command execution.
Socket uncovers a sprawling network of malicious Firefox extensions, masquerading as games, VPNs, and tools, to hijack affiliate links, steal OAuth tokens, and reroute traffic.