Where Cyber News Becomes Intelligence.
A continuously refreshed global view of cyberattacks, breaches, ransomware, threat campaigns, security research, cloud and AI security, plus only the most newsworthy vulnerability developments.
Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks. Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever.
Key Reasons Why Identity Fabric Matters in 2026. As enterprise access spans more cloud services and automated workloads, identity security depends less on static configuration and more on runtime visibility.
ATF confirms “major incident” after recent Qilin breach claims. The Bureau of Alcohol, Tobacco, Firearms and Explosives has described it as a ‘major incident’ and it’s conducting an investigation with the DOJ.
Some Malicious PE Stats, (Thu, Aug 27th). 32bits malware[ 1 ].
LiteLLM Supply Chain Attack: 2,500+ Companies Exposed in the Largest AI Supply Chain Breach of 2026. The security significance comes from trust: Trivy or the affected component sits in a software, development or delivery path that downstream teams may already allow to run automatically.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. This is an overview of the campaign, examining the countries affected, potential impact of BadIIS infections, the attack chain, and post-compromise tactics.
ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories. Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers, according to threat intelligence company Defused.
What the Data Says About AI in Security Operations in 2026. According to Prophet Security's State of AI in Security Operations 2026 report (produced from ViB’s survey of 250+ cybersecurity pros), 40% of security teams now use AI daily.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. AI is changing the harder part: how much time defenders have left to act.
AI-Agent-Driven Offensive Operation : Exposed Adversary Open Directory Reveals Autonomous Crypto-Theft Campaign Leading to Mass Wallet and Credential Compromise. The exposed infrastructure also revealed a developing blockchain-based command-and-control system designed to make future operations mo...
The State of Ransomware Q2 2026. Ransomware or extortion is part of the impact, which means the incident also involves disruption, recovery pressure or leverage over the affected organization.
Caught in 4K: The Aurora Files. A misconfigured server opened a window straight into an Aurora ransomware operator's playbook: attacker tools, AI-assisted planning, and a look inside the actual negotiation panel where a victims and the operator settled on payment.
A polymorphic phishing page (that occasionally breaks itself), (Thu, Aug 27th). As I've mentioned before in some of my diaries, from time to time, I like to go over phishing messages that get caught in my various spam traps or sent to us here at the Internet Storm Center.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. By structuring the analysis process, enforcing skeptical validation steps, and injecting domain-specific huma.
UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments. Telemetry and infrastructure analysis reveal that rather than disbanding, UNC6671 has diversified its operations across multiple extortion fronts.
68-year-old imprisoned after making $1.3 million by pirating IPTV services. to more than six years in prison for operating an illegal IPTV (Internet Protocol Television) service that generated £980,812 ($1.3 million) over three years.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. The issue currently carries a High severity signal in the CyberDeltaForce record.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. Organisations now depend on cloud applications, digital platforms, connected devices, third-party vendors, social media, and online customer channels to deliver products and services.
Brand Protection in Cybersecurity: Protecting Businesses from Digital Threats. It represents the trust customers place in a business, the reputation it has built, and the digital experiences associated with its name.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. Pretty much any software accepting an IP address will also accept a hostname as an argument.
Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia. Examples of these techniques can be found.
BRIDGEHEAD : An npm typosquatting campaign that crosses from WSL into Windows to plant a crypto-wallet stealer. The malware targets cryptocurrency wallets, browser credentials, cookies and Telegram sessions, while executing largely in memory and using public infrastructure for reconnaissance and ...
Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect. Further analysis of the infrastructure reveals that the infection chain starts with a ClickFix social-engineering technique, which prompts victims to execute a PowerShell command.
17th August – Threat Intelligence Report. TOP ATTACKS AND BREACHES Colombia’s Ministry of Justice has experienced a ransomware attack that affected part of its technology infrastructure and disrupted public services related to illicit-drug monitoring and legal processes.
Access For Sale: Inside a Russian-Speaking Access Broker's Dual Operation. The investigation connects credential theft, Active Directory compromise, and access sales to ransomware groups, while also uncovering surveillance activity targeting Ukrainian defence and aerospace organizations.
UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities. The reporting includes an identity or credential element, which matters because a valid account or session can let an attacker move through trusted systems without relying only on malware.
VIT Bhopal opens applications for International Master in Cybersecurity Management with POLIMI GSoM Italy - Careers360. VIT Bhopal University Accepting Applications for International Cybersecurity Masters with POLIMI GSoM, Italy India Education Diary.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. But the threat already exists, as attackers use the "harvest now, decrypt later" tactic.
A security weakness in Azure is being tracked as a newly reported vulnerability. Tenable One Cloud Exposure uses AI-powered threat stories to expose Storm-0501 TTPs, backed by precision-engineered threat detection alerts.
A security weakness in Hugging Face is being tracked as a newly reported vulnerability. The analysis maps the published incident to Qualys Container Runtime Security, Kubernetes Security Posture Management, and Cloud Detection.
A security weakness in Windows is being tracked as a newly reported vulnerability. The security flaw, which does not have a CVE identifier, works against Kiro IDE 0.7.45 on Windows, according to Mindguard.
New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access. A newly disclosed Rowhammer attack called GPUThor can bypass error-correcting code (ECC) protections on NVIDIA GPUs, enabling denial-of-service (DoS) and root-level privilege escalation.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. "The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims.
WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords. According to findings from Gen Digital, WordlistLoader is being used to deliver Amatera Stealer (aka ACR Stealer or AcridRain Stealer) via ClearFake campaigns, which employ the ClickFix (aka FakeCaptcha).
Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows. The commercial phishing-as-a-service toolkit targets Microsoft 365 accounts by abusing legitimate login flows and bypassing two-factor authentication.
Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor. The campaign, codenamed Operation QUICSILVER, has been found to target government and information technology sectors, per Seqrite Labs.
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit. The vast majority of the targets are located in Brazil, Bolivia, China, Canada, and Vietnam.