Intelligence Feed

3w ago · Datadog Security Labs

Threat actor MUT-1244 targets offensive security actors, including pentesters and researchers, using phishing campaigns and trojanized GitHub repositories to deliver a second-stage payload. The payload exfiltrates sensitive data such as SSH keys, AWS credentials, and environment variables. Over 390,000 WordPress credentials were harvested after compromising threat actors who used a trojanized credential checker tool named 'yawpp'. The actor leverages multiple initial access methods, including malicious npm packages and phishing emails, to distribute the same backdoor.

3w ago · hunt.io

A macOS-targeted campaign dubbed 'Odyssey Stealer & AMOS' is actively distributing malware to developers through fake software download sites impersonating trusted platforms like Homebrew, TradingView, and LogMeIn. Attackers use social engineering tactics, including clipboard manipulation and base64-encoded commands, to trick users into executing malicious payloads. The campaign leverages reused infrastructure, including IP addresses and SSL certificates, to distribute stealer malware capable of harvesting system data, browser credentials, and cryptocurrency wallets.

3w ago · bleepingcomputer

Over 266,000 F5 BIG-IP instances are exposed online following a breach of F5's network by suspected China-nexus threat actor UNC5291, which stole source code and information on undisclosed vulnerabilities. F5 has released patches for 44 vulnerabilities and urged immediate customer action, while CISA issued an emergency directive for federal agencies to patch or disconnect exposed systems. The attackers used the Go-based Brickstorm malware and had access to F5's network for at least a year. Threat actors are targeting these devices to breach networks, steal credentials, and establish persistence.

3w ago · Datadog Security Labs

Stressed Pungsan, a DPRK-aligned threat actor, has been observed leveraging malicious npm packages for initial access. The actor published two packages, 'harthat-hash' and 'harthat-api', which execute a preinstall script to download and run a malicious DLL from a C2 server. The infrastructure and TTPs align with Microsoft's MOONSTONE SLEET, indicating a focus on Windows environments and potential espionage or credential theft objectives.

3w ago · Datadog Security Labs

A new opportunistic campaign exploiting the Log4Shell vulnerability (CVE-2021-44228) has been observed targeting vulnerable Java applications. The attack uses obfuscated LDAP requests to deliver a malicious Java class, which downloads and executes a crypto-mining payload (XMRig) and establishes persistence via systemd or cron. The threat actor exfiltrates system information and maintains remote access through encrypted reverse shells using Perl and netcat.

3w ago · Datadog Security Labs

In September 2024, Datadog Security Research identified three malicious npm packages—passports-js, bcrypts-js, and blockscan-api—linked to the DPRK-associated threat actor 'Tenacious Pungsan'. These packages distributed BeaverTail, a JavaScript infostealer and downloader used in the Contagious Interview campaign targeting US tech job-seekers. The malware steals cryptocurrency wallet data, browser credentials, and deploys a second-stage Python backdoor called InvisibleFerret. The activity is tied to known infrastructure and overlaps with prior Contagious Interview TTPs, indicating ongoing targeting of developers.

3w ago · Datadog Security Labs

MUT-8694 is a persistent threat actor conducting a supply chain attack across both npm and PyPI ecosystems, distributing malicious packages that deliver infostealer malware to Windows users. The campaign uses typosquatting and obfuscated code to distribute Blank Grabber and Skuld Stealer, both open-source infostealers targeting credentials, cryptocurrency wallets, and gaming data. The threat actor leverages legitimate services like GitHub and Replit to host payloads and employs PowerShell-based execution and evasion techniques, including disabling Windows Defender and exfiltrating data via Telegram and Discord.

3w ago · fortinet

FortiGuard Labs has identified a persistent hacker group conducting phishing campaigns across Asia, targeting users in Mainland China, Taiwan, Japan, and Malaysia. The group uses malicious PDFs, Word, and Excel documents that mimic official government communications to deliver malware such as Winos 4.0 and HoldingHands. The attacks have evolved to include multi-stage delivery mechanisms, abuse of legitimate digital signatures, and use of Windows Task Scheduler for stealthy execution, complicating detection and analysis.

3w ago · wiz

Wiz Research discovered a series of critical unauthenticated Remote Code Execution (RCE) vulnerabilities in Ingress NGINX Controller for Kubernetes, collectively dubbed IngressNightmare. These vulnerabilities (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974) allow attackers to inject malicious NGINX configurations and achieve remote code execution on the ingress controller pod, leading to full cluster compromise. The admission controller, which is exposed without authentication by default, enables exploitation by processing untrusted admission review requests. Over 43% of cloud environments are estimated to be vulnerable, with more than 6,500 clusters already exposed to the public internet.

3w ago · Datadog Security Labs

CVE-2025-29927 is a critical authorization bypass vulnerability in Next.js middleware that allows attackers to skip security checks by exploiting improper handling of the internal 'x-middleware-subrequest' header. Exploitation involves sending a crafted HTTP request with this header to bypass middleware protections, potentially exposing administrative routes and sensitive content. The vulnerability affects self-hosted Next.js applications using vulnerable versions prior to specific patched releases, with immediate remediation advised through upgrading or implementing temporary mitigations.

3w ago · Datadog Security Labs

MUT-9332 is a threat actor targeting Solidity developers via malicious Visual Studio Code extensions named solaibot, among-eth, and blankebesxstnion. These extensions deliver multi-stage malware that establishes persistence, disables security controls, and exfiltrates cryptocurrency wallet credentials. The campaign uses obfuscated scripts, steganography, and multiple command-and-control domains to evade detection, with infrastructure reuse indicating links to a prior Monero cryptominer campaign.

3w ago · Datadog Security Labs

The Mimo threat actor, previously known for targeting Craft CMS, has expanded its operations to compromise Magento CMS platforms and misconfigured Docker instances through PHP-FPM vulnerabilities. The actor employs sophisticated persistence and evasion techniques, including GSocket-based reverse shells, in-memory execution via memfd_create(), and process masquerading to mimic kernel threads. Mimo monetizes compromised systems through cryptojacking using XMRig and proxyjacking via IPRoyal Pawns, indicating a dual revenue strategy. This evolution reflects increased operational sophistication and a broader targeting scope beyond CMS platforms.

3w ago · bleeping-computer

Threat actors have exploited a recently patched SNMP vulnerability (CVE-2025-20352) in Cisco IOS and IOS XE devices to deploy a rootkit on vulnerable switches, enabling them to bypass access controls, manipulate logs, and move laterally across VLANs. The attacks, tracked as 'Operation Zero Disco' by Trend Micro, target older Linux systems lacking endpoint detection and response solutions. The rootkit includes fileless components that persist across reboots via IOSd hooks, and attackers also attempted to exploit the older CVE-2017-3881 vulnerability. Cisco confirmed the exploitation of CVE-2025-20352 as a zero day, with no reliable detection tool currently available.

3w ago · hacker-news

A security researcher published a proof-of-concept exploit for a critical remote code execution (RCE) vulnerability in GitLab, affecting self-managed instances from versions 15.2.0 to 19.0.1. The vulnerability allows authenticated users to execute arbitrary commands as the 'git' user by exploiting memory corruption bugs in the Oj Ruby JSON parser via crafted Jupyter notebooks. Despite being patched in June 2026, the fix was not classified as a security update, leading to potential under-prioritization by administrators. No CVE has been assigned, and exploitation in the wild has not been observed.

3w ago · bleeping-computer

OpenAI has confirmed a worldwide outage affecting ChatGPT, with users across the U.S., Europe, India, Japan, Australia, and other regions reporting connectivity issues. The company is actively investigating the cause of the disruption, which began within the last 30 minutes. No evidence of a cyber attack or compromise has been provided in the article; the nature of the incident appears to be service degradation rather than malicious activity.

3w ago · static-urls

Cavalry Werewolf conducted targeted phishing campaigns from May to August 2025, primarily against Russian public sector entities and critical infrastructure organizations. The attackers impersonated Kyrgyz government officials and delivered custom malware, including FoalShell reverse shells and StallionRAT, via malicious RAR attachments. These tools enabled remote command execution, data exfiltration, and persistence through registry modifications, with command and control communications routed through Telegram bots and proxy tools.

3w ago · welivesecurity

ESET Research has uncovered the first known collaboration between two Russian FSB-affiliated APT groups, Gamaredon and Turla, targeting high-profile entities in Ukraine. Gamaredon provided initial access and infrastructure to Turla, enabling the deployment and reactivation of Turla's Kazuar backdoor on compromised systems. This cooperation suggests a strategic alignment between the two groups, with Gamaredon acting as an access provider for Turla's more targeted espionage operations.

3w ago · hacker-news

The EvilAI campaign involves threat actors distributing malware disguised as legitimate AI and productivity tools to infiltrate organizations globally. These trojans use valid digital signatures and professional interfaces to evade detection, enabling reconnaissance, data exfiltration, and command-and-control communication. The malware acts as a stager for follow-on payloads, with different variants like BaoLoader and TamperedChef linked to distinct but overlapping infrastructure and objectives.

3w ago · fortinet

The Confucius threat group, a state-aligned cyber-espionage actor, has evolved its tactics from using document stealers like WooperStealer to deploying Python-based backdoors such as AnonDoor. Initially targeting organizations in Pakistan via spear-phishing and malicious Office documents, the group has advanced to using LNK files, DLL side-loading, and scheduled tasks for persistence. Their campaigns now feature layered obfuscation, custom Python RATs, and sophisticated data exfiltration techniques, indicating a growing level of operational sophistication.

3w ago · talos

Cisco Talos identified a new attack campaign linked to the DPRK-aligned threat group Famous Chollima, which uses social engineering through fake job offers to distribute trojanized Node.js applications. The campaign leverages malicious npm packages like 'node-nvm-ssh' and combines the BeaverTail and OtterCookie malware tools to steal credentials, cryptocurrency wallets, and system information. Recent evolution includes merged functionality between BeaverTail and OtterCookie, with new capabilities such as keylogging, screenshot capture, and clipboard monitoring delivered via a modular JavaScript-based framework.

3w ago · cn-cert

3w ago · dark-trace

Salt Typhoon, a China-linked advanced persistent threat (APT) group also known as Earth Estries or UNC2286, conducted a cyber espionage intrusion targeting a European telecommunications organization. The attack began with exploitation of CVE-2025-5777 in Citrix NetScaler Gateway appliances, followed by lateral movement and DLL sideloading using legitimate antivirus software to execute the SNAPPYBEE (Deed RAT) backdoor. Command-and-control communications were observed using suspicious domains and IPs, with activity detected and contained early by Darktrace’s AI-driven systems.

3w ago · hacker-news

China's Ministry of State Security (MSS) accused the U.S. National Security Agency (NSA) of conducting a multi-stage cyber attack on the National Time Service Center (NTSC), starting in March 2022. The attack involved compromising mobile devices via a foreign SMS service, using stolen credentials, and deploying a cyber warfare platform with 42 specialized tools to target internal systems. The MSS claims the attack aimed to disrupt 'Beijing Time' infrastructure and was ultimately thwarted, with the U.S. accused of using global infrastructure to conceal its activities.

3w ago · google-threat-intel

Russian state-sponsored threat group COLDRIVER rapidly deployed new malware families following the public disclosure of its LOSTKEYS malware in May 2025. The group introduced a new infection chain centered around the NOROBOT DLL, delivered via a 'ClickFix' CAPTCHA-themed lure, leading to deployment of the YESROBOT and later MAYBEROBOT backdoors. COLDRIVER has shown aggressive development tempo, frequently evolving delivery mechanisms and evasion techniques to maintain access to high-value targets such as NGOs, policy advisors, and dissidents.

3w ago · Kaspersky-labs

The PassiveNeuron campaign is a sophisticated cyberespionage operation targeting government, financial, and industrial organizations in Asia, Africa, and Latin America. It primarily compromises Windows Server machines, often through SQL server exploitation, and deploys custom APT implants such as Neursite and NeuralExecutor. The attackers use a multi-stage DLL loader chain with anti-sandbox techniques and have shifted to using GitHub-based dead drop resolvers for C2 configuration in newer variants. Attribution remains challenging, but TTPs suggest a Chinese-speaking threat actor with low confidence.

3w ago · security.com

China-based threat actors exploited the ToolShell vulnerability (CVE-2025-53770) to compromise a telecoms company in the Middle East and multiple government agencies globally shortly after the patch was released in July 2025. The attackers deployed backdoors such as Zingdoor and ShadowPad, used DLL sideloading techniques, and leveraged tools like KrustyLoader and Sliver for post-exploitation. Activities indicate espionage motives, with credential theft and lateral movement observed across compromised networks.

3w ago · hacker-news

A critical remote code execution vulnerability in Microsoft WSUS, tracked as CVE-2025-59287, is under active exploitation with public proof-of-concept code available. The flaw stems from unsafe deserialization of AuthorizationCookie objects via the BinaryFormatter, allowing unauthenticated attackers to execute arbitrary code with SYSTEM privileges. Exploitation has been observed in the wild, with threat actors targeting publicly exposed WSUS instances to deploy PowerShell payloads for reconnaissance and potential supply chain attacks. Organizations are urged to apply emergency patches immediately, as unpatched systems are at high risk of compromise.

3w ago · hacker-news

APT36, also known as Transparent Tribe, has targeted Indian government entities using spear-phishing emails delivering a Golang-based DeskRAT malware. The campaign primarily targets BOSS Linux systems, leveraging malicious Desktop files and cloud storage services to distribute payloads. DeskRAT establishes persistence through multiple methods and communicates with C2 servers via WebSockets, enabling file exfiltration and remote execution. The group has evolved to use custom malware, indicating increased sophistication.

3w ago · talos

The Qilin ransomware group, active since 2022 and operating as a Ransomware-as-a-Service (RaaS), has intensified its global operations in 2025, targeting primarily the manufacturing, professional services, and wholesale trade sectors. The group employs a double-extortion strategy, combining file encryption with data exfiltration, leveraging tools such as Mimikatz, Cyberduck, and Cobalt Strike. Initial access is suspected via compromised credentials on exposed VPNs without MFA, followed by extensive reconnaissance, credential dumping, lateral movement, and deployment of dual encryptors to maximize impact.

3w ago · Kaspersky-labs

In March 2025, Kaspersky identified a sophisticated cyber espionage campaign dubbed Operation ForumTroll, targeting Russian and Belarusian organizations via spear phishing emails with personalized links. The attack exploited a zero-day vulnerability in Google Chrome (CVE-2025-2783) to escape the browser sandbox, leveraging a logical flaw in Windows IPC handling of pseudo-handles. The threat actor used LeetAgent, a custom spyware, and was linked to the commercial Dante spyware developed by Memento Labs (formerly Hacking Team), indicating a well-resourced and persistent threat actor conducting long-term surveillance operations.