Threat Intelligence
Some Malicious PE Stats, (Thu, Aug 27th)
Some Malicious PE Stats, (Thu, Aug 27th). 32bits malware[ 1 ].
Yesterday
Independent cybersecurity news, intelligence and analysis
Where Cyber News Becomes Intelligence.
RESEARCHKnow what happened. Understand the risk. Know what to do next.CyberDeltaForce home
CYBERDELTAFORCE / RESEARCH
20 current storiesSecurity Research
Technical research from threat labs, security researchers, vulnerability teams and specialist cybersecurity organizations.
Threat Intelligence
LiteLLM Supply Chain Attack: 2,500+ Companies Exposed in the Largest AI Supply Chain Breach of 2026
LiteLLM Supply Chain Attack: 2,500+ Companies Exposed in the Largest AI Supply Chain Breach of 2026. The security significance comes from trust: Trivy or the affected component sits in a software, development or delivery path that downstream teams may already allow to run automatically.
19d ago
Threat Intelligence
UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
A security weakness in the affected technology is being tracked as a newly reported vulnerability. This is an overview of the campaign, examining the countries affected, potential impact of BadIIS infections, the attack chain, and post-compromise tactics.
9d ago
Threat Intelligence
AI-Agent-Driven Offensive Operation : Exposed Adversary Open Directory Reveals Autonomous Crypto-Theft Campaign Leading to Mass Wallet and Credential Compromise
AI-Agent-Driven Offensive Operation : Exposed Adversary Open Directory Reveals Autonomous Crypto-Theft Campaign Leading to Mass Wallet and Credential Compromise. The exposed infrastructure also revealed a developing blockchain-based command-and-control system designed to make future operations mo...
11d ago
Threat Intelligence
The State of Ransomware Q2 2026
The State of Ransomware Q2 2026. Ransomware or extortion is part of the impact, which means the incident also involves disruption, recovery pressure or leverage over the affected organization.
16d ago
Threat Intelligence
Caught in 4K: The Aurora Files
Caught in 4K: The Aurora Files. A misconfigured server opened a window straight into an Aurora ransomware operator's playbook: attacker tools, AI-assisted planning, and a look inside the actual negotiation panel where a victims and the operator settled on payment.
3d ago
Threat Intelligence
A polymorphic phishing page (that occasionally breaks itself), (Thu, Aug 27th)
A polymorphic phishing page (that occasionally breaks itself), (Thu, Aug 27th). As I've mentioned before in some of my diaries, from time to time, I like to go over phishing messages that get caught in my various spam traps or sent to us here at the Internet Storm Center.
2d ago
Threat Intelligence
Staying Ahead of Adversarial AI Through Agentic Source Code Review
A security weakness in the affected technology is being tracked as a newly reported vulnerability. By structuring the analysis process, enforcing skeptical validation steps, and injecting domain-specific huma.
11d ago
Threat Intelligence
UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments
UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments. Telemetry and infrastructure analysis reveal that rather than disbanding, UNC6671 has diversified its operations across multiple extortion fronts.
23d ago
Threat Intelligence
What Is Digital Risk Management and Why Does Your Business Need It?
A security weakness in the affected technology is being tracked as a newly reported vulnerability. Organisations now depend on cloud applications, digital platforms, connected devices, third-party vendors, social media, and online customer channels to deliver products and services.
11d ago
Threat Intelligence
Brand Protection in Cybersecurity: Protecting Businesses from Digital Threats
Brand Protection in Cybersecurity: Protecting Businesses from Digital Threats. It represents the trust customers place in a business, the reputation it has built, and the digital experiences associated with its name.
19d ago
Threat Intelligence
Obfuscating IP Addresses as Hostnames, (Tue, Aug 25th)
A security weakness in the affected technology is being tracked as a newly reported vulnerability. Pretty much any software accepting an IP address will also accept a hostname as an argument.
4d ago
Threat Intelligence
Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia
Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia. Examples of these techniques can be found.
9d ago
Threat Intelligence
BRIDGEHEAD : An npm typosquatting campaign that crosses from WSL into Windows to plant a crypto-wallet stealer
BRIDGEHEAD : An npm typosquatting campaign that crosses from WSL into Windows to plant a crypto-wallet stealer. The malware targets cryptocurrency wallets, browser credentials, cookies and Telegram sessions, while executing largely in memory and using public infrastructure for reconnaissance and ...
10d ago
Threat Intelligence
Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect
Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect. Further analysis of the infrastructure reveals that the infection chain starts with a ClickFix social-engineering technique, which prompts victims to execute a PowerShell command.
11d ago
Threat Intelligence
17th August – Threat Intelligence Report
17th August – Threat Intelligence Report. TOP ATTACKS AND BREACHES Colombia’s Ministry of Justice has experienced a ransomware attack that affected part of its technology infrastructure and disrupted public services related to illicit-drug monitoring and legal processes.
12d ago
Threat Intelligence
Access For Sale: Inside a Russian-Speaking Access Broker's Dual Operation
Access For Sale: Inside a Russian-Speaking Access Broker's Dual Operation. The investigation connects credential theft, Active Directory compromise, and access sales to ransomware groups, while also uncovering surveillance activity targeting Ukrainian defence and aerospace organizations.
27d ago
Threat Intelligence
UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities
UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities. The reporting includes an identity or credential element, which matters because a valid account or session can let an attacker move through trusted systems without relying only on malware.
9d ago
Vulnerabilities
Why a cryptographic inventory is key for addressing the quantum computing threat
A security weakness in the affected technology is being tracked as a newly reported vulnerability. But the threat already exists, as attackers use the "harvest now, decrypt later" tactic.
Yesterday
Vulnerabilities
Detecting cloud ransomware in Azure with Tenable One’s cloud detection and response capabilities
A security weakness in Azure is being tracked as a newly reported vulnerability. Tenable One Cloud Exposure uses AI-powered threat stories to expose Storm-0501 TTPs, backed by precision-engineered threat detection alerts.
12d ago
Where cyber news becomes intelligenceKnow what happened, understand the risk and know what to do next
Global coverageIncidents, threats, breaches, ransomware, cloud, AI, research and policy
Defender focusedClear reporting with practical context for cybersecurity professionals