Where Cyber News Becomes Intelligence.
Malware, intrusion campaigns, identity attacks, cybercrime, APT activity and the tactics defenders need to understand.
Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks. Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever.
ATF confirms “major incident” after recent Qilin breach claims. The Bureau of Alcohol, Tobacco, Firearms and Explosives has described it as a ‘major incident’ and it’s conducting an investigation with the DOJ.
Some Malicious PE Stats, (Thu, Aug 27th). 32bits malware[ 1 ].
LiteLLM Supply Chain Attack: 2,500+ Companies Exposed in the Largest AI Supply Chain Breach of 2026. The security significance comes from trust: Trivy or the affected component sits in a software, development or delivery path that downstream teams may already allow to run automatically.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. This is an overview of the campaign, examining the countries affected, potential impact of BadIIS infections, the attack chain, and post-compromise tactics.
ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories. Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers, according to threat intelligence company Defused.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. "The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims.
AI-Agent-Driven Offensive Operation : Exposed Adversary Open Directory Reveals Autonomous Crypto-Theft Campaign Leading to Mass Wallet and Credential Compromise. The exposed infrastructure also revealed a developing blockchain-based command-and-control system designed to make future operations mo...
The State of Ransomware Q2 2026. Ransomware or extortion is part of the impact, which means the incident also involves disruption, recovery pressure or leverage over the affected organization.
Caught in 4K: The Aurora Files. A misconfigured server opened a window straight into an Aurora ransomware operator's playbook: attacker tools, AI-assisted planning, and a look inside the actual negotiation panel where a victims and the operator settled on payment.
A polymorphic phishing page (that occasionally breaks itself), (Thu, Aug 27th). As I've mentioned before in some of my diaries, from time to time, I like to go over phishing messages that get caught in my various spam traps or sent to us here at the Internet Storm Center.
UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments. Telemetry and infrastructure analysis reveal that rather than disbanding, UNC6671 has diversified its operations across multiple extortion fronts.
A security weakness in the affected technology is being tracked as a newly reported vulnerability. Organisations now depend on cloud applications, digital platforms, connected devices, third-party vendors, social media, and online customer channels to deliver products and services.
Brand Protection in Cybersecurity: Protecting Businesses from Digital Threats. It represents the trust customers place in a business, the reputation it has built, and the digital experiences associated with its name.
Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia. Examples of these techniques can be found.
BRIDGEHEAD : An npm typosquatting campaign that crosses from WSL into Windows to plant a crypto-wallet stealer. The malware targets cryptocurrency wallets, browser credentials, cookies and Telegram sessions, while executing largely in memory and using public infrastructure for reconnaissance and ...
Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect. Further analysis of the infrastructure reveals that the infection chain starts with a ClickFix social-engineering technique, which prompts victims to execute a PowerShell command.
17th August – Threat Intelligence Report. TOP ATTACKS AND BREACHES Colombia’s Ministry of Justice has experienced a ransomware attack that affected part of its technology infrastructure and disrupted public services related to illicit-drug monitoring and legal processes.
Access For Sale: Inside a Russian-Speaking Access Broker's Dual Operation. The investigation connects credential theft, Active Directory compromise, and access sales to ransomware groups, while also uncovering surveillance activity targeting Ukrainian defence and aerospace organizations.
WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords. According to findings from Gen Digital, WordlistLoader is being used to deliver Amatera Stealer (aka ACR Stealer or AcridRain Stealer) via ClearFake campaigns, which employ the ClickFix (aka FakeCaptcha).
Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows. The commercial phishing-as-a-service toolkit targets Microsoft 365 accounts by abusing legitimate login flows and bypassing two-factor authentication.
Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor. The campaign, codenamed Operation QUICSILVER, has been found to target government and information technology sectors, per Seqrite Labs.
UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities. The reporting includes an identity or credential element, which matters because a valid account or session can let an attacker move through trusted systems without relying only on malware.
CVE-2026-76197 affects Adobe Campaign Classic (ACC). The flaw is described as a command injection vulnerability.
CVE-2026-69414 affects the affected technology. A public PoC was released on August 12, 2026, and Microsoft assigned the CVE on August 14, and no patch is available yet.
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit. The vast majority of the targets are located in Brazil, Bolivia, China, Canada, and Vietnam.