Cyber Threat Intel News

Hijacked Domain Registries Let Attackers Get Real HTTPS Certificates for Google Domains

The operators behind Ghana, Sierra Leone and American Samoa's domains were compromised. Chrome has blocked the fraudulen...

Pub. 8 Oct

Open settling basins at a water treatment plant

The Warlock Ransomware Group Still Breaks In Through SharePoint, Now at a Water Utility

Symantec says the China-linked group hit a water company, a telecom operator, a regional government and a university in...

Pub. 3 Oct

A German police car marked Polizei parked on a street

Police Shut Down the KillSec Ransomware Group. Its Suspected Leader Is 16.

Operation KillSwitch seized the gang's leak site and servers and made three arrests. Investigators link it to about 1,00...

Pub. 2 Oct

A phone on a stand showing the ChatGPT app's opening screen

A Google Ad for ChatGPT Led to a Real chatgpt.com Page That Installed a Trojan

Attackers published a Custom GPT called "Plus 5.6" that sent every visitor to a fake backup site. OpenAI took it down; a...

Pub. 1 Oct

The PeopleSoft Attackers Are Back, and Firewall Rules No Longer Stop Them

Google says ShinyHunters now slips past rules that blocked June's exploit and has hit dozens of systems. Oracle's June p...

Pub. 29 Sep

Network switches and routers in a rack with patch cables

The MikroTik Router Takeover Used a Different Flaw Than First Reported. The Same Updates Fix It.

CERT Polska now says the chain pairs CVE-2026-67279 with CVE-2026-86060. Routers updated in early September are covered,...

Pub. 27 Sep

A hand holding a smartphone in the dark with a messaging app open on screen

Uninstall RatHat and It Reinstalls Itself

A new Android malware family escapes the app sandbox by switching on wireless debugging and pairing with the phone as a...

Pub. 23 Sep

A plain black wall clock mounted on wooden boards

The Backdoor Checks a Private GitHub Repository for Orders

Zscaler's Operation RapidRust report finds APT36 running a Rust implant over the GitHub API, with commands issued only o...

Pub. 21 Sep

A laptop screen glowing alone in a dark room, with city lights blurred beyond the window

A Security Company's Private Code Sat Stolen for 117 Days

The copy happened in May. Nobody knew until the repositories turned up on a criminal forum in September, and no control...

Pub. 20 Sep

A red and white telecommunications mast carrying cellular antennas against a blue sky

A Pixel Modem Flaw Needs No Tap, and CISA Gave Three Days

The modem is a separate computer that answers to the mobile network, not to you. Nothing has to be opened, clicked or do...

Pub. 19 Sep

Close-up of a circuit board showing a surface-mounted chip surrounded by soldered contacts and copper tracks

Four Linux Root Exploits Published, for Bugs Up to 21 Years Old

Mistakes a decade or more old, in networking code read by thousands of people, found in months by a researcher whose AI...

Pub. 19 Sep

A person holding a smartphone in the dark, face lit by the screen

Three Agencies Blamed Iran for CHOSEN BRICK. Only the FBI Named the Ministry.

CHOSEN BRICK gives every victim their own Telegram bot. The NCSC, FBI and AIVD signed one advisory and stopped at differ...

Pub. 17 Sep

A lattice communications mast carrying dish and panel antennas against an open sky

BambooToken Malware Takes Its Orders Over MQTT, the Smart-Device Protocol

Infected machines never connect to the attacker. They subscribe to a topic on a message broker and wait. About a dozen v...

Pub. 17 Sep

A white multifunction office printer with a small touchscreen, standing on a dark wooden cabinet.

AI Agents Compromised 440 PaperCut Servers. Only Twelve Became Domain Admin.

Eleven organisations fell in 26 seconds, and schools took 204 of the 395 victims. The gap between landing on a box and o...

Pub. 16 Sep

A dark desk with two glowing monitors, a backlit keyboard, a boom-mounted microphone and a PC tower with lit fans.

A 30,000-User Twitch Ad-Blocker Was Sending Live Login Sessions to a Bot Service

The extension blocked ads by routing traffic through its own proxies, and forwarded each viewer's login token as it pass...

Pub. 15 Sep

A close-up of a laptop keyboard at a shallow angle — illustrating the step this attack depends on, which the victim performs themselves.

Berlin's Second Leak Is Credentials, and the Way In Was a Fake CAPTCHA

Login details went up over the weekend and the state will not say whether they still work. Researchers trace the intrusi...

Pub. 14 Sep

A stapler and pen resting on a stack of printed invoices and forms

A Million Fake CEO Emails in Three Days, Written by a Model

Microsoft says the operators used generative AI to tailor each one and filled the signatures with real executive names....

Pub. 13 Sep

A close-up of an audio mixing console, rows of faders receding into shadow

CISA Added Five Exploited Flaws, All in Software That Manages Other Machines

JFrog Artifactory builds your software, ConnectWise ScreenConnect reaches into your machines and MikroTik RouterOS route...

Pub. 13 Sep

Three identical tall orange openings set in a plain earth-coloured wall

Three Unrelated Groups Walked Through the Same Cisco Flaw

Talos found Sandworm's implant, Qilin ransomware and a third intruder inside Secure Firewall Management Center. The espi...

Pub. 12 Sep

Hands resting on a backlit keyboard in a dark room, the keys glowing in colour

Cyber Threat Intel 7 min

The Backdoor Came Through Sogou, Which Sees Every Key You Press

A crafted link was enough. An input method editor is downstream of every application on the machine, and this one is ins...

Pub. 12 Sep

Bar chart: twelve KEV entries in the last seven days, eleven in the seven before that, eleven across the fortnight before that

CISA Has Logged 37 Newly Exploited Flaws in 30 Days

CISA's exploited-vulnerability catalogue has taken 37 new entries in 30 days, including this week's Citrix NetScaler aut...

Pub. 11 Sep

An open laptop on a wooden desk in a dim room, its screen filled with lines of source code.

Chrome's Sixth Zero-Day of 2026, and Browser Zero-Days Keep Falling

CVE-2026-85046 is a V8 type confusion patched in Chrome 152 with a CISA deadline of 18 September. Across all browsers th...

Pub. 7 Sep

An industrial control desk in a plant, its sloped panel set with rows of red, green and orange push buttons beside a window looking onto the works

Industrial Cyber Attacks Fell 25 Per Cent in 2025, and Got Worse

Fifty-seven attacks caused physical damage in 2025. Ransomware flat-lined while nation-state and hacktivist attacks roug...

Pub. 4 Sep

A dark empty corridor running to a vanishing point, lit by a single strip light along the ceiling

AI Agents Ran a Whole Ransomware Intrusion in Under Ten Hours

Unit 42 describes agents running reconnaissance through to CI/CD hijacking in under ten hours. The 80-page report left b...