Threat Actors

MI5 Warns of Chinese Espionage Campaign Exploiting LinkedIn for Intelligence Gathering
News
MI5 Warns of Chinese Espionage Campaign Exploiting LinkedIn for Intelligence Gathering
MI5 warns that Chinese intelligence operatives are using LinkedIn and fake recruiters to target UK professionals with access to sensitive information. Thousands have reportedly been ...
ShadowRay 2.0 Botnet Campaign Exploits Ray Clusters for Cryptomining
Endpoint Security
ShadowRay 2.0 Botnet Campaign Exploits Ray Clusters for Cryptomining
ShadowRay 2.0 is exploiting an unauthenticated RCE flaw in older Ray Cluster deployments, infecting more than 5,000 exposed nodes and turning them into a self-spreading ...
Dutch Police Dismantle Bulletproof Hosting Platform Used by Cybercriminals
News
Dutch Police Dismantle Bulletproof Hosting Platform Used by Cybercriminals
Dutch authorities have seized roughly 250 servers tied to a bulletproof hosting service that catered exclusively to cybercriminals, disrupting infrastructure used for malware, phishing, and ...
Threat Group ShinyHunters Hacks Checkout.com, Demands Ransom Over Legacy Cloud Breach
Cybersecurity
Threat Group ShinyHunters Hacks Checkout.com, Demands Ransom Over Legacy Cloud Breach
A cyberattack on Checkout.com by ShinyHunters exposed sensitive data stored in an overlooked legacy cloud system, highlighting the risks of outdated infrastructure. The attackers are ...
Chinese APT Leveraged Claude AI for Automated Espionage Operation
News
Chinese APT Leveraged Claude AI for Automated Espionage Operation
Chinese APT group GTG-1002 has been caught abusing Anthropic’s Claude AI to automate phishing, malware development, and reconnaissance tasks. The campaign marks a major shift ...
North Korean ‘Contagious Interview’ Campaign Evolves With JSON-Based Malware Delivery
News
North Korean ‘Contagious Interview’ Campaign Evolves With JSON-Based Malware Delivery
North Korea’s “Contagious Interview” campaign is evolving with new stealth techniques, using legitimate JSON-based storage services to host malware delivered through trojanized developer tools. NVISO ...
DanaBot Resurfaces with New Windows Variant Six Months After Takedown
News
DanaBot Resurfaces with New Windows Variant Six Months After Takedown
DanaBot has resurfaced with version 669 after six months of silence following Operation Endgame, signaling a rebuilt infrastructure and upgraded loaders. The new variant features ...
Konni Campaign Impersonates Human Rights Groups in Cross-Platform Espionage Operation
Cybersecurity
Konni Campaign Impersonates Human Rights Groups in Cross-Platform Espionage Operation
North Korea-linked APT group Konni is conducting new cyberattacks using social engineering and cross-platform malware for Android and Windows. Disguised as mental health or activism ...
Graphite Spyware Targets Italian Political Adviser Francesco Nicodemo
News
Graphite Spyware Targets Italian Political Adviser Francesco Nicodemo
Israeli-made Graphite spyware has been used to target Italian political adviser Francesco Nicodemo, marking Italy’s fifth confirmed infection. The case intensifies concerns over state-backed surveillance, ...
U.S. Sanctions North Korean Financial Network Over Cybercrime-Funded Weapons Program
News
U.S. Sanctions North Korean Financial Network Over Cybercrime-Funded Weapons Program
The U.S. Treasury has sanctioned eight North Korea-linked individuals and entities accused of laundering funds from cyberattacks to finance Pyongyang’s weapons programs. The move targets ...