Threat Actors

PCPJack Malware Exploits Five CVEs to Worm Across Cloud Environments
Cybersecurity
PCPJack Malware Exploits Five CVEs to Worm Across Cloud Environments
Nation-state-linked PCPJack malware framework worms across cloud environments via five CVEs, using parquet file evasion to harvest credentials from cloud and financial systems.
Two Americans Jailed for Running North Korean IT Worker Laptop Farms
Cybersecurity
Two Americans Jailed for Running North Korean IT Worker Laptop Farms
Matthew Knoot and Erick Prince received 18-month federal sentences for laptop farm operations that placed North Korean IT workers inside U.S. companies under stolen American ...
GothFerrari Gets 6.5 Years for $250M Crypto Home-Invasion Theft Ring
Cybersecurity
GothFerrari Gets 6.5 Years for $250M Crypto Home-Invasion Theft Ring
California man Marlon Ferro, alias GothFerrari, received a 78-month federal sentence for home invasions, iCloud surveillance of victims, and money laundering in a ring that ...
Sygnia Responder, DigitalMint Negotiator Sentenced for BlackCat Role
Cybersecurity
Sygnia Responder, DigitalMint Negotiator Sentenced for BlackCat Role
Sygnia incident responder Ryan Goldberg and DigitalMint ransomware negotiator Kevin Martin each received four-year federal prison sentences for deploying BlackCat/ALPHV against their own clients from ...
Nefilim Affiliate Stryzhak Sentenced in U.S. for Ransomware Campaign
Cybersecurity
Nefilim Affiliate Stryzhak Sentenced in U.S. for Ransomware Campaign
Nefilim ransomware affiliate Artem Stryzhak, 35, faces sentencing May 6, 2026 after pleading guilty to conspiracy to commit computer fraud. Stryzhak targeted companies with $100M+ ...
China-Linked UAT-8302 Targets Governments in South America and Europe
Cybersecurity
China-Linked UAT-8302 Targets Governments in South America and Europe
Cisco Talos on May 5, 2026 linked UAT-8302, a China-nexus APT, to government espionage campaigns across South America and southeastern Europe using malware shared with ...
Karakurt Negotiator Gets 8.5 Years in First U.S. Conviction
Cybersecurity
Karakurt Negotiator Gets 8.5 Years in First U.S. Conviction
Deniss Zolotarjovs, Karakurt's "cold case" extortion negotiator, received an 8.5-year U.S. federal prison sentence — the first conviction of a Karakurt gang member — linked ...
SimpleHelp and ScreenConnect The IT Tools That Became a Backdoor
Cybersecurity
SimpleHelp and ScreenConnect: The IT Tools That Became a Backdoor
VENOMOUS#HELPER spent 13 months inside 80+ organizations using legitimate RMM software — SimpleHelp and ScreenConnect — as undetected persistent access channels.
Hacking the Hackers What a Security Vendor Breach Really Means
Cybersecurity
Hacking the Hackers: What a Security Vendor Breach Really Means
Trellix disclosed that attackers accessed its internal source code repositories — raising serious questions about what stolen security vendor source code enables.
275 Million Students' Records Allegedly Stolen in Canvas Breach
Cybersecurity
275 Million Students’ Records Allegedly Stolen in Canvas Breach
ShinyHunters claims 3.65 TB of Instructure Canvas data affecting 275 million users at 9,000 schools — with minors' data exposed and a Salesforce pivot involved.