Cobalt Strike

Cato CTRL™ Threat Research: Foxveil – New Malware Loader Abusing Cloudflare, Discord, and Netlify as Staging Infrastructure

Silent Ransom Group - Leak Analysis

Fishmonger’s Arsenal Upgraded: Sprysocks for Windows

AI-Assisted Cyberespionage Campaign Targets Government Systems

Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries

Threat Intelligence | Analysis of the DarkSword Trojan Backend and iOS Attack Chain

Blog

Midnight Mimosa Malware Campaign Exploits Android Firmware Supply Chain

Sekoia Honeypot Captures an Attack on GenAI Infrastructure

Taiwan High Tech Ecosystem Targeted by Foreign Apt Group:

ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

Chinese State-Linked Hackers Target US Critical Infrastructure with Automated Scanning and Cyber Espionage Tools

Huntress + AlgaPSA Integration: Built in Days by Nine Minds

How RL mapped a Midnight Blizzard-linked campaign from two hashes

Aoki: Infostealer Targets AI Coding Assistant Credentials

Passkeys Raise the Bar. Here’s Where Attackers Can Still Get In.

KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize

ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure

Fake WatchGuard VPN Site Steals Credentials

Unmasking a Multi Stage Loader: Autoit Abuse Leading to Vidar Stealer Command and Control Communication

Phantom in the Vault: Obsidian Abused to Deliver Phantompulse Rat

Needymantis: Unpacking a Post Compromise Malware Family Used in Targeted Operations

Darksword/coruna Open Directory Finding Report

China Linked Warlock Ransomware Campaign Targets Critical Infrastructure

GhostAction Attack Escalates By Targeting GitHub Users

Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense Research

SMB1001: How Huntress Maps to Each Tier

Jdy Botnet: How Iot and Soho Devices Are Exploited

Darktrace Malware Analysis: Unpacking Snappybee

ORKL Report