Threat Research

Researchers analyzed a fileless SharePoint intrusion attributed with moderate confidence to Storm-2603, involving exploitation of ToolShell vulnerabilities CVE-2025-53770 and CVE-2025-53771 to achieve remote code execution....

: Anubis ransomware attackers deployed a newly discovered custom backdoor, named Backdoor.Lindnor, against a U.S. organization in October 2026. The malware disguised itself as legitimate Chrome and VMware components and was found on two Microsoft SQL Server systems....

Malware-as-a-Service (MaaS) is becoming easier to access through online gaming communities and other internet platforms. Tools that once required advanced technical skills are now freely available, allowing even inexperienced individuals to launch attacks....

Researchers uncovered Mirax, an Android Remote Access Trojan (RAT) and Malware-as-a-Service (MaaS) platform that enables real-time device takeover through Accessibility Service abuse, screen sharing, keylogging, SMS/OTP interception, and banking application overlay injection....

: DARK PROJECT is a financially motivated ransomware group that employs double-extortion tactics, combining data theft with file encryption to pressure victims into paying ransoms. According to the report, the group recently posted three new victims across the United States and the Philippines, targeting the Energy, Transportation & Logistics, and Automotive industries....

The investigation uncovered an open directory at `23.248.226[.]250`, identified as a Hong Kong-based jump server containing Claude Code configurations, custom model-routing scripts, and 19 agent skills....

Researchers uncovered a fake-download campaign distributing trojanized installers disguised as legitimate games, cracked software, and utilities to compromise Windows systems....

The team investigated multiple incidents in 2026 involving threat actors hijacking enterprise access to Large Language Models (LLMs), a technique known as LLMJacking. These attacks affected organizations across North America, South America, and Asia Pacific, spanning financial services, retail, technology, and transportation sectors....

PHP2Shell exploits two critical PHP memory-safety vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that can enable remote code execution on vulnerable systems. Further investigations uncovered 616 PHP2Shell-related files, including exploit kits, custom tools, scanners, and post-exploitation utilities....

The XCPE backdoor infected more than 1.3 million Android set-top boxes worldwide. The investigation linked the operation to Videostrong Technology, which allegedly used compromised devices to distribute malware, conduct ad fraud, steal data, and provide residential proxy services for criminal affiliates....

BITTER is a suspected South Asian cyberespionage group active since at least 2013, known for targeting government, energy, and engineering organizations. Labs recently identified a campaign targeting South Asian entities using malicious PowerShell scripts and a custom remote access trojan (RAT) named PapRAT....

Researchers identified CyberStrikeAI, an open-source LLM-orchestrated Command-and-Control (C2) framework, being abused in attacks against educational organizations across Africa and Latin America....

Researchers identified BlackApex, DarkApex, SPY, and XXX101, a family of AI-assisted, vibe-coded Phishing-as-a-Service (PhaaS) kits with more than 70 observed instances targeting Microsoft 365 accounts....

: The team has recently identified multiple incidents in which threat actors abused mobile device management (MDM) applications to conduct malicious activities. Rather than exploiting software vulnerabilities, attackers misused legitimate MDM tools to gain access to managed devices....

INJ3CTOR3 has upgraded its FreePBX toll-fraud campaign by adding credential theft to its existing JOMANGY webshell. The malware now steals sensitive SIP trunk, AMI, database, and mail-relay credentials and sends them to attacker-controlled servers every minute. This allows attackers to continue making unauthorized calls even after the infected PBX is cleaned or rebuilt....