Threat Research

The WeedHack campaign is a Malware-as-a-Service (MaaS) operation that targets Minecraft players through fake gaming websites, SEO poisoning, and YouTube lures distributing malicious mods and clients....

Medusa is a Ransomware-as-a-Service (RaaS) operation first identified in 2021 that uses double extortion, encrypting victim data while threatening to leak stolen information. As of April 2026, Medusa actors had impacted more than 500 victims across critical sectors including healthcare, education, legal, insurance, technology, and manufacturing....

Three suspected Russian cyber-espionage clusters are targeting individuals in academia, aerospace and defense, government, and think tanks across Europe and the United States. The groups abuse legitimate authentication and OAuth workflows to make phishing attempts appear more trustworthy and harder to detect....

Autonomous AI agents are creating new security risks by connecting LLMs directly to operating systems. OpenClaw lets AI execute commands, access files, and modify local environments, expanding the attack surface. Researchers first uncovered a supply chain campaign called ClawHavoc targeting the ClawHub skill registry....

The StopAndProtect campaign is a multi-stage malware operation that begins with ClickFix social engineering, leading to PowerShell, .NET payloads and the deployment of ransomware, SMB/USB worm, credential stealer, VBS spreader, and LockScreen components....

WindRelay is a newly identified NFC relay malware designed to capture and remotely relay contactless payment card data, enabling fraudulent transactions. It is deployed alongside the SpyNote RAT, whose Accessibility Service access allows attackers to silently install and activate the NFC malware through live-call social engineering....

This campaign demonstrates how modern stealers increasingly combine social engineering, browser fingerprinting, fileless execution, and steganography to evade traditional detection....

Between June 17 and July 22, 2026, a single operator compromised more than 14,000 Dahua IP cameras worldwide. The campaign began with masscan sweeps targeting Russian IP ranges before expanding across the entire IPv4 address space....

Token jacking is an emerging AI-focused threat where cybercriminals steal developers’ AI API keys or tokens and use them to access AI platforms without authorization. Attackers can consume large amounts of expensive LLM processing resources or resell the stolen access, potentially causing significant financial losses before the victim notices....

The StubMaker campaign is a RubyGems supply chain attack that distributed typosquatted Ruby packages containing malicious extconf.rb installer hooks to compromise Windows developer systems. During installation, the packages fingerprint the host, download a Rust-based loader from GitHub Releases, and decrypt an embedded Go infostealer entirely in memory for fileless execution....

ENIbot (also known as HuntBot) is an actively spreading IoT botnet that self-propagates across the internet and conducts Layer 7 DDoS attacks through its C2 infrastructure. Since March 2026, honeypots have recorded millions of exploitation attempts and 3,505 distinct malware samples linked to the campaign....

C2Looper is a newly identified Rust-based backdoor likely used by a ransomware-related threat actor to establish footholds for lateral movement. It supports remote command execution, system reconnaissance, and deployment of additional payloads, while using encrypted strings and dynamically resolved Windows APIs for evasion....

Lucid Stealer is an information-stealing malware designed to harvest sensitive personal and financial data from compromised systems. It uses a legitimate Node.js-based execution framework to hide malicious components and evade traditional static analysis....

This DCRat campaign combines phishing with SVG attachment, DLL sideloading, and process hollowing to establish stealthy remote access while evading endpoint defenses. By abusing trusted Windows utilities and requiring user interaction, the malware blends into legitimate activity and enables in-memory execution....

On July 31, Threat Intelligence reported an ongoing credential theft campaign tracked as CaptiveCrunch, attributed to Storm-2945, a sub-group of Russia-linked Midnight Blizzard (APT29). The campaign abuses captive portal networks at hotels, conference centers, and similar venues to redirect victims to attacker-controlled infrastructure....