Intel Exchange

A Russian-speaking operator compromised over 14,000 Dahua IP cameras globally, primarily in Ukraine and Russia, using authentication bypasses, P2P relay abuse, and credential brute-forcing.

The Exilware threat group uses the AI-driven BraZetsu Python framework to compromise Windows hosts and monetize access via the 'Infect Marketplace.'

Silver Fox threat actor is distributing the ValleyRAT backdoor by masquerading as signed adware applications to exfiltrate sensitive data from targets in China and India.

TWINLOOT is a modular Python implant using Microsoft SharePoint, Teams, and headless Edge browsers for stealthy command-and-control and lateral movement.

Blackpoint APG identified Miraak, a modular post-exploitation framework using PostgreSQL/Timescale for C2 communication and featuring Cobalt Strike BOF compatibility.

Chinese-speaking threat actor TA4922 is utilizing PackClient, a modular C2 framework sold on Telegram, to target organizations in China and India with tax-themed phishing lures.

CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).

The Dark Caracal threat actor is deploying a modular Go-based framework named GoCaracal that utilizes Ethereum smart contracts for resilient command-and-control infrastructure.

TWINLOOT is a sophisticated Python implant utilizing SharePoint for tasking, Teams TURN relays for SOCKS5 tunneling, and headless Edge for stealthy Microsoft Graph API transport.

The Offside Wallet Theft Factory campaign utilizes 77 malicious Firefox extensions to steal cryptocurrency secrets and credentials by masquerading as Web3 tools and sports-score utilities.