Intel Exchange

Unidentified threat actors are exploiting a critical macOS Screen Sharing authentication bypass (CVE-2026-65400) to gain root access and deploy Monero miners.

The Head Mare APT group is exploiting TrueConf Server vulnerabilities to distribute PhantomCore and PhantomGraph backdoors via infected client installers.

Evooo1Bot is a highly modular Linux botnet leveraging Mirai's DDoS engine alongside advanced SOCKS relay, SSH brute-forcing, and an extensive CVE exploit arsenal to compromise Internet-facing edge devices.

Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.

Gunra (also known as Golden Community) is a RaaS operation using a double-extortion model targeting critical infrastructure by exploiting vulnerabilities in Fortinet appliances and leveraging Impacket for lateral movement.

Russian-speaking operators are using custom platforms like camview and open-source scanners to exploit vulnerabilities in IP cameras and routers across Ukraine and Europe to build proxy networks.

Head Mare APT exploits a chain of vulnerabilities in TrueConf Server to distribute PhantomCore and PhantomGraph backdoors via Trojanized client installers.

Forest Blizzard (linked to Russian military intelligence) compromises SOHO routers to perform DNS hijacking and adversary-in-the-middle attacks targeting Microsoft 365 and government servers.

Security researcher Gareth Heyes demonstrates how to bypass CSS sanitizers in major webmail clients to perform real-time keylogging, token theft, and UI defacement.

The Pluto Hephaestus threat actor utilizes the AI-powered 'Hephaestus' framework to automate the full attack lifecycle against government and educational targets in Southeast Asia and South Korea.