Keith Dixon

The cyber criminal group TeamPCP is conducting large-scale software supply chain attacks targeting DevOps and security tools to exfiltrate cloud credentials and secrets.

Adversaries like Mirage Kitten and Cloud Atlas leverage Kerberoasting and DNS tunneling to bypass traditional security perimeters and exfiltrate data.

The Head Mare APT group is exploiting TrueConf Server vulnerabilities to distribute PhantomCore and PhantomGraph backdoors via infected client installers.

The North Korean-linked threat actor Larva-26005 is targeting South Korean users by distributing the Xctdoor and XcLoader backdoors through spear phishing and installers disguised as legitimate security programs.

UNC6780 and MIDNIGHT NEPTUNE target open-source repositories and AI coding environments to deploy credential stealers and backdoors via malicious package dependencies.

PolinRider threat actors hijacked two Joyfill npm packages to distribute an obfuscated five-stage malware chain using blockchain-based C2 resolution and a Python credential stealer.