Ethan Andrews

Everest is a Russian-speaking ransomware group utilizing a triple-stream business model including file encryption, initial access brokerage, and paid corporate insider recruitment.

The Hyadina threat group is deploying the rebranded GodDamn ransomware, utilizing a Microsoft-signed PoisonX kernel driver to disable EDR and antivirus software.

The WP-SHELLSTORM campaign targets WordPress and Joomla installations at scale using automated exploit scanners and webshells for access brokerage.

The threat actor O-UNC-066 is using vishing and a real-time operator-controlled phishing kit to trick users into enrolling attacker-controlled passkeys for Microsoft 365 access.

IRGC-affiliated actors utilize GigaWiper, a modular Golang-based backdoor combining disk wiping, fake ransomware, and surveillance capabilities against Israeli targets.

A malicious actor compromised the @injectivelabs/sdk-ts npm package to exfiltrate cryptocurrency private keys and seed phrases through a deceptive telemetry module.

The emiltype actor published a malicious npm package nodemon-sudo that uses the dependency tslint-conf to fetch and execute a second-stage payload via IPFS at runtime.

An active Microsoft 365 phishing campaign abuses the legitimate OAuth 2.0 Device Authorization Grant flow to bypass traditional credential theft and gain account access.

The EvilTokens and ARToken Phishing-as-a-Service (PhaaS) platforms use Microsoft Device Code flows and browser-side decryption to bypass MFA and achieve persistent Microsoft 365 account takeovers.

An attacker utilizes a 1 MB HTML attachment from an authenticated Gmail account to bypass static scanners and render a local phishing page.