Ethan Andrews

SystemBC is a Windows-based malware family used as a SOCKS5 proxy and persistent RAT by major ransomware groups to tunnel malicious traffic and execute payloads.

Threat actors are using personal Gmail accounts and short.gy URL shorteners to deliver bilingual legal-threat lures for credential harvesting.

A flaw in the Linux kernel's act_pedit traffic-control action allows unprivileged users to gain root access by poisoning cached setuid binaries in memory.

Chinese-speaking threat actor CL-STA-1062 is targeting government and energy sectors in Southeast Asia using a custom .NET backdoor named TinyRCT.

A high-severity Linux kernel vulnerability (DirtyClone) allows local attackers to achieve root access by exploiting improper shared memory flag propagation in the networking stack.

The ShinyHunters extortion group is targeting Oracle PeopleSoft instances globally using a zero-day vulnerability (CVE-2026-35273) and credential spraying to steal data.

The Russia-linked Turla group is deploying STOCKSTAY, a multi-component .NET backdoor masquerading as benign utilities, to target government and military entities in Ukraine and Europe.

A phishing campaign forges a long-standing healthcare sender's identity to deliver multi-hop redirect links via abused SaaS platforms for credential harvesting.

Bluekit PhaaS leverages advanced Browser-in-the-Middle (BitM) techniques and AI to bypass MFA by streaming live DOM interactions to victims.

A sophisticated AiTM phishing campaign utilizes the PoisonSeeds kit to harvest AWS console credentials and bypass MFA via real-time challenge relaying.