Kenji Choy

China-nexus actors and other threat groups are increasingly utilizing autonomous agentic AI frameworks like ARTEX and CyberStrikeAI to automate large-scale reconnaissance and rapid exploitation of cloud and on-premise environments.

APT28 (Swallowtail) is targeting NATO defense contractors and law enforcement using the HOOKEDGE backdoor, reverse SSH tunnels, and an undocumented reflective loader named ld.exe.

Critical unauthenticated remote code execution vulnerabilities in the PHP engine, dubbed PHP2Shell, are being exploited in the wild to deploy webshells.

Adversary c05d5254 uses the PoisonedRefresh rootkit to inject fileless PHP web shells into F5 BIG-IP APM memory via CVE-2025-53521 exploitation.

ShinyHunters (UNC6240) is targeting healthcare through identity-access extortion using vishing/AitM kits and mass exploitation of CVE-2026-35273 in Oracle PeopleSoft.

Sophisticated threat actor UAT-8616 and additional clusters are exploiting at least 12 vulnerabilities in Cisco SD-WAN, FMC, and ASA/FTD devices for persistent access and root escalation.

F5 BIG-IP APM is vulnerable to a critical unauthenticated remote code execution flaw (CVE-2026-94127) when configured as an OAuth Authorization Server, which is actively being exploited in the wild.

Ransomware groups including CHAOS, Medusa, and Gunra are increasingly targeting radiology departments and healthcare providers using double-extortion and extortion-only tactics.

Cluster c05d5254 utilizes the PoisonedRefresh rootkit to inject fileless PHP web shells into F5 BIG-IP APM memory via CVE-2025-53521 exploitation.

Adversaries such as ShinyHunters are exploiting known vulnerabilities and unsecured remote access services to target the healthcare sector, leading to significant ransomware impacts and clinical disruptions.