Tim Peck

The Kimsuky group is deploying a new multi-stage LNK malware campaign targeting South Korean financial sectors using GitHub, Dropbox, and WordPress as functional C2 channels.

Threat actors are using fake Grand Theft Auto VI (GTA6) installers to distribute a multi-component malware package including RATs, infostealers, and a wiper.

A threat actor designated TH-3BB targeted Thai ISP 3BB and Jasmine International using CVE-2024-21762 for initial access and MeshCentral for persistent command-and-control.

Rapidly deployed AI-built educational applications are collecting sensitive student data, including PII and biometric inputs, often without basic security configurations or privacy policies.

A China-nexus threat actor is actively exploiting a critical path traversal flaw in VMware vCenter (CVE-2026-59310) to deploy the linuxFile backdoor and Babuk-derived ransomware across hypervisors.

The Dntry loader utilizes the Linux kernel keyring subsystem to store ELF payloads in slab memory, executing them via anonymous memory mappings to bypass traditional filesystem-based detection.

A Chinese-speaking operator utilized rogue Redis replication and multi-protocol exploit toolkits to compromise 3,562 servers for XMRig cryptomining across Asia and Europe.

Unidentified threat actors are exploiting a critical authentication bypass in UpdraftPlus to deliver PHP backdoors disguised as legitimate plugins.

Kimsuky leverages AI agents like opencode and HeadlessChrome to mass-produce decoy documents while evolving its GitHub-based LNK execution framework with enhanced evasion and persistence.

StyleSmuggler is an unauthenticated remote code execution vulnerability (CVE-2026-75650) in Adobe Commerce and Magento exploited to deploy persistent implants and web shells.