Tim Peck

UNC6240 (ShinyHunters) exploited an unauthenticated RCE chain in Oracle PeopleSoft (CVE-2026-35273) to target higher education and steal sensitive data.

Kimsuky targets South Korea and Japan using spear phishing to deploy LNK malware and abuse legitimate remote access tools like AnyDesk and Chrome Remote Desktop.

Chinese-speaking threat actor UAT-10147 leverages agentic AI frameworks like PentestGPT and DeepAudit to automate reconnaissance and exploit validation against Windows and Linux web servers.

Threat actors including APT29 and North Korean-linked campaigns are increasingly misusing trusted collaboration platforms like Slack and Microsoft Teams for identity phishing, credential theft, and persistence.

A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.

TWINLOOT is a sophisticated Python implant utilizing SharePoint for tasking, Teams TURN relays for SOCKS5 tunneling, and headless Edge for stealthy Microsoft Graph API transport.

Threat actors are abusing FTP banners as Dead Drop Resolvers (DDRs) to deliver novel RATs, E4del and PINHOLE, using legitimate services like Pinterest and SurveyMonkey for configuration retrieval.

NachoMDM is a research project demonstrating how a malicious MDM server can achieve silent SYSTEM code execution and UAC bypass by abusing the native Windows MDM enrollment process.

A Chinese-speaking threat actor is manually exploiting CVE-2026-33824, a critical double-free vulnerability in the Windows IKE Extension, to achieve pre-authentication remote code execution on VPN gateways.

The ClearFake campaign utilizes a new WordlistLoader to deliver Amatera Stealer (ACR Stealer) through social engineering techniques like FakeCaptcha and advanced WoW64 evasion.