Tim Peck

Suspected UTA0576 exploited an Ivanti Connect Secure zero-day chain for root access and credential theft, documented via an exposed operator memory file.

DoNot APT (APT-C-35) utilized Go-based reverse shells and Inveigh credential harvesting tools targeting Pakistan's nuclear and energy sectors.

A 3AM ransomware affiliate targeted a UK school estate using a hybrid operation where a human operator guided an agentic AI loop to execute repetitive lateral movement and domain trust configuration tasks.

Videostrong Technology Co. developed and preloaded the XCPE backdoor into 1.3 million Android devices to facilitate ad-fraud and residential proxy monetization for criminal affiliates.

The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.

MadApe is an undocumented phishing kit that abuses Microsoft Device Code authentication via business-themed PDF lures and multi-stage redirects to compromise Microsoft 365 accounts.

An operator exfiltrated over 68 GB of SQL Server backups from a Philippine government agency and staged a rebranded GodPotato tool named Wrqsnx on an open directory.

The Shai-Hulud worm compromised the tensorlake npm package to exfiltrate secrets and cryptocurrency browser data while implementing a destructive 'dead-man's switch' upon token revocation.

A suspected Chinese threat actor is using SEO poisoning targeting DeepSeek AI users to deliver Kong RAT through a complex multi-stage infection chain.

An unknown APT group is using a complex .NET loading framework called NetamLoader to target customized Windows 10 builds used by Asian government entities via supply-chain infection vectors.