Tim Peck

dMSA Ouroboros is a persistence technique in Windows Server 2025 that uses self-referencing GroupMSAMembership and Shadow Credentials to automate the extraction of NT hashes from superseded accounts.

China-nexus threat group UAT-8302 targets government entities in South America and southeastern Europe using a suite of shared and custom malware including NetDraft, CloudSorcerer, and VSHELL.

The threat actor STAC6405 is conducting an ongoing phishing campaign targeting U.S. organizations with a dual-RMM architecture using SimpleHelp and ScreenConnect for persistent, silent access.

A Qilin ransomware affiliate is targeting WatchGuard and Fortinet appliances using multiple CVEs to deploy Sliver C2 and establish reverse SOCKS tunnels into internal networks.

China-aligned actor SHADOW-EARTH-053 targets government and defense sectors in Asia using DLL sideloading, multiple tunneling tools, and exploitation of CVE-2025-55182.

VECT 2.0 ransomware permanently destroys data in files larger than 128 KB due to a critical nonce-handling flaw across Windows, Linux, and ESXi platforms.

The TeamPCP campaign hijacked the @bitwarden/cli npm package to distribute a sophisticated stealer targeting developer credentials, cloud secrets, and AI configuration files.

The Mini Shai-Hulud malware targets SAP npm packages to steal developer and cloud credentials using an obfuscated Bun-based execution framework.

The Nightmare-Eclipse toolset, including BlueHammer and RedSun, was observed in a live intrusion following initial access via compromised FortiGate VPN credentials.

The Shai Hulud threat actor compromised SAP CAP framework packages by exploiting an AI coding assistant's GitHub integration to inject malicious code and steal npm OIDC tokens.