Intel Exchange

Everest is a sophisticated .NET-based ransomware that employs aggressive lateral movement, service termination, and process self-protection while targeting Windows environments.

The researcher Nightmare Eclipse (aka MSNightmare) has released multiple proof-of-concept exploits targeting Windows Defender, Kaspersky, Avast, CrowdStrike, and NVIDIA drivers to achieve local privilege escalation or denial-of-service.

BlackSuit ransomware operators conducted a 9-day intrusion starting with VPN brute-force attacks on non-MFA accounts, followed by lateral movement via RDP and data staging before enterprise-wide encryption.

A Russian-speaking Aurora ransomware affiliate utilizes AI-assisted planning and Active Directory exploits to compromise over twenty organizations globally before deploying a Zig-based encryptor.

An unidentified threat actor leveraged SQL injection on a Tomcat application to install a database-resident post-exploitation toolkit called khunt on an Oracle server.

Evidence refutes the attribution of TAG-150 commodity Russian Malware-as-a-Service (MaaS) and ClixFlare infrastructure to the Iranian state actor MuddyWater.

Attackers can abuse the legitimate Windows Bind Filter driver (bindflt.sys) to virtualize file paths, allowing malicious code to masquerade as trusted system files and blind EDR sensors.

An unknown threat actor deployed a new Rust-based ransomware called Spirals against a South Asian IT services company using web shell access and rapid lateral movement.

The GoSerpent campaign utilizes a sophisticated suite of Go-based backdoors and specialized loaders to collect and exfiltrate sensitive data from government and diplomatic entities in Southeast Asia.

Offensive researchers are using large language models to automate the reverse engineering of EDR products, extracting static YARA rules, behavioral logic, and ML model classifiers to facilitate bypasses.