Intel Exchange

Cluster CL-STA-0954 (UNC5820) exploited multiple Fortinet vulnerabilities, including CVE-2024-47575 and CVE-2025-61624, to deploy a novel memory-resident ARM64 implant named PEERSTITCH against telecommunications providers.

The Ebury botnet hijacked 377 Tor exit relays to intercept SSH connections, steal passwords, and redirect encrypted mail traffic to plaintext ports.

Adversaries such as ShinyHunters are exploiting known vulnerabilities and unsecured remote access services to target the healthcare sector, leading to significant ransomware impacts and clinical disruptions.

China-nexus actor Fire Ant is compromising Cisco Nexus switches and IOS XR routers to harvest credentials and establish covert tunnels into critical infrastructure.

SLEEPWALKER is a sophisticated passive DLL backdoor targeting ERAAgent.exe that utilizes a custom bytecode command language and sniffs network traffic for magic trigger packets rather than beaconing.

The Evooo1Bot and GorillaBot threat actors are deploying highly modular Mirai-based malware targeting Linux systems and IoT devices to execute large-scale DDoS attacks and establish persistent proxy relays.

Evooo1Bot is a highly modular Linux botnet leveraging Mirai's DDoS engine alongside advanced SOCKS relay, SSH brute-forcing, and an extensive CVE exploit arsenal to compromise Internet-facing edge devices.

Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.

Gunra (also known as Golden Community) is a RaaS operation using a double-extortion model targeting critical infrastructure by exploiting vulnerabilities in Fortinet appliances and leveraging Impacket for lateral movement.

INC Ransomware and threat actor UTA0533 are weaponizing a zero-day exploit chain in SonicWall SMA 1000 series appliances to achieve root access and deploy memory-resident malware.