Intel Exchange

AISURU threat actors deployed Kimwolf v7 targeting Android TV boxes and IoT devices using Ethereum Name Service (ENS) for resilient C2 and advanced HTTP/2 DDoS fingerprinting.

Security researcher Chaotic Eclipse released a Windows Zero-Day PoC, LegacyHive, which enables arbitrary registry hive loading for privilege escalation across all supported Windows versions.

Researchers identified five critical and high-severity memory corruption vulnerabilities in the Cloudflare workerd runtime, enabling sandbox escapes and cross-tenant data theft.

The Pluto Hephaestus threat actor utilizes the AI-powered 'Hephaestus' framework to automate the full attack lifecycle against government and educational targets in Southeast Asia and South Korea.

Phantom Mantis utilizes a portfolio of kernel-mode tools, including the GentleKiller-related G12/G13 line and the DriverKiller BYOVD tool, to disable endpoint security products before ransomware deployment.

A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.

Nebula Security researchers disclosed IonStack, an exploit chain combining a Firefox JIT miscompilation (CVE-2026-10702) and a 15-year-old Linux kernel futex flaw (CVE-2026-43499) to achieve remote code execution and root privileges.

The Silver Fox group is targeting Japanese industrial manufacturing organizations using a modular three-driver BYOVD framework to deploy ValleyRAT for persistent remote access.

INC Ransomware and threat actor UTA0533 are weaponizing a zero-day exploit chain in SonicWall SMA 1000 series appliances to achieve root access and deploy memory-resident malware.

Researchers identified 84 'iTrue' vulnerabilities in cellular core networks arising from implicit trust between components, enabling denial-of-service and session hijacking across major open-source and commercial implementations.