Intel Exchange

Direwolf is an emerging ransomware group using custom Golang-based malware and double-extortion tactics to target global organizations, particularly in the manufacturing and technology sectors.

Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.

Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.

ShinyHunters is targeting healthcare organizations using vishing to compromise SSO identities (Entra, Okta, Google) for rapid SaaS data exfiltration and extortion.

The pro-Ukrainian threat actor Bearlyfy (Toy Ghouls) is targeting Russian organizations using their custom GenieLocker ransomware across Windows, Linux, and ESXi platforms.

An authenticated attacker with repository write access can achieve remote code execution by exploiting an add/add collision in Gitea's diffpatch endpoint to plant a malicious Git hook.

BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.

Kimsuky targeted South Korean groupware vendors to compromise downstream customers using new Gomir malware variants and credential harvesting techniques.

Threat actors are spoofing OAuth client IDs in Microsoft Entra to perform stealthy user enumeration and credential validation without generating successful sign-in logs.

The WP-SHELLSTORM campaign targets WordPress and Joomla installations at scale using automated exploit scanners and webshells for access brokerage.