Intel Exchange

Everest is a sophisticated .NET-based ransomware that employs aggressive lateral movement, service termination, and process self-protection while targeting Windows environments.

China-nexus threat actors, including Storm-3069, utilize the modular NeedyMantis malware to maintain long-term access in telecommunications, government, and education sectors following initial compromise.

UNC6240 (ShinyHunters) is conducting mass exploitation of CVE-2026-35273 in Oracle PeopleSoft using WAF bypass techniques to deploy SIDEEYE backdoors and MeshCentral agents for extortion.

A suspected China-based threat actor exploited file upload vulnerabilities in a recreation management platform to deploy webshells and steal payment card data.

Unauthenticated attackers are exploiting CVE-2026-73570 in Zimbra Collaboration Suite to deploy JSP webshells, escalate privileges via PAM, and exfiltrate mailbox data.

A vulnerability in Cloudflare Containers allowed cross-tenant data exposure by recovering residual disk blocks from physical storage pools due to disabled block zeroing in Linux dm-thin provisioning. Note: No customer action required. This has been remediated by Cloudflare.

The Iranian Ministry of Intelligence and Security (MOIS) uses HEAVYGRAM (aka CHOSEN BRICK) malware to target dissidents and journalists via social engineering and Telegram-based command-and-control.

Unknown actors compromised MemTensor packages on npm and PyPI to deliver 'sckit', a Go-based worm designed for credential harvesting and self-propagation via CI/CD pipelines.

VK Group’s Max messenger facilitates state-level surveillance by providing unencrypted message access, mandatory pre-installation, and granular behavioral tracking of Russian users.

Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.