Intel Exchange

The threat actor STAC4749 uses Microsoft Teams vishing to impersonate IT support, gaining remote access to deploy custom loaders, backdoors, and Chaos ransomware targeting North American organizations.

The Pluto Hephaestus threat actor utilizes the AI-powered 'Hephaestus' framework to automate the full attack lifecycle against government and educational targets in Southeast Asia and South Korea.

Chinese-speaking threat actor knaithe utilizes the Hermes Agent framework and DeepSeek LLM to orchestrate autonomous vulnerability research, target enumeration, and exploitation attempts against global infrastructure.

INC Ransomware and threat actor UTA0533 are weaponizing a zero-day exploit chain in SonicWall SMA 1000 series appliances to achieve root access and deploy memory-resident malware.

The Payouts King actor targets corporate environments using Microsoft Teams vishing and Quick Assist to deploy a multi-variant Go-based backdoor named GoGRPC.

Tengu is an evolved Mirai-derived IoT botnet featuring AEAD-encrypted C2, proxy capabilities, and aggressive self-defense mechanisms targeting Linux and Android systems.

A new Windows infostealer called Dolphin X, sold by the actor Kontraktnik, uses AI-driven triage to prioritize high-value corporate and DevOps targets.

TAG-195 (Golden Chickens) has introduced a new generation of modular malware, including TinyEgg and ChonkyChicken, featuring enhanced browser credential theft and session automation via CDP.

Anonymous researcher 'bikini' released Exploitarium, a repository containing over 30 proof-of-concept exploits for unpatched vulnerabilities across multiple software projects, including critical flaws in libssh2 and Gitea.

Kimsuky targeted South Korean groupware vendors to compromise downstream customers using new Gomir malware variants and credential harvesting techniques.