Intel Exchange

DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.

Adversaries such as ShinyHunters are exploiting known vulnerabilities and unsecured remote access services to target the healthcare sector, leading to significant ransomware impacts and clinical disruptions.

Silk Typhoon is suspected of exploiting a pre-authentication RCE chain in PaperCut NG and MF involving improper access control and unsafe class loading.

Unauthorized threat actors exploited a critical vulnerability (CVE-2026-63077) in the JetBrains Cadence service to access customer source code, credentials, and personal data.

A Russian-speaking operator compromised over 14,000 Dahua IP cameras globally, primarily in Ukraine and Russia, using authentication bypasses, P2P relay abuse, and credential brute-forcing.

Grafana MCP servers were found vulnerable to a critical killchain involving session spoofing and a 9.1 CVSS SSRF vulnerability that allows unauthenticated access to internal infrastructure.

A suspected Chinese-speaking operator utilized the SecFlow AI orchestration framework to exploit multiple vulnerabilities and deploy steganographic GLUTTON webshells against government and education targets across Asia.

KindaRails2Shell (CVE-2026-66066) is a critical remote code execution vulnerability in Ruby on Rails Active Storage caused by insecure default handling of untrusted libvips image loaders.

Unauthenticated attackers are actively exploiting a SQL injection vulnerability (CVE-2026-9586) in Sangoma Switchvox's /pa endpoint to achieve remote code execution and deploy reverse shells.

BREEZE COMET targets Brazilian financial services and payment systems like Pix using a custom multi-language malware suite and AI-accelerated tradecraft.