Intel Exchange

Earth Sirrush (UAC-0099) utilizes evolving .NET malware, steganographic delivery, and trojanized applications to target Ukrainian government and logistics sectors for long-term espionage.

An unauthenticated attacker can achieve remote code execution on Rejetto HFS by exploiting a predictable PRNG to forge administrator sessions.

An unidentified operator using Simplified Chinese tools conducted iOS exploitation via the Coruna kit, multi-vector web attacks, and an AI-assisted gambling SEO campaign.

WordPress Core versions 4.7.0 through 7.1.1 are vulnerable to an unauthenticated path traversal flaw (CVE-2026-87902) that can lead to remote code execution under specific environmental conditions.

Chinese threat actor UTA0565 utilized chained Chrome and Windows zero-day exploits through spoofed domains to deliver a custom obfuscated malware named CLEANGULP targeting government entities.

Chinese threat actors UTA0560 and JungleBamboo exploited a 'patch-gap' zero-day chain in Chrome and Windows to deploy the GRIMWEDGE backdoor and LONGTALE credential stealer.

Anthropic identifies multi-vector misuse of Claude AI models by state-sponsored actors (Russia, China, Iran), financially motivated groups (ShinyHunters), and commercial entities for cyber operations, surveillance, and conventional weapons development.

Multiple espionage threat actors, including China-aligned TA412, are deploying the BlueMoon exploit kit to chain Chrome V8 RCE and Windows kernel LPE vulnerabilities for malware delivery.

Suspected state-sponsored actors and cybercriminals, including Midnight Blizzard and ShinyHunters, are utilizing generative AI frameworks like PentAGI to automate the cyber kill chain, reconnaissance, and malware development against global targets.

UNC3569 is exploiting a one-click RCE vulnerability (CVE-2026-51990) in Sogou Input Method to deploy the GRAYRABBIT backdoor using a chained attack involving protocol handler injection and an outdated Chromium engine.