Intel Exchange

Suspected Silver Fox (Yinhu) threat actors are targeting Chinese-speaking users and multinational operations in China using high-fidelity spoofed vendor sites to deliver persistent implants like ValleyRAT.

A Russian-speaking Aurora ransomware affiliate utilizes AI-assisted planning and Active Directory exploits to compromise over twenty organizations globally before deploying a Zig-based encryptor.

ClickLock is a macOS information stealer and backdoor that uses social engineering and process-killing loops to coerce users into surrendering administrative credentials.

Direwolf is an emerging ransomware group using custom Golang-based malware and double-extortion tactics to target global organizations, particularly in the manufacturing and technology sectors.

Nova is a Rust-based Ransomware-as-a-Service that employs extensive Microsoft Defender evasion, process termination of security tools, and hybrid encryption to target multiple sectors globally.

The pro-Ukrainian threat actor Bearlyfy (Toy Ghouls) is targeting Russian organizations using their custom GenieLocker ransomware across Windows, Linux, and ESXi platforms.

ClickLock Dev uses ClickFix social engineering and aggressive process-killing loops to steal credentials and crypto wallets from macOS users in Europe and North America.

An unknown threat actor deployed a new Rust-based ransomware called Spirals against a South Asian IT services company using web shell access and rapid lateral movement.

The threat actor Hyadina has rebranded Beast ransomware as GodDamn, utilizing the malicious PoisonX kernel driver to disable endpoint defenses via BYOVD attacks.

A cryptocurrency-mining campaign exploits CVE-2026-33017, an unauthenticated RCE in Langflow, to deploy a Go-based miner with aggressive defense evasion and lateral movement capabilities.