ills3c Intel&Coffee

Ransomware actors including Spikey Scorpius and Tarnished Scorpius are exploiting CVE-2026-0257 to bypass MFA and gain initial access to corporate networks via PAN-OS VPNs.

Russian threat actor APT28 compromised a NATO naval shipbuilder and other defense targets using the HOOKEDGE backdoor, a persistent SSH tunnel, and a custom reflective loader.

Attackers are weaponizing AI coding agents by placing malicious AGENTS.md instruction files in common directories to coerce the agents into installing rogue npm packages and executing arbitrary commands.

Unauthenticated attackers are exploiting CVE-2026-88771 in NetScaler ADC and Gateway appliances using a multi-stage log-poisoning technique to achieve remote code execution and deploy web shells.

Threat actors are using stolen UpdraftCentral connection keys to deploy malicious plugins and create administrator accounts on WordPress websites.

China-linked APT41 (FishMonger) is using BlackX, a UEFI bootkit evolved from BlackLotus, to bypass Secure Boot and maintain persistence on diplomatic targets in Central Asia.

Zeabur is permanently shutting down following an October 2026 breach that exposed 3.2 million secrets and granted attackers root access to customer infrastructure via compromised administrative credentials.

STAC4749 utilizes Microsoft Teams external chat and email bombing to impersonate IT support, gaining remote access via legitimate RMM tools to deploy GoGRPC and Chaos ransomware.

The XWorm 6.0 modular malware has resurfaced with over 35 plugins for data theft, ransomware, and persistence, primarily targeting Windows systems via phishing and malicious installers.

Cyber threat actors are actively exploiting a critical authentication bypass vulnerability (CVE-2026-102764) in BeyondTrust Remote Support to gain initial access and move laterally.