ills3c Intel&Coffee

Qilin (aka Agenda) is a high-volume Russian-speaking RaaS operation targeting global manufacturing and healthcare sectors through credential abuse and advanced EDR evasion.

Attackers deploy Remcos as a remote access tool to maintain persistent control, execute commands, and steal data from Windows systems.

Fedora 43 has released critical security patches for Request Tracker version 5.0.10, addressing seven vulnerabilities that could lead to unauthorized access or execution.

A compromised version of the Tensorlake npm package (v0.5.144) distributes the Shai-Hulud worm to steal developer credentials and crypto-wallets while utilizing Ethereum smart contracts for C2 agility.

Unknown attackers compromised the Rank Math PRO WordPress plugin version 3.0.123 to deploy self-rebuilding backdoors and unauthorized administrator accounts.

A Chinese-speaking threat actor is leveraging the ARTEX agentic AI framework to automate reconnaissance and exploitation of South Korean financial institutions, resulting in large-scale PII theft.

Threat actors are actively exploiting CVE-2026-114625, a critical SQL injection vulnerability in Arista VeloCloud Orchestrator, to escalate low-level authenticated access to superuser operator privileges.

Threat actors are actively exploiting a decade-old improper access control vulnerability in ProFTPD's mod_copy module to achieve unauthenticated remote code execution on Linux/Unix systems.

Chinese state-linked actors Flax Typhoon and Integrity Technology Group are exploiting a suite of legacy and modern vulnerabilities, including Apache Struts RCE, targeting critical infrastructure globally.

Lazarus Group targets global financial services and cryptocurrency sectors using supply chain compromises and trojanized software to fund the North Korean regime.