Arnold Chan

The WEEVILPROXY threat actor is deploying JSCeal, a compiled V8 JavaScript malware that uses stolen session cookies to bypass Google authentication and target cryptocurrency investors.

SilkParasite is a China-nexus cyberespionage cluster targeting Central Asian government entities using a modular arsenal of seven RAT families, including five previously undocumented tools and AI-assisted tradecraft.

Funnull-linked threat actors exploited a Sub-Store zero-day through poisoned CDN dependencies to deliver multi-platform malware including ProRAM, RingH23, and iOS exploit kits.

China-nexus actor Fire Ant is compromising Cisco Nexus switches and IOS XR routers to harvest credentials and establish covert tunnels into critical infrastructure.

Threat actors are leveraging compromised WordPress sites and blockchain smart contracts to deliver Amatera password stealers and WebRTC stagers through ClickFix lures.

A Russian-speaking operator compromised over 14,000 Dahua IP cameras globally, primarily in Ukraine and Russia, using authentication bypasses, P2P relay abuse, and credential brute-forcing.

Salty Spider's long-standing Sality P2P botnet has been disrupted through a global sinkholing operation targeting its peer-to-peer communication and payload delivery infrastructure.

Grafana MCP servers were found vulnerable to a critical killchain involving session spoofing and a 9.1 CVSS SSRF vulnerability that allows unauthenticated access to internal infrastructure.

A suspected Chinese-speaking operator utilized the SecFlow AI orchestration framework to exploit multiple vulnerabilities and deploy steganographic GLUTTON webshells against government and education targets across Asia.

Toy Ghouls (Bearlyfy) is using new custom backdoors, mqtt-bird-agent and matrix-bird-agent, targeting Russian organizations via HiveMQ and Element C2 channels.