Tim Peck

SLEEPWALKER is a sophisticated passive DLL backdoor targeting ERAAgent.exe that utilizes a custom bytecode command language and sniffs network traffic for magic trigger packets rather than beaconing.

An unauthenticated attacker can achieve root Remote Code Execution on SonicWall GMS by chaining multiple patch bypasses for legacy vulnerabilities.

The BRIDGEHEAD campaign utilizes 40 npm typosquatting packages to jump from WSL environments to Windows hosts, deploying a Rust-based stealer for cryptocurrency wallets and browser credentials.

The BengalSEO group, linked to WeConnect Solutions and Garage2Global, utilizes sophisticated SEO poisoning and a custom Traffic Distribution System (TDS) to deploy MayaBot malware and tech support scams.

The Superior threat actor uses 19 malicious Chrome and Edge extensions to deliver wallet drainers and credential-stealing payloads through a modular JavaScript framework.

A cluster of trojanized npm packages delivers the RedShell Linux implant, which features an AI-driven post-exploitation layer called Red Agent.

UNC6240 (ShinyHunters) exploited an unauthenticated RCE chain in Oracle PeopleSoft (CVE-2026-35273) to target higher education and steal sensitive data.

Adversaries are chaining a JWT authentication bypass with unsafe .NET type instantiation in SharePoint's Business Connectivity Services to achieve remote code execution.

Kimsuky targets South Korea and Japan using spear phishing to deploy LNK malware and abuse legitimate remote access tools like AnyDesk and Chrome Remote Desktop.

Chinese-speaking threat actor UAT-10147 leverages agentic AI frameworks like PentestGPT and DeepAudit to automate reconnaissance and exploit validation against Windows and Linux web servers.