Tim Peck

Silk Typhoon is suspected of exploiting a pre-authentication RCE chain in PaperCut NG and MF involving improper access control and unsafe class loading.

Tengu is a Linux-based botnet targeting IoT and server environments, utilizing kernel-worker masquerading and multiple persistence mechanisms to facilitate DDoS attacks.

Lazarus Group is targeting macOS users with trojanized application installers that deliver the OtterCookie RAT through a multi-stage infection chain.

A Russian-speaking Aurora ransomware affiliate utilizes AI-assisted planning and Active Directory exploits to compromise over twenty organizations globally before deploying a Zig-based encryptor.

The BlueKit threat actor group is conducting a sophisticated Phishing-as-a-Service campaign targeting financial sector CEOs using browser-in-the-middle techniques and post-authentication ScreenConnect delivery.

Virtualizor update infrastructure was compromised to deliver the 'nerat' RAT via malicious PHP modifications and a Java-based persistence mechanism on hypervisor nodes.

Mini Shai-Hulud threat actors compromised the '@7nohe/openapi-react-query-codegen' npm package by abusing comment-triggered GitHub Actions workflows to publish malicious versions targeting cloud and registry credentials.

DPRK-nexus actors, likely Sapphire Sleet, leveraged malicious Rust packages on crates.io to deploy Rustbot, a macOS RAT targeting cloud credentials and cryptocurrency wallets.

The Armadin Attacker uses a new tool called PRTremote to hijack Entra ID Primary Refresh Tokens by executing scheduled tasks within interactive user sessions over SMB.

Threat actors are abusing the legitimate Faronics Deploy platform to execute malicious PowerShell scripts and establish persistent remote access via ScreenConnect.