Threat Intelligence

Week 32 Security Roundup: The Management Plane Is the Target

TeamCity, N-central, and Cisco FMC put the same lesson in three different packages: attackers want the systems that already control everything else.

DEF CON 34: The Hacker Party That Became the World's Biggest Hacking Conference

DEF CON started as a farewell party for a BBS sysop who never showed up. 33 years later it draws more than 30,000 people, shapes election security policy, and lets autonomous AI agents hunt flags.

One Email Preview Is Enough: Russia's Half-Click Webmail Exploits

Russian-aligned espionage groups exploited stored XSS flaws in Zimbra, SOGo, Roundcube, MDaemon, and Kerio. Opening a message was enough to lose credentials, email, and persistent access.

JADEPUFFER: Inside the First Documented Agentic Ransomware Attack

Sysdig caught an LLM agent breaking into a Langflow server, pivoting to a production database, and extorting the victim — with no human at the keyboard between steps. Here's what actually happened, and what's still unproven.

FortiBleed's Ransomware Pipeline: What SOCRadar's INC Ransom and Lynx Attribution Actually Proves

SOCRadar says the FortiBleed credential campaign feeds directly into INC Ransom and Lynx ransomware operations, with 430,000 FortiGate devices targeted. Here's what's confirmed, what's one vendor's assessment, and what it means for your firewall.

Exploited Before the PoC Existed: CVE-2026-46817 in Oracle Payments

A critical, unauthenticated flaw in Oracle E-Business Suite's Payments module was hit in the wild on June 27, 2026 — six weeks after the patch, with no public exploit code anywhere. Here's what's confirmed, what's still speculation, and how to check if you're exposed.

CVE-2026-48558: A Perfect 10 in SimpleHelp Opens the Door for Djinn Stealer

An unsigned OIDC token is all it takes to become a fully authenticated technician on a SimpleHelp RMM server. Attackers are already using that shortcut to push a cross-platform infostealer built for the AI era.

Cloud Concentration Risk: A Single Point of Failure

Recent AWS and Cloudflare disruptions show how shared cloud, identity, and network dependencies turn localized faults into widespread outages. Here is how to find and reduce that hidden blast radius.

The VPN Was Never the Problem: How a Windows Telemetry ID Unmasked a Scattered Spider Suspect

A 19-year-old allegedly hid behind a VPN and ngrok during an $8M jewelry-retailer extortion case. Windows' Global Device Identifier (GDID) gave investigators a device-level pivot.

The Watchdog Got Bitten: Pegasus Spyware Hit the EU Committee Investigating It

A member of the EU committee investigating Pegasus abuse was hacked with Pegasus himself. Here is how forensic researchers proved it — and how to run the same detection process yourself.

FBI Seizes NetNut: How a 2-Million-Device Proxy Botnet Hid Inside Smart TVs

The FBI seized hundreds of domains tied to NetNut after Google and security researchers linked the residential proxy network to Popa, a 2-million-device botnet of smart TVs and streaming boxes.

AI Cyber Sovereignty: What Happens When Your Best Defender Can Be Switched Off?

Frontier cyber AI is becoming controlled infrastructure. The security risk is not only that attackers get stronger models, but that defenders become dependent on capabilities a vendor or government can withdraw.

Operation Endgame Hits SocGholish: FakeUpdates Takedown

Operation Endgame's June 2026 action against SocGholish shows why fake browser updates, compromised WordPress sites, and criminal loader infrastructure still matter to defenders.

Prinz Eugen Ransomware Encrypts Your Newest Files First

A new Go-based ransomware family prioritizes recently modified files, uses RDP and legitimate remote-management tooling, and leaves no ransom note on disk. Here's what to hunt and harden.

47-Day Certificates Will Make Every Website Look Like a Phishing Site

The CA/Browser Forum is cutting TLS certificate lifespans from 398 to 47 days by 2029 to reduce the value of stolen certificates. The fix creates a bigger target: the automation that now issues every certificate on the internet.

ShinyHunters Were Inside Two Weeks Before Oracle Noticed

A critical, unauthenticated RCE in Oracle PeopleSoft let ShinyHunters compromise universities and other organizations for weeks before Oracle's advisory caught up. Google notified 100+ potentially exposed organizations. The technical breakdown, IOCs, and what to hunt for.

How Europol Is Catching Cybercriminals in 2026

Europol does not usually kick down the door. It makes cybercrime investigations cross-border, evidence-rich, and harder for offenders to escape.

N-days Are Becoming N-hours

Anthropic's June 2026 N-day research shows how frontier models can turn public patches into working exploits in hours. Here's what defenders should change now.

Court Said Stop. Meta Says NSO Group Didn't Listen.

Meta says NSO Group violated a federal court's permanent injunction within months of receiving it by running new social engineering attempts against WhatsApp users. Meta is now seeking contempt of court.

You Are Now the Minority: Bots Have Officially Taken Over the Internet

2026 reports confirm bots now generate 53% of all internet traffic — the second year running that automated traffic outnumbers humans. Here's what that actually means.

The AI Evasion Lab

Sophos X-Ops uncovered a threat actor using Claude Opus 4.5 and Cursor IDE to build an automated, modular EDR evasion framework — 80 modules, 70+ techniques, tested against Sophos, CrowdStrike, and Defender.

Why Finland and Japan Consistently Top Every Cybersecurity Metric

Finland and Japan lead global cybersecurity rankings across multiple independent measures. The explanation is not primarily technical — it is socioeconomic.

No One in the Loop: The Autonomous Weapons Race

China's so-called 'kill them all' drone algorithm made headlines. But the real story is bigger: major militaries are racing to reduce human involvement in lethal decisions, and the window to regulate them is narrowing.

The IT Guy Who Wasn't: How Attackers Walk Through Your Front Door

Physical social engineering is back — and the attacker doesn't have to be an IT guy. Learn how anyone with the right uniform and pretext can walk through your front door, and how organizations can fight back.

Netherlands Seized 800 Servers: Bulletproof Hosting Is Now a Sanctions Problem

Dutch investigators seized more than 800 servers in a sanctions case tied to Stark Industries. The lesson for defenders is simple: attacker infrastructure is a business ecosystem.

Verizon DBIR 2026: The Remediation Paradox

Verizon's 2026 DBIR confirms vulnerability exploitation as the #1 breach vector for the first time in 19 years — while remediation rates dropped and patch times increased. Here's what the data actually says.

GitHub's VS Code Extension Breach: What We Know, What We Don't, and How to Defend

GitHub says an employee device was compromised through a poisoned third-party VS Code extension and internal repositories were exfiltrated. Here is the fact-checked breakdown for defenders.

Windows Attack Techniques 2026: BYOVD, ClickFix, and C2 over Cloud

BYOVD EDR evasion, ClickFix delivery, C2 over cloud services — how modern Windows attackers operate in 2026, and the detection logic to catch them.

Ransomware Doesn't Need to Encrypt Anymore — And That's the Point

22% of ransomware incidents in 2026 involve no encryption at all. The threat model has shifted from disruption to silent exfiltration — and most defenses haven't caught up.

$10 Million Ransom, Four Days of Peace, and Then the Login Page Changed

ShinyHunters breached Canvas LMS, stole 275 million students' data, took the ransom — and attacked again four days later. Here's who they are and why arrests haven't stopped them.

Unmasking TeamPCP: The Supply Chain Saboteurs and the Trails They Left Behind

TeamPCP has compromised hundreds of open-source packages and stolen half a million credentials. But their OPSEC is leaking — and someone is already hunting them.

500 Microsoft CVEs Later — We're Still Measuring Security Wrong

Microsoft patched 500+ vulnerabilities in five months. Linux ecosystems patched even more. So which is more secure? That's the wrong question — here's the metric that actually matters.

Shai-Hulud: The Open-Source GitHub Actions Token Harvester That Just Went Public

TeamPCP's Shai-Hulud is a TypeScript/Bun C2 framework targeting GitHub Actions CI/CD pipelines — it steals GitHub tokens, exfiltrates via a fake git domain, and has now been open-sourced for anyone to deploy.

When the Weapon Learns: How Nation-States Weaponized AI Across the Full Attack Chain

Google GTIG's May 2026 report documents a turning point: state actors now use AI to write zero-day exploits, build self-navigating backdoors, and poison the AI supply chain itself.

Europe's Digital Independence Push: EuroStack, Sovereign Cloud, and Breaking Free from US Infrastructure

France is migrating 2.5 million government PCs to Linux. Europe is building its own payment network to rival Visa and Mastercard. EuroStack aims to replace AWS and Azure. Here's what's happening, why it matters for security, and how realistic it is.

CallPhantom: How 28 Fake Apps Collected Payments for Data That Never Existed

ESET uncovered CallPhantom — 28 Android apps with 7.3M downloads that sold fabricated call histories. A deep dive into the fraud mechanics, billing bypass, and how to protect yourself.

The World's Most Dangerous Hacking Teams: A Guide to Nation-State APT Groups

Meet the elite state-sponsored hacking groups that stole billions, blacked out cities, and infiltrated governments. Who they are, what they want, and how they operate in 2026.

AutoHotkey Malware Loaders: How Attackers Weaponize Automation Scripts

AutoHotkey isn't just for productivity scripts — attackers use it as a stealthy malware loader. Learn how AHK-based campaigns work and how to detect them.

Claude Mythos: The AI That Rewrites the Rules of Cybersecurity — For Everyone

Anthropic built an AI that autonomously discovered a 27-year-old vulnerability in widely-used code. It can build working exploits from scratch. It's too dangerous to release publicly. Here's what that means for your bank, your government, your code — and the future of digital security.

The 'Fix' Is the Exploit: ClickFix, FileFix, JackFix and Pastejacking Attacks Explained

ClickFix attacks trick users into running malicious code disguised as legitimate troubleshooting. Learn how these social engineering tactics work and how to defend against them.

The Digital Parasite: How Attacker Tradecraft Evolved in 2026

80% of top MITRE ATT&CK techniques now focus on evasion and persistence. Attackers abandoned smash-and-grab for long-term parasitic operations in networks.

Why You Should Remove GAID From Your Android Phone Today

Discover why removing Google Advertising ID (GAID) from your Android device is crucial for privacy. Learn the simple steps to delete GAID and protect your data in 2026.

Hacking Prison Sentences: Real Convictions That Should Terrify You

From 10 years to life in prison - real cybercrime convictions from Europe, USA, and Asia. DDoS, ransomware, and data theft aren't victimless crimes.

Kimwolf Botnet: 2 Million Hijacked Devices Reshaping Threat Landscape

The Kimwolf botnet has compromised over 2 million devices worldwide by exploiting residential proxy networks and unsecured Android TV boxes. Here's what threat intelligence reveals about its infrastructure, tactics, and how to defend against it.

Project Glasswing: Anthropic's AI That Finds Zero-Days Better Than Humans

Anthropic just unveiled Claude Mythos Preview — an AI model too dangerous to release publicly, but powerful enough to find vulnerabilities that evaded detection for decades. Here's what it means and how to get involved.

State-Sponsored Threat Actors 2026: Who They Are and What They Do

A threat intelligence deep-dive into the world's most dangerous state-sponsored APT groups — their identities, motivations, campaigns, and tradecraft in 2026.

UEFI Bootkits: The Malware That Lives Below Your Operating System

UEFI bootkits survive OS reinstalls, hide from every AV and EDR tool, and can bypass Secure Boot on fully-patched systems. Here's how they work and what you can do about it.

Xanthorox AI: When the Attacker's AI Goes Dark

Xanthorox is an offline, modular AI attack platform with five specialized models — and it needs no cloud, no API, and leaves no traditional IoCs. Here's what defenders need to know.

Violence-as-a-Service: How Organized Crime Borrowed the Cybercrime Playbook

Europol's OTF GRIMM has made 280 arrests in one year targeting criminal networks that outsource violence like a SaaS product. The model mirrors ransomware-as-a-service — and it's recruiting teenagers through Discord and encrypted apps.

MITRE ATT&CK v19: Defense Evasion Is Dead — Meet Stealth and Impair Defenses

ATT&CK v19 drops April 28 and splits Defense Evasion into two tactics. Here's what changes, why it matters for detection engineering, and what you need to do before the weekend.

From CVE to RCE in Hours: The Collapse of the Exploitation Window

The average time from vulnerability disclosure to active exploitation has collapsed from 756 days in 2018 to mere hours in 2025. Here's what that means for defenders.

Vulnerability Exploitation Overtook Phishing — What That Means for Defenders

For the first time, vulnerability exploitation is the #1 initial access vector — not phishing. Here's what the data says and how defenders must adapt.

OSINT and Recon Methodology: A Practical Guide for Security Professionals

How to systematically map an organization's attack surface using open-source intelligence — domains, infrastructure, employees, leaked credentials, and exposed secrets.

Cookie-Controlled PHP Webshells: A Stealthy Tradecraft in Linux Hosting Environments

Microsoft's Defender team uncovered a clever attacker technique: PHP webshells that stay completely dormant until activated by a secret HTTP cookie. Here's how it works — and how to catch it.

Salt Typhoon: How China Hacked the World's Largest Telecoms

Salt Typhoon is the worst telecom breach in history. The Chinese APT stayed hidden for years inside AT&T, Verizon and T-Mobile. Here's the full attack chain, the tools they used, and the detection opportunities blue teams missed.

What 218 Million Honeypot Events Reveal About January 2026

Global honeypot sensors logged over 218 million malicious events in January 2026. MSSQL attacks doubled, botnet infrastructure expanded 50%, and attackers pivoted away from RDP toward database targeting.

The Human Remains the Weakest Link – But Now It's AI-Assisted

AI has transformed social engineering into an automated, scalable threat. Learn how attackers leverage AI-powered phishing, deepfakes, and voice cloning—and what defenders can do about it.

Cybersecurity in 2025: Holiday Season Security Guide and Year-End Threats

Cybersecurity threats heading into 2025: AI-powered attacks, ransomware trends, and quantum threats — with practical security measures for the holiday season and beyond.