Find what you’re looking for
Browse everything
6,868 results in Threat Reports
Russian APTs Exploit Messaging App Trust to Compromise EU Government Officials
In 2026, Russian state-sponsored threat actors conducted a sophisticated spear-phishing campaign targeting high-ranking EU government officials through encrypted messaging applications like WhatsApp and Signal. The attackers impersonated platform support teams and used QR code social engineering tactics to compromise accounts, successfully breaching officials including German Bundestag President Julia Klöeckner. Eight significant incidents were documented across EU governments, exposing the vulnerability of consumer messaging platforms used for official communications and prompting several nations to develop sovereign messaging solutions. This incident highlights the critical shift in nation-state attack vectors as threat actors exploit the inherent trust users place in encrypted messaging platforms, moving beyond traditional email-based phishing to leverage communication channels with less security oversight and monitoring capabilities.
How North Korean Operatives Are Infiltrating Organizations as Fake IT Workers
Throughout 2026, North Korean operatives significantly enhanced their tactics for infiltrating organizations by posing as legitimate IT workers using stolen or fabricated identities. Huntress Security documented three major investigations involving healthcare and financial services organizations where DPRK agents successfully gained employment, sent wages back to the regime, and potentially planted malware or stole sensitive data. These sophisticated insider threats utilized advanced techniques including PiKVM devices for remote hardware control, extensive VPN and proxy infrastructure to mask geolocation, digitally altered identity documents, and translation tools to overcome language barriers. This campaign represents the evolution of state-sponsored insider threats, where traditional perimeter security becomes irrelevant as malicious actors are hired as legitimate employees with authorized access to critical systems and data.
CISA Sounds Alarm: Six Critical Vulnerabilities Under Active Exploitation
In August 2026, CISA added six critical vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2026-8452 affecting Citrix NetScaler ADC and Gateway systems. Active exploitation was observed with attackers deploying web shells and conducting reconnaissance commands across 12 countries. The campaign also leveraged older Linux kernel flaws, Microsoft SQL Server vulnerabilities, and Red Hat system bugs, demonstrating how threat actors continue to exploit unpatched legacy systems alongside newer attack vectors. This incident highlights the persistent challenge of vulnerability management as AI-enabled threat actors increasingly automate exploitation of both recent and legacy flaws. The multi-vector approach demonstrates how attackers combine new and old vulnerabilities to maximize their attack surface against inadequately patched infrastructure.
GPUThor Rowhammer Attack Bypasses NVIDIA GPU Security in 2026 Breakthrough
In August 2026, University of Toronto researchers disclosed GPUThor, a sophisticated Rowhammer attack targeting NVIDIA workstation GPUs with GDDR6 memory that defeats error correction codes (ECC). The attack impacts RTX A6000, A5000, A4500, and A4000 models, enabling attackers to achieve denial-of-service conditions and privilege escalation to root access on host systems. GPUThor uses non-uniform hammering techniques to generate up to 377,000 bit flips per gigabyte, vastly exceeding previous GPU Rowhammer attacks and successfully bypassing NVIDIA's recommended ECC mitigation through multi-bit corruption exploitation. This hardware vulnerability represents a significant evolution in GPU-based attacks as organizations increasingly rely on shared GPU infrastructure for AI workloads and cloud computing. The attack highlights critical security gaps in hardware-level protections and the growing attack surface presented by specialized computing hardware in enterprise environments.
Dark Caracal's GoCaracal Malware Pioneers Ethereum Smart Contract C2 Infrastructure
In June 2026, threat actors linked to Dark Caracal deployed GoCaracal, a previously undocumented Go-based malware framework, against a Venezuelan communications organization. Arctic Wolf discovered this sophisticated malware uses Ethereum smart contracts as a fallback mechanism to retrieve replacement command-and-control (C2) server addresses when primary servers fail. GoCaracal provides remote shell access, payload execution, browser data theft, keylogging, and remote desktop control capabilities, delivered through phishing campaigns using malicious SVG files. This incident demonstrates the evolution of C2 resilience mechanisms as threat actors adapt to increased infrastructure takedowns and incorporate blockchain technology for operational persistence, highlighting the need for comprehensive egress filtering and behavioral anomaly detection.
Spark RAT Exploits Vulnerable OPSWAT Driver in Sophisticated Cambodia Campaign
Between June and August 2026, threat actors conducted a sophisticated campaign targeting individuals and organizations in Cambodia using Spark RAT, an open-source remote access trojan. The multi-stage attack leveraged phishing emails with localized lures including government notices and health materials to distribute Inno Setup executables. The campaign employed advanced techniques including DLL sideloading, bring-your-own-vulnerable-driver (BYOVD) tactics using OPSWAT's ardrv.sys driver, and multi-layered persistence mechanisms to disable security software and maintain access to compromised systems. This incident highlights the growing sophistication of nation-state and advanced persistent threat actors who are increasingly leveraging legitimate-but-vulnerable drivers to bypass modern endpoint security solutions, representing a critical evolution in attack methodologies that organizations must address immediately.
How TeamPCP's Supply Chain Attack Compromised 1,000+ Organizations Through Trusted Security Tools
In March 2026, the TeamPCP cybercrime syndicate executed a sophisticated supply chain attack that compromised multiple open-source security tools including Trivy scanner, Checkmarx KICS, and LiteLLM AI gateway. The attackers stole publishing credentials from trusted projects and pushed poisoned versions through legitimate release channels across GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX ecosystems. This credential-chaining technique allowed them to compromise over 1,000 organizations globally, steal more than 500,000 credentials, and exfiltrate at least 300GB of sensitive data including CI/CD pipeline secrets and cloud access tokens. This incident highlights the growing sophistication of supply chain attacks targeting the software development lifecycle, particularly as organizations increasingly rely on open-source components and automated CI/CD pipelines without proper security controls and credential management practices.
CISA Expands KEV Catalog: Six Critical Vulnerabilities Under Active Exploitation
On August 26, 2026, CISA added six actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, spanning from 2015 to 2026. The vulnerabilities affect critical infrastructure components including Red Hat Libuser, Microsoft SQL Server, Linux Kernel, Ajax.NET Professional, and Citrix NetScaler ADC/Gateway systems. These CVEs enable race condition exploits, privilege escalation, remote code execution, deserialization attacks, memory corruption, and buffer overflow exploits that grant attackers total system control. This advisory reinforces the urgency of risk-based vulnerability management as federal agencies face increased scrutiny under BOD 26-04, which mandates rapid remediation of KEV-listed vulnerabilities on publicly exposed assets while establishing breach assessment requirements for delayed patching.
CVE-2025-3511 Exposes Critical Flaws in Industrial Network Security
In May 2025, CISA disclosed CVE-2025-3511, a critical denial-of-service vulnerability affecting over 45 Mitsubishi Electric factory automation (FA) products including CC-Link IE TSN modules, MELSEC iQ-R/iQ-F series controllers, and Ethernet interface modules. The vulnerability stems from improper validation of UDP packet quantities, allowing remote attackers to send specially crafted UDP packets that cause system crashes, communication delays, or timeout errors requiring manual system resets for recovery. This vulnerability highlights the growing threat surface in industrial control systems as manufacturers increasingly adopt networked automation technologies. With a CVSS score of 7.5, the flaw demonstrates how input validation failures in industrial protocols can create significant operational disruptions in critical manufacturing environments.
Amazon Kiro IDE Vulnerability Exposes Critical AI Security Gaps
In August 2026, cybersecurity researchers disclosed a critical vulnerability in Amazon Kiro IDE that enables data exfiltration through prompt injection attacks. The flaw allows attacker-controlled repository content to influence Kiro's AI agent, causing sensitive local information to be transmitted to external endpoints without explicit user consent. Exploitation requires minimal user interaction - simply opening a malicious workspace file and sending any message to the agent triggers the vulnerable flow. Amazon addressed the issue in version 0.8.140 following responsible disclosure. This incident highlights the emerging threat landscape surrounding AI-powered development tools, where prompt injection attacks are becoming increasingly sophisticated. As organizations rapidly adopt AI coding assistants and autonomous development environments, these tools present new attack vectors that blur traditional security boundaries between trusted and untrusted content.
AI Infrastructure Under Attack: Critical Vulnerabilities in LiteLLM, RAGFlow, and Kestra
Between 2026 and early 2027, Microsoft observed coordinated attacks targeting AI infrastructure components including LiteLLM gateways, RAGFlow retrieval platforms, and Kestra workflow orchestration environments. Attackers exploited vulnerabilities including CVE-2026-42271, CVE-2026-48710, and CVE-2026-49869 to gain initial access, then systematically harvested model provider API keys, database credentials, and container secrets. The campaigns resulted in credential theft, cryptocurrency mining operations, persistent backdoor access, and potential unauthorized use of AI services. The attacks demonstrate how AI infrastructure has become a high-value target due to its concentration of credentials, data access privileges, and compute resources in centralized control points. These incidents highlight the emerging threat landscape where AI infrastructure components are increasingly targeted as control planes for broader enterprise compromise. As organizations rapidly deploy AI systems without adequate security controls, attackers are adapting their techniques to exploit the unique trust relationships and credential concentration inherent in AI gateways and orchestration platforms.
Polymorphic Phishing: When Advanced Evasion Techniques Backfire
In August 2024, cybersecurity researchers identified a sophisticated polymorphic phishing campaign that generates unique variants of credential-stealing pages for each visitor. The attack uses heavily obfuscated JavaScript with randomized function names, variable declarations, and page elements to evade detection systems that rely on static signatures. However, the polymorphic generation mechanism contains coding flaws that occasionally produce non-functional pages due to improper variable scope handling, causing infinite loops that prevent successful credential harvesting. Analysis of 50 page samples revealed a 4% failure rate where broken variants would consume 100% CPU utilization instead of displaying the phishing form. This incident highlights the evolving sophistication of phishing operations and the double-edged nature of advanced evasion techniques. As threat actors increasingly adopt polymorphic methods to bypass security controls, organizations must move beyond signature-based detection to behavioral analysis and real-time inspection capabilities.