Find what you’re looking for
Browse everything
6,838 results in Threat Reports
MonsterCloud Ransomware Recovery Fraud: $19M Scam Exposes Industry Vulnerabilities
In October 2026, the U.S. Department of Justice charged Zohar Pinhasi, owner of Florida-based MonsterCloud, with wire fraud for allegedly defrauding ransomware victims by secretly paying ransom demands while claiming to use proprietary decryption tools. Between 2021 and 2023, Pinhasi charged clients over $19 million while secretly paying over $8 million in ransoms to threat actors, marking up fees by 500-1800% above actual ransom costs. In one case, he paid $8,200 to attackers but billed the client $150,000, falsely advertising advanced decryption capabilities that never existed. This case highlights the growing threat of secondary victimization in the ransomware ecosystem, where recovery firms exploit victim desperation. As ransomware attacks surge globally and organizations increasingly turn to third-party recovery services, this incident exposes critical trust gaps in the cybersecurity vendor ecosystem and underscores the need for transparency in incident response partnerships.
$10 Million Bounty: How HAFNIUM's Exchange Server Attacks Exposed Critical Infrastructure Vulnerabilities
The U.S. State Department is offering up to $10 million for information leading to the capture of Zhang Yu, a Chinese national charged in connection with the 2021 HAFNIUM attacks against Microsoft Exchange Server. Zhang, allegedly working as a director at Shanghai Firetech Information Science and Technology under direction from China's Ministry of State Security, coordinated cyberattacks that compromised over 12,700 U.S. organizations between February 2020 and June 2021. The campaign initially targeted COVID-19 vaccine research at universities before exploiting four zero-day Exchange Server vulnerabilities, including ProxyLogon, to conduct widespread espionage operations. This incident remains highly relevant as state-sponsored threat actors continue leveraging zero-day vulnerabilities and contractor networks to obscure attribution while targeting critical infrastructure and intellectual property at unprecedented scale.
16 Malicious Firefox Extensions Target Crypto Wallets in Sophisticated 2026 Campaign
In October 2026, cybersecurity researchers discovered 16 malicious Mozilla Firefox extensions masquerading as legitimate Rabby and OKX cryptocurrency wallets. These extensions specifically targeted cryptocurrency users by intercepting wallet recovery phrases and private keys during import flows, then exfiltrating the stolen credentials to attacker-controlled Cloudflare Workers infrastructure. The campaign represents a continuation of earlier attacks documented in August 2026, with threat actors rotating package names and extension identifiers while reusing the same credential-harvesting logic and network infrastructure. All identified extensions have been removed from the Firefox add-on store as of October 5, 2026. This incident highlights the growing sophistication of cryptocurrency-focused malware campaigns and the increasing abuse of browser extension ecosystems for credential theft. The attack demonstrates how threat actors are systematically targeting the expanding cryptocurrency user base through trusted distribution channels, making extension security and wallet hygiene critical priorities for organizations and individuals managing digital assets.
Wazza Phishkit: Advanced Multi-Stage Attack Targets Critical Infrastructure
The Wazza phishing kit represents a sophisticated multi-stage attack campaign targeting banking, government, and manufacturing organizations across the United States, Europe, and Australia in 2026. This advanced phishing operation employs a complex routing infrastructure that includes wildcard domains, session tokens, and anti-bot validation to filter victims before delivering Adobe-themed Device Code phishing pages. The campaign demonstrates significant evolution in phishing tactics, moving beyond simple credential harvesting to implement session management, traffic controls, and automated filtering systems that make detection more challenging for security teams. This incident highlights the current trend toward more sophisticated phishing infrastructure as attackers adapt to improved security detection capabilities and automated threat response systems across enterprise environments.
How AI-Powered ARTEX Tool Compromised South Korean Financial Institutions
Between late September and early October 2026, threat actors leveraged ARTEX, an open-source AI-powered penetration testing tool developed in China, to conduct targeted attacks against South Korean financial institutions. The campaign utilized large language models including DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 to automate reconnaissance, exploitation, and data exfiltration. CrowdStrike discovered the operation through exposed directories on a Hong Kong-based IP address containing Claude Code session histories and ARTEX configuration files. Evidence suggests Chinese-speaking operators motivated by financial gain, with attackers specifically researching Korean data breach marketplaces and Telegram sales channels. This incident highlights the emerging threat of AI-weaponized attacks where sophisticated language models automate complex multi-stage cyber operations. The misuse prompted ARTEX's developer to immediately transition the tool to closed-source, demonstrating how legitimate security research tools are being rapidly co-opted by malicious actors to enhance attack capabilities at scale.
Russia's UAC-0099 Evolves with ASHVEIN RAT and Anti-AI Evasion Tactics
The Russia-aligned threat actor UAC-0099, tracked as Earth Sirrush, has deployed a previously undocumented .NET infostealer and RAT called ASHVEIN (internally named TelemetryBrowser) in targeted attacks against Ukrainian government personnel since October 2025. The malware features credential theft capabilities for Chrome and Firefox browsers, screenshot capture, file enumeration, PowerShell remote shell execution, and encrypted command-and-control communications that hide tasking inside invisible HTML elements. UAC-0099 has been actively targeting Ukrainian government, defense, border guard, and logistics entities since mid-2022 following Russia's invasion, serving as an initial access broker for the destructive Sandworm APT group. This incident demonstrates the continued evolution of state-sponsored cyber espionage capabilities targeting critical infrastructure during ongoing geopolitical conflicts. The threat actor's shift from PowerShell-based tools to sophisticated .NET malware with anti-analysis features, including GuardBreaker techniques designed to fool AI-assisted security analysis, represents a significant advancement in evasion tactics that security teams worldwide must prepare to counter.
Microsoft FORGE Lab Scales AI Vulnerability Research to 140 CVEs in 2026
Microsoft's FORGE Lab demonstrated significant advances in AI-powered vulnerability research throughout 2026, discovering 140 CVEs in Windows systems and submitting 155 validated reports across 23 open-source projects. Using their multi-model agentic scanning harness (MDASH), the team achieved automated vulnerability discovery at scale, with proof-of-concept generation averaging $3.61 in model costs and 21.5 minutes per Linux kernel finding. The initiative included successful collaboration with the Linux Foundation's Akrites program, resulting in the first Akrites submission to achieve a merged Linux kernel patch. This research represents a paradigm shift in cybersecurity as AI-powered vulnerability discovery transitions from experimental capability to operational reality, fundamentally changing how organizations must approach security validation and remediation at machine speed.
Fake Brand Partnerships Target YouTube Creators in Sophisticated Google Account Takeover Scam
A sophisticated social engineering campaign targeting YouTube content creators impersonates legitimate brands like Hollyland, Nike, and Spotify to steal Google account credentials. The attack begins with personalized sponsorship emails referencing specific channel content, leading victims through a fake collaboration platform that appears legitimate with income calculators and contract features. The scheme culminates in a credential harvesting page disguised as Google OAuth authentication, allowing attackers to fully compromise accounts by changing recovery methods and backup codes. Once successful, attackers can access Gmail, Google Drive, and YouTube channels to spread malicious content or conduct further social engineering attacks against the creator's network. This incident highlights the growing trend of business email compromise targeting the creator economy, where attackers exploit the legitimate sponsorship process that content creators rely on for revenue. As social media influence becomes increasingly monetized, threat actors are adapting their tactics to exploit trust relationships between brands and creators.
Web3 Supply Chain Attacks Target Enterprise Cloud Infrastructure
Unit 42 researchers have identified a sophisticated evolution in supply chain attacks where threat actors exploit Web3 infrastructure components and open-source repositories to infiltrate enterprise cloud environments. These attacks leverage the decentralized nature of Web3 technologies, including blockchain nodes, smart contracts, and decentralized applications, as entry points into traditional cloud infrastructure. Attackers compromise popular npm packages, Docker containers, and Kubernetes configurations used in Web3 development, then pivot to cloud workloads and data repositories. The campaign has affected multiple organizations across financial services and technology sectors, resulting in data exfiltration and cryptocurrency theft. This attack pattern represents a critical shift as Web3 adoption accelerates in enterprise environments, creating new attack surfaces that traditional security controls often miss due to the hybrid nature of these deployments.
FBI-French Joint Operation Dismantles AI-Powered Deepfake Exploitation Network
In October 2024, the FBI and French authorities conducted a coordinated operation to seize two websites, NudeLeaksTeens and NLTVIDS, that were distributing child sexual exploitation material including AI-generated deepfake content. A 25-year-old French resident suspected of being the primary administrator was arrested by French cybercrime division. The sites monetized stolen and hacked content from social media platforms including Snapchat, TikTok, Instagram and Facebook, using cryptocurrency payments and proprietary currency systems. One collection containing 189GB of material on 315 victims sold for $64.90. This operation highlights the evolving threat landscape where cybercriminals are leveraging AI deepfake technology to create and distribute illegal content at scale. The case demonstrates how traditional cybercrime techniques like social media account compromise are being combined with emerging AI capabilities to exploit victims and evade detection through decentralized hosting and cryptocurrency payments.
Advantest Ransomware Attack Exposes Critical Gaps in Semiconductor Supply Chain Security
In February 2026, Advantest Corporation, a leading Japanese semiconductor test equipment manufacturer, suffered a ransomware attack that compromised sensitive personal information of individuals. Threat actors gained unauthorized access to company systems, deployed ransomware, and exfiltrated data containing contact information, Social Security numbers, driver's licenses, passport numbers, medical information, and financial data. The company took eight months to confirm the data breach, notifying affected individuals in October 2026 and offering 18-month identity monitoring services through Kroll. This incident highlights the continuing evolution of ransomware groups targeting critical semiconductor supply chain companies, exploiting the industry's increasing digitization and interconnected manufacturing processes that are vital to global technology infrastructure.
SonicWall Issues Critical SSRF Vulnerability Warning for SMA1000 Gateways
SonicWall disclosed a maximum-severity server-side request forgery (SSRF) vulnerability (CVE-2026-102255) affecting SMA1000 series appliances in October 2026. The flaw exists in the Appliance WorkPlace interface of SMA1000 6210, 7210, and 8200v models, allowing remote unauthenticated attackers to exploit an unintended alternate access path to direct appliances to issue requests on their behalf and perform unauthorized operations. SonicWall released hotfixes to address the vulnerability, with over 400 Internet-exposed SMA1000 appliances currently tracked by security researchers. This incident underscores the continuing threat to enterprise VPN infrastructure, as SMA1000 appliances have been repeatedly targeted throughout 2026 with multiple zero-day exploits leading to ransomware deployment and custom malware installation across government agencies and large corporations.