Threats & Attacks
Ransomware, malware, phishing and the actors behind them.
Global Law Enforcement Coalition Disables Massive WordPress Botnet
International authorities have successfully cleaned nearly 15,000 malware-infected WordPress websites and disabled infrastructure linked to the SocGholish botnet and Russian cybercrime gang Evil Corp.
Ghost-Sender: How a Common Exchange Setup Lets Attackers Impersonate Anyone
A widespread Microsoft Exchange misconfiguration allows attackers to spoof any email address—bypassing SPF, DKIM, and DMARC protections—and evidence suggests the flaw is being actively exploited in the wild.
Autonomous Defenders: Reframing the Phishing Threat for AI-Native Operating Systems
With the rise of AI-native operating systems and autonomous agentic workflows, the frontline against social engineering cyberattacks is migrating away from the individual employee. Instead of training humans to spot deceptive lures, the security burden is shifting to the OS and AI assistants themselves, exposing new architectural vulnerabilities like prompt injection, dynamic skill hijacking, and untrusted execution contexts.
Ukrainian National Extradited from Ireland Pleads Guilty to Conti Ransomware Conspiracy
A Ukrainian developer extradited from Ireland pleaded guilty to conspiracy charges for coding malware loaders used by the Conti ransomware syndicate, which extorted over $150 million from hospitals and businesses worldwide.
Legacy D-Link Routers Harnessed by Undocumented AryStinger Botnet for Malicious Proxy Operations
Qianxin researchers discovered AryStinger, a botnet exploiting CVE-2013-3307 and CVE-2016-5681 to turn outdated D-Link routers into proxy executors for scanning, DNS hijacking, and traffic interception.
The ChatGPT Outage Scam That Actually Lives Inside ChatGPT
Malicious actors exploit ChatGPT's content-sharing feature to host fake OpenAI outage pages, tricking users into downloading malware disguised as the ChatGPT desktop app in a campaign dubbed LLMShare.
No-Code Android RAT Lets Cybercriminals Build Custom Phishing Payloads for Device Takeover
BTMOB is a malware-as-a-service Android remote access trojan evolved from the SpySolr family, sold with an APK builder that lets buyers generate custom payloads and localized phishing lures without coding. Priced at $5,000 for a lifetime license plus monthly support, the RAT abuses Android Accessibility Services to escalate privileges and exfiltrate data, capture screenshots, record audio, and take full remote control of infected devices. First documented by Cyble in February 2025 and analyzed extensively by ESET in May 2026, BTMOB is primarily active across Brazil and Latin America but poses a growing regional threat.
Ransomware Ecosystem Realigns as European Markets Become Prime Targets
Ransomware gangs, once focused heavily on the US, are increasingly shifting their attention to European organizations and their broader supply chains, leveraging automation and exploiting new vulnerabilities in the region.
AI Built This Ransomware Toolkit—And It’s Learning Faster Than Your EDR
Sophos researchers uncovered a ransomware attack framework whose tool and payload development was assisted by Cursor and Claude Opus AI agents — generating nearly 80 evasion modules tested against Sophos, CrowdStrike, and Microsoft Defender EDR solutions.
Kodak Brings in Cyber Experts After Extortion Gang Says It Stole 2.2 Million Records
Kodak has confirmed a security breach and brought in external cybersecurity experts to investigate after the ShinyHunters extortion gang claimed responsibility for stealing over 2.2 million customer and corporate records, threatening to publish the data.
Prinz Eugen Ransomware: Go-Based Encryptor Targets Recent Files, Leaves No Footprint
Threatdown's deep-dive analysis of Prinz Eugen reveals a Go-based ransomware encryptor that sorts files by modification date to hit active data first, uses ChaCha20-Poly1305 with Argon2id key derivation, and leaves no ransom note — while attribution points to a lone operator known as ROOTBOY behind breaches including Standard Bank's 1.2 TB data theft.
FBI and CISA Warn: Russian Hackers Target Signal Backup Keys
The FBI and CISA warn that Russian intelligence is phishing Signal users to steal Backup Recovery Keys, granting attackers permanent access to message archives.