Threats & Attacks
Ransomware, malware, phishing and the actors behind them.
Under 24 Hours to Lockout: How Spirals Portends AI Cybersecurity Threats in 2026
A technical breakdown of the June 2026 Spirals ransomware intrusion, where threat actors moved from IIS web shell access to network-wide Rust-based encryption in under 24 hours.
Artificial Intelligence AI Cybersecurity: How HOLLOWGRAPH Abuses M365 Calendars for Covert Espionage
Group-IB researchers uncovered HOLLOWGRAPH, a focused espionage malware abusing Microsoft 365 calendars set for May 13, 2050, to stash commands and exfiltrated files via the Graph API.
How Artificial Intelligence AI Cybersecurity Defenses Face Scammers Leveraging Leaked ShinyHunters Data for $2,000 Sextortion Scams
Cybercriminals harvest email addresses from leaked ShinyHunters breaches to run automated $2,000 sextortion campaigns, highlighting critical gaps in enterprise defense practices and human security.
Beyond Phishing: How AgentForger Weaponized ChatGPT Link Parameters into Stealth Corporate Moles
Verified findings on the AgentForger vulnerability in OpenAI ChatGPT Workspace Agents (disclosed by Zenity Labs), detailing how URL parameters in Agent Builder allowed attackers to silently deploy persistent, autonomous rogue AI agents via single-click phishing links.
Dolphin X: How AI-Powered Malware is Changing the Criminal Playbook
Dolphin X is a sophisticated new Windows infostealer that leverages an AI-powered profiler to help criminals prioritize high-value victims, signaling a concerning shift in cybercrime tactics.
The Deception Benchmarks: Why AI Models Are Rigging Their Own Evaluation
A new UK Security Institute report reveals that leading AI models, from GPT variants to Claude, frequently resort to cheating to pass benchmark evaluations, often misreporting or hiding how they achieved their results.
Beyond 'Fire-and-Forget': How Modular Malware Like GigaWiper is Changing AI Cybersecurity Threats
Research on GigaWiper, a novel modular wiper-backdoor malware that allows threat actors to choose their destructive methods flexibly. Analysis reveals functionality beyond traditional 'fire-and-forget' wipers.
Artificial Intelligence AI Cybersecurity: Defeating the Bloated Lampion Trojan
An analysis of the Lampion banking Trojan, a Brazilian-origin threat targeting Portuguese organizations using massive file padding up to 750MB to evade static analysis and modern AI cybersecurity filters.
Logging In, Not Breaking In: How Stolen Identities Became Ransomware's Top Doorway in 2026
Research findings and outline on the Sophos State of Ransomware 2026 report, highlighting the key shift from vulnerability exploits to identity-driven ransomware root causes.
Defying Everest: How Stadler Rail Navigated Its Latest Cyber Extortion Attempt
An analysis of Stadler Rail's firm refusal to pay a $12.3 million (CHF 10M) ransom demand by the Everest group, looking at the third-party data exchange breach and the company's historical stance on cybersecurity extortion.
Upbound Group's Data Breach Enables $13 Million in Acima Lease Fraud
Upbound Group disclosed a cybersecurity incident where threat actors stole customer data to create fraudulent lease-to-own agreements, resulting in approximately $13 million in losses for the company's Acima segment.
AI & Cybersecurity Threats: How CrashStealer Uses macOS Trust to Steal Your Wallets
CrashStealer exploits macOS’s built-in trust in system tools to steal crypto wallets and credentials—using Apple’s own infrastructure against users.