Cyber Threat Intelligence

Iran-linked OT alerts broaden as 83 alleged exposures span government, education and finance; Kimsuky and critical endpoint flaws raise risk.

Urharmless claims US agency breaches as Qilin exploits PAN-OS; 299 events include 78 breach/leak exposures concentrated in the US, France and Spain.

FakeGit's 7,600 repositories, SonicWall exploitation, a 7-Zip flaw, and Microsoft 365 C2 broaden attack paths.

NGINX CVE-2026-42533, 2 exploited SonicWall SMA zero-days, and ClickFix malware put edge systems at risk.

LockBit 5.0 names 6 victims across 5 countries as Qilin, Nova, KRYBIT, DragonForce, access, and token-leak claims expand risk.

Wp2shell, HollowByte's 11-byte TLS DoS, 7 malicious Vite packages, and exploited SharePoint flaws raise enterprise risk.

Exchange Markets actor claims breaches at UnitedHealthcare, HSBC Mexico, and Punjab National Bank. ACR Stealer campaigns surge. Scattered Spider hackers sentenced.

232 events tracked; NPCIL data breach, multiple Indian universities hit, and a surge in data leaks targeting India, the US, and Indonesia. SonicWall zero-days and TuxBot v3 IoT botnet add to the threa

Over 78 critical data exposures reported, targeting Mexico, India, and US entities. Microsoft issues record Patch Tuesday with 622 fixes, including two zero-days. Qilin, Akatsuki cyber team active.

KYCMyASS lists passports from 6 nations; EU sanctions Turla for grid attacks; AI-generated PowerShell and Forg365 PhaaS target Microsoft 365.

Russia blamed for Poland energy cyberattack as UK/EU impose sanctions. Telegram 182M user database alleged leak. Sophia01 targets German firms. UAE entities hit by Exchange Markets.

Exchange Markets targets UAE real estate and healthcare; SUB-ZERO leaks French education data; Qilin, Sophia01 active; Jscrambler supply chain attack.

Today's brief covers the aggressive expansion of The Gentlemen ransomware, massive alleged breaches in Brazil and US, critical ShareFile vulnerability, and a surge in citizen database sales.

Pro-Russian group targets Romanian military institutions. Microsoft details GigaWiper destructive backdoor. GodDamn ransomware uses kernel driver. Interpol arrests 5,800.

GhostLock Linux flaw enables root access; HalluSquatting targets AI coding assistants. Breaches hit Binance, NASA Earthdata, Deloitte, and more. DR4K7H CYBER TEAM active.

40 critical exposures today including Pakistan Airlines, SK Telecom, UAE govt. Mandiant reveals active ADFS signing key recovery via Machine DPAPI. Spain arrests alleged Russian hacktivist.

Multiple alleged breaches hit BreachForums, military/defense orgs, and govt entities. AI prompt injection and device code phishing threats emerge.

48 critical exposures today: Iraq banks, French govt, Zara, India CA portal, Brazil vehicle DB. Multiple actors active. Focus on credential reuse, supply chain.

Massive KYC data leaks target USA, France, Brazil, Indonesia. Mexican government entities hit by multiple breaches. Actor 0xSec targets French schools. North Korean PolinRider campaign active.

Today's brief covers alleged breaches at Tesla, Duolingo, and Malaysia's IRBM, plus the new Avalon malware framework and critical Linux kernel flaw.

Ransomware groups exploit Citrix Bleed 2; Google disrupts NetNut proxy network. Multiple government and education data breaches alleged across Sri Lanka, Indonesia, Mexico, and more.

26 critical exposures today target Indonesia, India, France. Scattered Spider suspect extradited. Critical Argo CD, Oracle EBS, and Kemp LoadMaster flaws under active exploitation.

33 critical data events reported globally, targeting UAE, Mexico, France, and US. Burger King, UAE Ministry, and German telecom among victims.

Over 80 critical data events reported today, including breaches at Amtrak, GameStop, and Okta. Pro-Russia influence ecosystem analysis reveals evolving tactics.

MagoSpeak claims breaches at five Mexican universities. Indonesian government agencies hit by DigitalStormSec. Bolivian military and health data allegedly exposed. US e-commerce and insurance sectors

X Forum Bot claims 14+ database leaks targeting Russia, Ukraine, and others. Thai government entities hit by NXBB.SEC. Russian espionage campaign uncovered.

Critical alleged DoD leak, Signal recovery key phishing by Russian intel, new Linux pedit COW and DirtyClone exploits, and widespread data breaches across sectors.

Turla deploys STOCKSTAY .NET backdoor against Ukraine and Europe. 32 critical exposures include SK Telecom, Bouygues Telecom, and multiple government databases. Hospitality sector targeted by Node.js

Cisco SD-WAN zero-day exploited for root access at a service provider. Law enforcement disrupts Amadey and StealC malware infrastructure. Over 50 data exposure events reported, targeting healthcare, f

FortiBleed targets 430K FortiGate firewalls; AI agent skill bypasses scanners; DPRK macOS backdoor; data leaks hit finance, gov, healthcare globally.