5+ day, 5+ hour ago   (596+ words) A newly documented ransomware intrusion attributed to The Gentlemen shows how attackers can convert a foothold in a Windows environment into domain-wide control by elevating accounts, turning off endpoint defenses, and abusing trusted Active Directory infrastructure to distribute ransomware. The…...

5+ day, 1+ hour ago   (634+ words) A human-operated intrusion campaign in which attackers abuse Microsoft Teams external collaboration to impersonate internal IT or helpdesk staff, persuade employees to grant remote control of their PCs, and then move toward critical enterprise infrastructure. The result is a hands-on-keyboard…...

1+ week, 5+ day ago   (578+ words) A coordinated social-engineering campaign dubbed Spring Ring used external Microsoft Teams accounts to impersonate corporate IT help desk staff and target more than 150 employees across at least 10 organizations between January and April 2026. The operation demonstrates how attackers are shifting phishing…...

1+ week, 6+ day ago   (684+ words) Aurora ransomware operators have been observed using Cursor Agent, powered by Claude Sonnet, to support hands-on intrusion activity across ten victim organizations, while deploying a purpose-built Linux encryptor designed to disrupt VMware ESXi environments. The findings show how ransomware affiliates…...

1+ week, 6+ day ago   (472+ words) Anthropic’s Claude AI platform is currently dealing with two separate cybercrime campaigns that aim to steal account credentials, misuse paid subscriptions, and reinstall malware even after a victim believes their device has been cleaned. In response to this threat, Anthropic…...

1+ week, 6+ day ago   (575+ words) Rather than directly exposing a modified executable, the account hosted a legitimate AutoIt interpreter alongside separately retrievable malicious script logic an approach that lets operators rotate their payload code without repacking the executable component. Researchers pivoted from GitHub’s raw commit…...

2+ week, 3+ day ago   (631+ words) A Russian-speaking affiliate of the Aurora ransomware operation compromised more than 20 organizations across nine countries between April and July 2026, using the AI coding assistant Cursor to plan intrusion activity and Active Directory escalation. The exposed server offered an unusually complete…...

2+ week, 4+ day ago   (576+ words) The Core Werewolf espionage cluster has introduced a previously undocumented remote access trojan dubbed CoreRAT in targeted attacks on Russian public-sector bodies and defense-industry organizations. The shift is notable because Core Werewolf, previously associated with the abuse of legitimate UltraVNC…...

3+ week, 2+ day ago   (394+ words) A Chinese-speaking cybercrime group, tracked as UAT-10147, targeting vulnerable Windows and Linux web servers worldwide to deploy BadIIS malware, steal data, and manipulate search engine results for financial gain. An operational security lapse exposed an attacker download server at 139.180.197[.]150, where…...

3+ week, 3+ day ago   (414+ words) MacSync Stealer is expanding its macOS-focused theft operation through a rotating network of more than 30 domains, using stable execution and network patterns to steal credentials, browser data, cloud access keys, SSH material, and sensitive user files. Initial execution commonly begins…...