grep -rl "threat-intel" ./articles
Cisco Talos found an exposed directory belonging to UAT-10147 and pulled out target lists of roughly 170,000 URLs, AI tooling across the whole attack lifecycle, and a cross-platform implant called SPECTRE that unlinks EDR callbacks in the kernel using two vulnerable drivers from 2019 and 2021.
MalwareHunterTeam spotted the technique in July and SOCRadar says it is still running. A phishing ZIP drops a shortcut file, the shortcut connects to an FTP server and takes commands from the greeting banner, and either E4del or PINHOLE lands. Novel — and SOCRadar notes that being novel is also what makes it visible.
Hunt.io reconstructed Operation CameraSwarm from the operator's own exposed files: 2,616 of them across 234 folders, with tooling, logs and command history. The campaign took more than 14,530 Dahua devices in 35 days using password guessing, two authentication bypasses and a peer-to-peer relay — concentrated in Ukraine and Russia.
Reco has tracked a single IP walking Salesforce and ServiceNow customer portals across telecoms, banks, software vendors and government. No exploit was involved: the guest user on those public sites could already read more than the site needed to show. One target logged over 560,000 events from that one address.
Microsoft Defender Experts has tied 30-plus domains to MacSync, a macOS stealer delivered by getting people to paste a command into Terminal. It takes the Keychain, SSH keys, AWS credentials and Kubernetes configs. The build token changes every deployment; the API key does not, which is the whole detection.
Ransom Busters says it has spent three years breaking into ransomware operators' servers and can get your files back. GuidePoint responded to two of these incidents and found the same backdoor password, the same attacker hostname and the same toolkit in both — which points somewhere much less heroic.