grep -rl "threat-intelligence" ./articles
Anthropic's September threat report attributes nearly 200 million exchanges to five distillation campaigns. Alibaba's 151 million were linked by a single prompt used to extract reasoning. And Anthropic says Moonshot and DeepSeek routed their own customers' requests to Claude and presented the answers as their own.
UNC6671 runs four extortion brands off one set of domains. The pretext is a security upgrade — FIDO2 enrolment, MFA migration — and the payoff is an adversary-in-the-middle portal. Average settled payment: $750,000.
GTIG's threat tracker names five PRC-nexus groups, six malware families and a 2FA bypass in an open-source admin tool. The interesting part is why an LLM found it: fuzzers look for crashes, and this was a hardcoded trust assumption.
Infoblox tracked Sable Squirrel across 10,000-plus domains, including former General Electric, Procter & Gamble and Sony developer addresses. 31,000 malware samples talked to the infrastructure. Roughly 65,000 expired domains are re-registered every day.
Two law firms, an equine hospital, a mental health charity and three metal companies, published in batches with a two-day gap between attack and leak. It shares a name with Microsoft's Storm-1175, which is a different actor entirely.
Microsoft's analysis describes two Polygon wallet addresses holding proxy URLs and leak-blog posts, with negotiation over Session. There is no hosting provider to serve, because there is no hosting.
Two poisoned releases in March, published with a token stolen in the Trivy breach and kept alive by an incomplete rotation. CloudSEK's dataset of 434,000 captured files now maps possible exposure across 2,500+ organisations.
Genians found the stack on infrastructure linked to the North Korean espionage unit. Running models offline means stolen documents never touch a provider, and no usage policy applies. That is the point.
Microsoft attributes StormEncryptor, a new C++ locker, to the China-linked group. Initial access was likely CVE-2026-18577 in N-able N-central, which is itself a bypass of the earlier fix. CISA has both flagged as exploited.
51 victims since April 2025, mostly outside North America, exploiting a 2024 Schneider Electric flaw and a 2025 Fortinet one. The advisory is worth reading for what it says about which patches actually matter.
Ballena Azul did not exist. The recruitment did. Three developers came through a referral chain, signed contracts, got VM access — and within minutes ran dxdiag and checked which country their connection appeared to come from.
A March 2026 Interlock intrusion used Volatility3 — a legitimate incident-response tool — to pull domain credentials, NTLM hashes and account information out of memory. The rest of the chain was a ClickFix lure and PowerShell.
Sonatype tracked a campaign flooding npm with 846 packages carrying a multi-stage JavaScript loader. It fingerprints the operating system, fetches a matching payload, and on Windows patches security functions before establishing persistence through a scheduled task.
Silent Push counts roughly three million dangling DNS records worldwide. In one exercise across 12,500 apex domains they isolated 16,000 dangling subdomains and automated the takeover of 4,000 of them. The worst outcome isn't defacement — it's session cookies.
Sophos tracked STAC4749 across dozens of North American organisations between February and June 2026. Attackers used external Teams accounts and IT-themed personas to talk their way into remote access, then deployed a modular backdoor and, in at least three cases, Chaos ransomware.
Attackers changed passwords and IP addresses on controllers that were already reachable from the internet, locking operators out and triggering boil-water notices. Forescout then found 4,407 exposed Rockwell PLCs worldwide — most of them on mobile carrier networks.
CVE-2026-8037 is a CVSS 9.6 command injection in Progress Kemp LoadMaster, traced to its escape_quotes() routine. 792 exploitation attempts over 41 days from 65 IPs across 18 countries — and the federal remediation deadline is today.
Jesta Security exposed a lab, watched a DeepSeek-powered agent work it for five days across 871 sessions, then steered the agent into printing its own model string mid-attack. Its target list held 1,283 hosts with working credentials.
CVE-2026-18577 exists because the fix for CVE-2026-18556 didn't finish the job. Both are being exploited, and N-central sits at the top of MSP estates — admin on the server means Take Control access to every endpoint underneath it.
Volexity says a threat actor it tracks as UTA0533 is harvesting credentials from compromised SonicWall appliances, and researchers note INC Ransomware has picked up its pace since the start of August.
Explore the latest cybersecurity threats in 2026 including AI-powered attacks, advanced ransomware, phishing 2.0, and identity-based breaches. Stay ahead with deep research insights.
OWASP has ranked it the top LLM vulnerability three years running. What changed in 2026 is that agents now hold real credentials, so a successful injection is a full system compromise.
Attack volume jumped nearly 20% month over month. Qilin alone accounted for 372 incidents across Europe, hitting 26 of 31 countries analyzed.