Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure Beyond the Published IOCs 2026-10-08 70 True SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia 2026-09-17 85 True Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence 2026-09-15 90 True UK Council Attack Linked to SonicWall SMA 1000 Campaign 2026-09-11 80 True Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files 2026-09-09 78 True Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia 2026-09-04 88 True Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities 2026-08-27 85 True Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia 2026-08-19 78 True Inside a Russian-Speaking Operator's Ukrainian IP Camera Toolkit 2026-08-11 68 True The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2 2026-08-05 80 True Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon 2026-07-29 70 True Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged 2026-07-24 88 True Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries 2026-07-21 72 True Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries 2026-07-16 88 True Inside Eastern Europe's C2 Sprawl: 3,900+ Servers, 302 Providers, One Host Doing Half the Work 2026-06-25 82 True Chinese-speaking Operators Clone FIFA's World Cup 2026 Ticketing Site To Steal Fan Logins and Card Data 2026-06-18 70 True Ababil of Minab Exposed: LA Metro SCADA Backups and Israeli Victim Data Left Open on an Iranian Staging Server 2026-06-16 90 True PCPJack Hijacked 230 AWS, GCP, and Azure Servers to Run a Hidden SMTP Relay Network 2026-06-04 75 True Exposing a Global Smishing Operation Across 19 Countries: Governments, Postal Services, and Telecoms Targeted 2026-05-28 72 True Middle East Malicious Infrastructure Report: 1,350+ C2 Servers Mapped Across 98 Providers 2026-05-22 88 True How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account 2026-05-15 90 True CVE-2025-32975: The Open Directory Behind the KACE SMA Breach and 60+ Downstream Victims 2026-05-13 92 True Iranian-Nexus Operation Against Oman's Government: 12 Ministries Hit and 26,000 Citizen Records Exposed 2026-05-06 90 True xlabs_v1 DDoS-for-Hire Operation Exposed: How an Operator's Debug Build Unraveled a Commercial Game-Server Botnet 2026-04-30 75 True DinDoor Backdoor: Deno Runtime Abuse and 20 Active C2 Servers 2026-04-22 75 True Exposing Russian Malicious Infrastructure: 1,250+ C2 Servers Mapped Across 165 Providers 2026-04-16 75 True Canis C2 Exposed: Previously Undocumented Cross-Platform Surveillance Framework Targeting Japan 2026-04-09 80 True Breaking Down the Axios Supply Chain Attack: Dropper, Cross-Platform RATs, and BlueNoroff/TA444 2026-04-02 92 True 33K Exposed LiteLLM Deployments and the C2 Servers Behind TeamPCP's Supply Chain Attack 2026-03-28 88 True TheGentlemen Ransomware Toolkit Found on Russian Proton66 Server 2026-03-25 80 True Iranian Botnet Exposed via Open Directory: 15-Node Relay Network and Active C2 2026-03-18 70 True Exposing Lumma Stealerâs Second-Stage Infrastructure and C2 Servers with ASN and JA4X Pivoting 2026-03-12 70 True Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine 2026-03-12 90 True Iranian APT Infrastructure in Focus: Mapping State-Aligned Clusters During Geopolitical Escalation 2026-03-05 85 True The Complete Guide to Hunting Cobalt Strike - Part 4: Operationalizing C2 Feeds with API Automation 2026-03-04 75 True Fake Homebrew Pages Deliver Cuckoo Stealer via ClickFix 2026-02-18 78 True Russian-Speaking Threat Actor Abuses Cloudflare & Telegram in Phishing Campaign 2026-02-16 70 True South Korean Organizations Targeted by Cobalt Strike âCatâ Delivered by a Rust Beacon 2026-02-16 75 True 630K gov.br Subdomains Abused in SEO Poisoning Attack 2026-02-16 70 True JSPSpy and âfilebroserâ: A Custom File Management Tool in Webshell Infrastructure 2026-02-16 55 True Hunt.io Insights: Gamaredonâs Flux-Like Infrastructure and a Look at Recent ShadowPad Activity 2026-02-16 86 True Inside the 2025 Energy Phishing Wave: Chevron, Conoco, PBF, Phillips 66 2026-02-16 65 True ClickFix Facebook Session Hijacking Campaign Targets Creators at Scale 2026-02-16 75 True KeyPlug Server Exposes Fortinet Exploits & Webshell Activity Targeting a Major Japanese Company 2026-02-16 85 True Proactive ClickFix Threat Hunting with Hunt.io 2026-02-16 70 True Operation SouthNet: SideWinder Targets South Asia Maritime 2026-02-16 88 True Introducing Code Search on AttackCapture: Uncover Exploit Code, Reverse Shells, C2 Configs, and More 2026-02-16 65 True Server-Side Phishing: How Credential Theft Campaigns Are Hiding in Plain Sight 2026-02-16 65 True Suspected DPRK Phishing Campaign Targets Naver; Separate Apple Domain Spoofing Cluster Identified 2026-02-16 70 True Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight 2026-02-16 70 True 
