Stories with indicators of compromise: attacker IPs, domains, URLs and file hashes to hunt for and block.
40 stories match your filters.
WatchGuard details three Brazil-linked campaigns, Overlord RAT, Lampion and a newdev.dll RAT, that start with VBScript and lean on built-in Windows tools and signed programs to stay hidden.
Amazon says a PHP2Shell exploit hit its MadPot honeypots on Oct. 17, four days before PHP disclosed CVE-2026-109618 and CVE-2026-109619. It now calls exploitation broad.
Microsoft ties the ConnectWise Cloud Backup supply-chain attack to China-aligned Storm-0940, which used ARTEX AI agents to try sign-ins to more than 2,250 Microsoft 365 tenants at up to 2,900 a minute.
A joint FBI, CISA and USSS advisory says SafePay ransomware has hit at least 600 victims since August 2024, getting in through stolen or guessed VPN logins and old Cisco ASA, SonicWall and Veeam flaws, then wiping backups before it encrypts.
Kaspersky says Lazarus abused South Korea's mandatory INISAFE CrossWeb EX security plug-in to break into at least three firms, using fake résumé sites, GitHub-based C2 and a post-quantum key exchange.
Hunt.io found the PaperCut mass-exploitation crew's AI agent prompts, exploit variants, credential stealers and victim access kits on an open server, plus a second RCE route through the XML-RPC API.
Stormshield says hacked WordPress sites read C2 addresses from a Polygon smart contract, then show Windows visitors a fake Cloudflare check that leads to a stealer loaded through the Deno runtime.
ESET says UAC-0099 phished into a Ukrainian grain logistics company and handed access to Sandworm, which wiped data, while a new Go backdoor hid its C&C inside the Yggdrasil mesh network.
Unit 42 says the Qilin and INC ransomware groups are using CVE-2026-0257, a GlobalProtect authentication bypass patched in May, to open VPN sessions without MFA and then move on to vCenter, ESXi and Veeam.
Attackers are chaining four Plex Media Server bugs, now on CISA's exploited list, to drop a cryptominer and a traffic-relay proxy on servers that never got September's fix.
Rapid7 details intrusions where attackers chained CVE-2026-88771 and CVE-2026-88779 to get root on NetScaler ADC and Gateway, then planted HA-aware persistence and stole the appliance's credentials and keys.
An attacker used a hijacked developer account to swap the binaries on five OVHcloud CLI releases for a build that steals cloud keys, SSH keys and AI-tool data. OVHcloud ties it to GlassWorm and says about 250 downloads happened in the 94-minute window.
Symantec says Russia's APT28 breached a naval shipbuilder, a law enforcement agency and an aircraft-engine maker in two NATO countries, using the HOOKEDGE backdoor and a previously unseen reflective loader.
Google and Mandiant say suspected Chinese espionage group ARMORY CASTLE has exploited a BeyondTrust Remote Support zero-day since late August. Once inside, it took root, dumped stored credentials and used the support tool to reach internal machines.
Unit 42 says a cluster it calls CL-UNK-1211 spent six months in government Linux servers using AI-generated scripts, a new Go RAT and fake red-team markers, going after databases, mailboxes and linked social media accounts.