A Korean-Speaking Crew Is Building a PHP2Shell Hit List
CYFIRMA says Korean-speaking operators are quietly scanning 216 unpatched PHP hosts at governments, banks and logistics firms, with a moderate-confidence Lazarus link.
YARA
Stories with published YARA rules, reproduced exactly as their authors wrote them, ready to copy into your scanner.
3 stories match your filters.
Plex Servers Are Quietly Mining Crypto for Someone Else
Attackers are chaining four Plex Media Server bugs, now on CISA's exploited list, to drop a cryptominer and a traffic-relay proxy on servers that never got September's fix.
CriticalCVE-2026-102764 8 Hunt LeadsYARAIOCsRemote AttackerARMORY CASTLESAWFLYBARECLAWGoogle Threat Intelligence Group / Mandiant
China-Linked Spies Turned BeyondTrust Help Desks Into Skeleton Keys
Google and Mandiant say suspected Chinese espionage group ARMORY CASTLE has exploited a BeyondTrust Remote Support zero-day since late August. Once inside, it took root, dumped stored credentials and used the support tool to reach internal machines.