Published Date All 2025-03-10 2025-03-09 2025-03-08 2025-03-07 2025-03-06 2025-03-05 2025-03-04 2025-03-03 2025-03-02 2025-03-01 2025-02-28 2025-02-27 2025-02-26 2025-02-25 2025-02-24 2025-02-23 2025-02-22 2025-02-21 2025-02-20 2025-02-19 2025-02-18 2025-02-17 2025-02-16 2025-02-15
Tags All .NET Malware .urlfile Exploit $1.46 Billion Theft 24-Hour Reporting 24/7 Monitoring 2FA 5G Security Accessibility Account Takeover Acoustic data transfer Active Directory Active Directory Compromise Active Exploitation Ad Fraud Ad Tracking Advanced Persistent Threats Adversarial AI Adversary Emulation Adware AES Encryption Affiliate Program Agenda Ransomware Agent Tesla AI AI Abuse AI Asset Inventory AI Backdoors AI Guardrails AI Hallucinations AI in Cybersecurity AI in Security AI Model Release AI Privacy Risks AI Regulation AI Risk AI Risk Management AI Safety AI Safety Bypass AI Security AI Threats AI Voice Cloning AI Vulnerability AI-driven Attacks AI-enabled Disinformation AI-Generated Audio AI-generated CSAM AI-generated Phishing AI-powered Attacks AI-powered security AI-powered Security AI-Powered Security AI-powered security testing AI-powered Social Engineering Alien Txtbase AMD CPU Vulnerability AML/CFT Deficiencies Amnesty International AMS Exposure Android Android Beta Android ID Android Malware Android Patches Android Security Android Security Update Android Tracking Android TV Botnet Android TV Malware Android Vulnerability Android Zero-Day Angry Likho Anomaly Detection Anthropic Anti-Analysis Anti-Debug Techniques Anti-phishing Anti-Phishing Anti-Scam Anubis Threat Group ANY.RUN AOT Files Apache Pinot API Abuse API Key Compromise API Key Exposure API Key Theft API Security API Vulnerability App Store Malware Apple Apple Security AppSec APT APT Attack APT Attacks APT Attribution APT-C-36 APT-C-40 APT40 APT41 Arbitrary Code Execution Arbitrary File Read Artificial Intelligence (AI) in Cybersecurity Aryon Security ASAR Integrity Asia ASLR Bypass ASN.1 ASPM AsyncRAT AT&T Hack Atlassian Vulnerabilities ATM Jackpotting Attack Surface Management Attack Surface Reduction Attacker Tactics Attribution Audio watermarking AUKUS Australia Authentication Attacks Authentication Bypass Authentication Failure Authentication Filter Authentication Key Rotation Authentication Required Auto-Color Auto-Color Malware Autodesk Navisworks Freedom AutoIt Automated Attacks Automated Phishing Automated Security Automated Security Testing Automated vulnerability testing Automation Automation Trust Auxiliary Module Avast Data Breach AWS AWS Compromise AWS Security Azure Abuse Azure OpenAI Azure OpenAI Abuse Azure OpenAI Breach Azure RBAC B2B Spam BackConnect Backdoor Backdoor Access Backdoor Detection Backdoors Background Check Backup and Recovery Backup Software Vulnerability Bank Theft Banking Banking Trojan Banking Trojans Barracuda ESG Vulnerability Basic Authentication BEC Behavior Signatures Behavioral AI Behinder Belarus-linked Threat Actor Belgian Intelligence Breach BeyondTrust BigAnt Server Binance Spoofing BitConnect Black Basta Black Basta Ransomware BlackLock Blackmail Blind Eagle Blink Mini 2 Blockchain Forensic Investigation Blockchain Forensics Blockchain Security Bluetooth Bot API Botnet Botnets Bounty Program Brand Impersonation Broadcom Security Update BroadWorks Browser Extension Attack Browser Isolation Browser Security Browser Tracking Browser-Based Attacks Brute Force Brute-force Buffer Overflow Bug Bounty Bug Fix Bulletproof Hosting Burp Suite Business Email Compromise Business Email Compromise (BEC) BYOD Security BYOVD C Programming Language C/C++ C++ Memory Safety C++ Security C2 C2 Concealment C2 Infrastructure CAASM Cache Attacks Cactus Ransomware CAEP Callback Phishing CAN-2001-0144 CAPTCHA Cellebrite Cellebrite Exploit Censorship-as-a-Service CFPB ChatGPT ChatGPT Operator Child Data Privacy Child Sexual Abuse Material China China-based Cybercrime China-linked China-Linked China-Nexus Activity Chinese State-Sponsored Hacking Chipset Vulnerabilities Chirp tool Christopher Hadnagy Chrome Chrome Extension Compromise Chrome Extensions Chromecast Chromium-based Browsers CISA CISA Advisory CISA Alert CISA Directive CISA KEV List CISA Restructuring Cisco Cisco Nexus Switches Cisco Vulnerabilities Cisco Vulnerability CISO Liability CISO Role Evolution Citrix Vulnerability Click Fraud ClickFix Client-Side Attacks Client-Side Security Clipboard Hijacking Cloud C2 Cloud Exploitation Cloud Misconfiguration Cloud Misconfigurations Cloud security Cloud Security Cloud Security Enforcement Platform Cloud Storage Cloud-Native Security Cobalt Strike Code Execution Code Obfuscation Code Promotion Code Virtualization Cold Wallet Compromise Command and Control (C2) Command Injection Commix Common Webshells Compliance Compliance and Regulations Compliance Overconfidence Compromised Developer Machine Compromised System Compromised Systems Computer-Using Agents Confirmation Bias Confluence ConnectWise RAT Consent-less Tracking Consumer Protection Container Security Copilot Security Copyright Strike Abuse CPU Emulation Crazy Evil CRC32 Credential Capture Credential Compromise Credential Dumping Credential Harvesting Credential Hygiene Credential Stuffing Credential Theft Credentials Exposure Critical Infrastructure Critical Minerals Critical Vulnerability Cross-domain attacks Cross-Domain Attacks Crowd CrowdStrike CrowdStrike Falcon Cryptocurrency Cryptocurrency Exchange Hack Cryptocurrency Fraud Cryptocurrency Heist Cryptocurrency Malware Cryptocurrency Miner Cryptocurrency Mining Cryptocurrency Money Laundering Cryptocurrency Scam Cryptocurrency Scams Cryptocurrency Seizure Cryptocurrency theft Cryptocurrency Theft Cryptojacking CSP Bypass CTEM CUPS Vulnerability Custom Roles CVE CVE Exploitation CVE Exploits CVE prioritization CVE Prioritization CVE-2017-11882 CVE-2020-24901 CVE-2023-20118 CVE-2023-34192 CVE-2024 CVE-2024-10811 CVE-2024-12029 CVE-2024-12356 CVE-2024-13161 CVE-2024-43093 CVE-2024-43451 CVE-2024-48248 CVE-2024-49035 CVE-2024-50302 CVE-2024-53704 CVE-2024-53900 CVE-2024-9474 CVE-2025-0108 CVE-2025-0111 CVE-2025-0994 CVE-2025-1094 CVE-2025-1316 CVE-2025-1492 CVE-2025-20111 CVE-2025-23061 CVE-2025-23363 CVE-2025-24989 CVE-2025-26465 CVE-2025-26466 CVE-2025-27364 CVE-2025-27840 CVSS Scoring Cyber Espionage Cyber Insurance Cyber Resilience Cyber Warfare Cyberattack Cyberattacks Cybercrime Cybercrime Infrastructure Cybersecurity Cybersecurity Awareness Cybersecurity Awareness Training Cybersecurity Best Practices Cybersecurity Compliance Cybersecurity Frameworks Cybersecurity Fundamentals Cybersecurity Incident Cybersecurity Legislation Cybersecurity Negligence Cybersecurity Outsourcing Cybersecurity Policy Cybersecurity Program Cybersecurity Risk Cybersecurity Team Building Cybersecurity Training Cybersecurity Warning Darcula Dark Caracal Dark Web Dark Web Monitoring Data Aggregation Data Backup data breach Data Breach Data Breach Prevention Data Breaches Data Broker Regulation Data Broker Removal Data Brokerage Data Classification Data Collection Data Deletion Data Disposal Data Encryption Data exfiltration Data Exfiltration Data Extortion Data Leak Data Leakage Data Loss Prevention Data Malformation Data Minimization Data Poisoning Data Privacy Data Privacy Violation Data Protection Data Recovery Data Removal Data Retention Data Security Data Stealer Data Stealing Malware Data Theft Database Vulnerability DCRat DDoS DDoS Attacks DDoS Protection Deceptive Marketing Deep Packet Inspection (DPI) Deepfake Deepfake Creation Deepfake Generation Deepfakes DeepSeek DeepSeek AI DeepSeek Chatbot DEF CON Defamation DeFi Attack DeFi Exploit DeFi Hack Delta Electronics Denial of Service (DoS) Denial-of-Service Deobfuscation Deserialization Deserialization Vulnerability Device Code Device Code Phishing Device Linking DGA Dictionary Attack Digital Footprint Reduction Digital Transformation DLL Hijacking DLL Search Order Hijacking DLL Side-Loading DLL Sideloading DLP DMARC DNS Injection DNS Misconfiguration Dockutil DOGE Resignations DOGE Security Breach DOJ Indictment Domain Generation Algorithm Domain Hijacking Domain Spoofing DoS Double Extortion Driver Exploitation Dropbox DSID Cookie Dwell Time Reduction DWFX File Parsing Dynamic Analysis E-ZPass Scam E2EE EASM Edimax IP Camera EDR EDR Bypass EDR/AV Evasion Elderly Targeting Election Interference Electron Attacks Email Authentication Email Compromise Email Security Emergent Misalignment Employment Screening Encryption Encryption Backdoors End-of-Life End-of-Life Software End-to-End Encryption Endpoint Detection and Response Endpoint Detection and Response (EDR) Endpoint Protection Endpoint Security Enterprise Browser Ephemeral Ports ePHI ESP32 Espionage ESXi ESXi Vulnerability ETH Theft Ethereum Heist Evasion Techniques Evasive Malware Evasive Techniques Exclaves Exfiltration Expired Certificate Exploit Exploit Analysis Exploit Chaining Exploit Development Exploitation Tool Exploited Vulnerabilities Extortion Face Swap Attacks Facebook Ads Fake CAPTCHA Fake Job Interviews Fake Job Offers Fake VPN Fake Website FBI FBI Warning Federal Agencies Federal Contractors Federal Cybersecurity File Conversion File Upload FinalDraft Financial Crime Financial Data Financial Data Compromise Financial Fraud Financial Impact Financial Loss Financial Sector Finastra Fine-tuning Attacks Fintech Malware Firefox Firewall Vulnerability FOG Ransomware Foreign Intelligence Forensic Analysis Forensic Artifacts Forensic Investigations Formjacking Forrester Wave FortiWeb France Legislation Fraud Detection FTC Action FTC Settlement Funding Game Exploit Game Repacks Garantex Seizure GDPR Gen-AI Gen-AI Attacks GenAI Misuse GenAI Security Generative AI Generative AI Abuse Generative AI Hacking Generative AI in Cyberattacks Generative AI Security Generative AI Threats Geopolitical Targeting Gh0st RAT Ghost Ransomware Ghost Tap Ghostwriter APT GitHub GitHub Compromise GitHub Malware GitHub Malware Hosting GitVenom Campaign Giveaway scams Gmail GNMI Gnosis Safe Exploit Go Golang Backdoor Golang Security Google Google Forms Google Gmail Security Google OAuth Google Patch Google Play Google Privacy Google Redirect Google Search Google Security Google Server Issue Google Vulnerability Google Workspace Security GOP Government Government Cybersecurity Government Policy Government Regulation Government Restrictions Government Surveillance GPT-4.5 Graph API Graphite Spyware GRC Great Firewall GreyNoise Report Hacking-as-a-Service hacktivism Hacktivism Hacktivism Attribution Halcyon RDR Hard Drive Hard Drive Sanitization Hardware Security Have I Been Pwned Havoc C2 Healthcare Healthcare Data Healthcare Data Breach Heap Buffer Overflow Heap Overflow Help Desk Social Engineering High-Severity Vulnerabilities High-Severity Vulnerability Higher Education HIPAA Hive Ransomware Home Router Vulnerabilities Hooking HP LaserJet HP Printer HTTP on Non-Standard Ports HTTPS Exploit Human Trafficking Human-in-the-Loop Hunters International Hybrid Cloud Hybrid IT Security Hypervisor IAM Misconfiguration iCloud Encryption ICO ICO Investigation Iconics ICS Identity Management Identity Protection Identity Security Identity Spoofing Identity theft Identity Theft IDFA/AAID IFV Illegal Workarounds Imgur Impacket Impersonation Impersonation Scams Import Hash Improper Access Control Improper Input Validation Improper IP Management Incident Response India Indicator of Compromise (IOC) Indicators of Behavior (IOB) Indicators of Compromise (IOC) Indicators of Compromise (IOCs) Industrial Control Systems Industrial Espionage Info Leak Info Stealer Info-Stealer Info-Stealer Malware Info-Stealing Information Disclosure Information Stealer Information Stealing Infostealer Malware Infostealers Infostealing Malware Initial Access Initial Access Brokers Injection Attacks Input Validation Insider Threat Insider Threats Insight Partners Instant Payouts Insufficient Neutralization Integer Overflow Integer Underflow Internal Conflict Internal Data Security International Cybercrime International Law Enforcement Collaboration Interpol Investigation InvisibleFerret IOCs IoT IoT Botnet IoT Malware IoT security IoT Security IoT Vulnerability IP Volatility Iran ISP Attack ISPSoft Ivanti Endpoint Manager Japan Java JavaGhost Juniper Kaspersky Lab Kaspersky Secure Mail Gateway KDC Proxy Kerberos Kerberos Relaying Kernel Driver Exploit Kernel Exploit Kernel Vulnerabilities KEV Keylogger Kill Switch Kimsuky Known Exploited Vulnerabilities Known Exploited Vulnerabilities Catalog Krpano Vulnerability ksmbd Kubernetes Security Large Language Model Large Language Model (LLM) Large Language Model Vulnerabilities Large-Scale Crypto Theft LastPass Breach LastPass Vulnerability Lateral movement Lateral Movement Latin America Launchpad Law Enforcement Law Enforcement Action Law Enforcement Collaboration Law Enforcement Misuse Law Enforcement Overreach Law Enforcement Recovery Law Enforcement Seizure Lawsuit Lazarus Group LDAP Pass-Back Least Privilege Lee Enterprises Legacy Driver Exploitation Legal Action Legal Case Legal Issues Legal Ramifications Legislation Let's Encrypt LightSpy Linux Backdoor Linux Kernel Linux Kernel Vulnerability Linux Malware Linux Security Linux Vulnerabilities Living off the Land Living-off-the-Land Living-off-the-Land Attacks LLM Backdoors LLM Jailbreaking LLM Security LLMjacking Local Attack Location Tracking Log Server Breach LOLBAS Loongson LOTL Low-bandwidth communication LuckyStrike Agent Lumma Stealer LVPROJECT File Parsing Lynx Ransomware M2M Security Machine Identity Management Machine Learning in Cybersecurity macOS Malware MacOS Malware Macro Malware Magecart Malicious Attachments Malicious Code Malicious JavaScript Malvertising Malware Malware Analysis Malware Campaign Malware Delivery Malware Detection Malware Distribution Malware Hosting Malware Infection Malware Loader Malware Obfuscation Malware Sandbox Malware Takedown Malware-as-a-Service Malware-Free Attacks Man-in-the-Middle Mandatory Reporting Manual testing enhancement Maritime Sector Maritime Targets MDR Media Industry Mediatek Medusa Ransomware MedusaLocker Meme Coin Memory Corruption Memory Forensics Memory Leak Memory Safety Memory-Safe Languages Metasploit MFA MFA Bypass Microarchitectural Side-Channel Attacks Microburst Attacks Microkernel Microsoft Microsoft 365 Microsoft Account Compromise Microsoft Dev Tunnels Microsoft Entra Connect Microsoft Entra ID Microsoft Exchange Server Microsoft Graph API Microsoft Intune Microsoft Outlook Microsoft Partner Center Microsoft Power Pages Microsoft Pricing Microsoft Security Microsoft Teams Microsoft Threat Intelligence Microsoft Vulnerabilities Microsoft Windows Middle East Midmarket Cybersecurity Mining Industry Mirai Botnet Misconfiguration Misconfigurations Misconfigured Access Management Systems Mitigation MitM MITRE ATT&CK MITRE Caldera Mitsubishi Electric Mobile App Privacy Mobile Banking Trojans Mobile Forensics Mobile Malware Mobile Security Mobile Spyware Mobile Surveillance Mobile Wallet Fraud Model Alignment Model Serialization Attacks Modeling Attacks ModelScan Money Laundering MongoDB Vulnerability Mongoose Library MOVITOOLS MotionStudio Multi-Factor Authentication Multi-Factor Authentication (MFA) Multi-IDP Multicast Poisoning Multisig Compromise Multisig Vulnerability Multisig Wallet Multisig Wallet Compromise Multistage Attack NAKIVO Nation-State Attack Nation-State Attacks Nation-State Hacking National Security National Telecommunications and Information Administration (NTIA) Neglect of Security Negligence Negotiation tactic Netherlands NetSupport RAT Network Attacks Network Device Compromise Network Disconnection Network Pentesting Network Pivoting Network Security Network Segmentation Network traffic Network Traffic Analysis Neverwinter Nights Newspaper Industry NFC Relay NFC Scams NHS Cybersecurity NI DAQExpress NIS Directive NIS2 Directive NIST NIST Standards Njrat Node.js Exploitation Non-Technical Cybersecurity Careers Noninteractive Sign-in NordLayer North America North Korea NotActions Notaries NSA NSA TTPs NSO Group NTLM Relaying NTLMv2 Hash Nuclear Sector Nuclear Targets O365 Attacks OAuth Vulnerabilities Obfuscation Off-Platform Transactions On-Device Processing Online Marketplace Scams Online Privacy Online Safety Open Banking Open Redirect Open Source Open Source AI Open Source Security Open-Source Exploitation Open-source intelligence OpenAI OpenAI Operator OpenConfig OpenSSH Operation Cumberland Operational Technology (OT) Security OS Command Injection OSINT OT/ICS Security Out-of-bounds read Outlook API P2P Palo Alto Networks Palo Alto Networks Vulnerability Pangea Paragon Driver Paragon Partition Manager Paragon Solutions Parking Scam Passkey Security Passkeys Password Cracking Password Guessing Password Management Password Manager Security Password Security Password Spraying Patch Patch Management Patch Tuesday Patching Path Traversal PathLoader Payload-based exploits Payment Card Data Theft Payment Redirection Payment Security Payout Account Compromise PayPal PCI DSS PCI DSS 4.0 PDF PDF Malware Pegasus Spyware Penetration Testing Permission Management Persistence Persistence Mechanism Persistence Mechanisms Personal Data Personal Data Exposure Personal Information Personal Liability Personnel Changes Personnel Cuts Personnel Security PhaaS Phishing Phishing Kits Phishing-as-a-Service Phishing-as-a-Service (PHaaS) Physical Destruction Physical Security Physical Security Risk PicassoLoader Pickle Vulnerability PII PII Exfiltration PII Theft Pixel Recorder PLM Software PlugX PoC Exploit Poco RAT PolarEdge Policy-as-Code Political Influence POLSA Polymorphic Malware Ponzi Scheme Poor Encryption Port 1098 Scans Post-Exploitation Post-Quantum Cryptography PostgreSQL PostgreSQL Vulnerability PostHog PostHog Vulnerability PostScript PostScript Vulnerability PowerShell PowerShell Execution Predatory Lending Preinstalled Malware Preventive Security Printer Vulnerability Prisma SASE Privacy Privacy Concerns Privacy Lawsuit Privacy Violation Private 5G Private Key Compromise Privilege escalation Privilege Escalation Privilege Management Pro Subscription Process Hollowing Programming Bugs Prompt Injection Proof-of-Concept Prospero OOO Proxy Server Abuse Public Sector Cybersecurity Pwn2Own Python Python Malware PyTorch Qbot (QakBot) Qilin Qilin Ransomware QR Code Attacks QR Code Authentication QR Code Phishing QR Code Verification Qualcomm Quantum Computing Quishing RaaS Rainbow Table Attack ransomware Ransomware Ransomware Attack Ransomware Payment Ban Ransomware Protection Ransomware Tactics Ransomware-as-a-Service RAT RAT Abuse RCE RCE Vulnerability RDP Security Real-time Protection Real-time Session Revocation Real-time Threat Detection Reconnaissance Reddit Redirection Refund Distribution Registry Registry Manipulation Remcos RAT Remediation Remote Access Security Remote Access Trojan Remote Access Trojan (RAT) Remote Access Trojans Remote Code Execution Resource Exhaustion Responsible Disclosure Reverse Engineering Reverse Proxy RevivalStone Rhysida Right to be Forgotten Risk Prioritization Risk Scoring Risk-Based Security Role Escalation Romance Scams Root Access Root Privilege Rosetta 2 RSA Encryption Rsync Vulnerability Runtime Detection Russia Russia-aligned Threat Actors Russia-Belarus Russian Cybercrime Russian Developer Russian Malware Russian Threat Actors Rust Rust Adoption SaaS Security Sabotage Safe File Conversion Practices Safe{Wallet} Sagerunex Salt Typhoon Salt Typhoon Campaign Sanctions Violations Sandbox Sandbox Escape Sandworm SCADA Vulnerability Scalping Scam Call Centers Scam detection Scam Detection Scanning Scareware Search Result Removal SEC Disclosure Rules SEC Filing SEC Lawsuit Secretsdump Secure Coding Practices Secure Data Deletion Secure Kernel Secure Web Gateway Security Security Advisory Security Agility Security Analysis Security Awareness Training Security Camera Security Culture Security Hardening Security Posture Management Security Rule Updates Security Updates Seed Funding Seed Phrase Theft Self-Extracting Archive Seller Protection SEO Poisoning Serbian Authorities Series A Funding Series B Funding Server Security Server-Side Attack Session Cookie Theft Session Hijacking Session Management Session Setup Flaw Session Smart Routers SEW-EURODRIVE Shadow IT Shadow Repeater ShadowPad Shared Responsibility SharePoint Shellcode Obfuscation Shor's Algorithm Shortened URLs Side-Channel Attacks Sideloading Sidewinder SideWinder Siemens Teamcenter Signal Signal Messenger Signed Binary Proxy Execution SIM Swapping Simone Margaritelli SIP SketchUp Skills Shortage SKP File Parsing Smart Contract Exploit Smart Contract Manipulation Smart Contract Vulnerability Smart Home Devices SMB Relaying SMB/FTP Pass-Back Smishing SMS Phishing SMS Security Snowflake Security Snowflake Vulnerability Social Engineering Social Media Privacy Social Media Scams Social Media Targeting Software Defects Software Dependency Vulnerability Software Developers Software Development Software Security Software Supply Chain Software Supply Chain Security Software Update Software Vulnerabilities Software Vulnerability SolarWinds SolarWinds Hack SonicWall South Korea Space Agency Spam Spam Campaign Spamhaus Spear Phishing Spear-phishing Spearphishing Spearwing Spoofing SpyLend Spyware SQL Injection Squidoor SSD Secure Erase SSH SSO Vulnerability Stack Overflow Staff Reductions Startups State-Sponsored Attack State-Sponsored Attacks State-Sponsored Censorship State-Sponsored Hacktivism State-sponsored Surveillance Static Analysis Stealer Malware Steam account theft Steganography Sticky Werewolf Storm-0408 Storm-2372 Stream Cipher Streamjacking Stylometry Suidexec Supply Chain Supply Chain Attack Supply Chain Attacks Supply Chain Compromise Supply Chain Security Suricata Suricata Rules Surveillance Surveillance Capitalism Sweden Switzerland Symbolic Link Bypass System Call Tactics, Techniques, and Procedures (TTPs) Taiwan Talent Agency Talent Retention Targeted Attacks Tata Technologies Tax Authorities Tax Scam Tech Support Scam Telecom Telecom Compromise Telecom Hacking Telecommunications Telegram C&C Telegram C2 Telegram Leaks Telegram Malware Telegram Malware Distribution Tencent Cloud Termite Ransomware TestWebsiteUrl Text-to-Speech TgToxic ThinkPHP Third-Party Forensic Investigation Third-Party Patches Third-Party Risk Third-Party Risk Management Threat Actor Threat Actors Threat Detection Threat Emulation Threat hunting Threat Hunting Threat intelligence Threat Intelligence Threat Intelligence Reports Threat Intelligence Update Threat Modeling Threat Reduction Threat Visibility TikTok TOAD Toll Payment Scam Tool Update Topic Modeling TopSec Tor Tornado Cash Torrent Malware Torrenting Traffic Pumping Trimble Cityworks Trojan Stealer Truesight.sys Trump Administration TTD Emulation Bugs UAE UI Manipulation UI Vulnerability UK UK Attack UK Data Protection UK Healthcare Security UK Investigatory Powers Act UK-US Relations Ukraine Un-authenticated UnAuthenticated Unauthenticated Access Unauthenticated Exploit Unauthorized Access Unauthorized AI Usage Undocumented Commands Unidentified Aerial Systems (UAS) Unified Security Unpatched Systems Unsecured Device URI Manipulation URI Validation US AI Policy US Cyber Command US Law Enforcement US Tariffs US Treasury US Treasury Breach USB Attack Surface USB Drive Attacks USB Driver Exploitation USB Exploits USB Propagation Use-After-Free User Data Sale User Experience UUID Encoding ValleyRAT Venezuela Venture Capital Vidar Infostealer Virtual Camera Software Virtual Labs Vishing VMware VMware Zero-Day Vo1d Botnet Vo1d Malware Voice Cloning Voice Phishing VoIP Attacks Volt Typhoon VPN VPN Restrictions VSCode Extension Compromise Vulnerabilities Vulnerabilities & Threats Vulnerability Vulnerability Analysis Vulnerability Disclosure Vulnerability Exploitation Vulnerability Landscape Vulnerability Management Vulnerability Patch Vulnerability Remediation Vulnerability Reward Program Vulnerable Driver Vulnerable Driver Abuse Wallbleed Water Utility Watering Hole Attack Wazuh Weak Credentials Weak Security Web Application Security Web Content Monitoring Web Resource Hitting Web Server Vulnerability Web Shell Web3 Security WebDAV Webex Webflow Webshell Detection Website Attack Website Cloning Website Compromise Website Defacement Website Redesign White Hat Hackers Wi-Fi Security Windows 10 ESU Windows Debugging Windows Malware Windows Packet Divert (WPD) Windows Security Windows Vulnerabilities Winnti Wire Fraud Wireless Security Wireshark Workload Isolation Workplace Harassment WPS Attacks Wyze Cam Xcode Xcode Projects XCSSET XDR Xerox VersaLink C7025 XMRig XNU Kernel XPATH Injection XSS XWorm YARA YARA Rules YouTube YouTube hijacking Zero Trust Zero-Click Attacks Zero-Day Zero-day Exploit Zero-Day Exploit Zero-Day Exploits Zero-Day Vulnerability Zhong Stealer Zimbra XSS Zloader
Categories All AI Security API Security Auth & Access Blockchain Security Cloud IAM Cloud Security Compliance Conferences/Events Container Security Crypto Fraud Customer Success Story Cyber Espionage Cyberattacks & Data Breaches Cybercrime Cybersecurity Cybersecurity Best Practices Data Breach Data Loss Prev. Data Privacy Database Security DNS DoS/DDoS E-commerce Security Endpoint Security Exploits & Vulns Government Government/Policy Identity Theft Incident Report Incident Response Insider Threat IoT/OT Security Law Enforcement Legal Legal & Law Enforcement Malware Malware Analysis Mobile Security Network Security News Other Patch Management Pen Testing Phishing & SE Physical Security Politics Privacy Product/Vendor Specific Ransomware Research Secure Dev Security Awareness Security Best Practices SOC Operations Social Media Security Software Security Supply Chain Attacks Supply Chain Security Technical Deep Dive Technical How-To Technology Threat Actors Threat Intel Threat Research Vendor Solution Vulnerabilities Vulnerability Analysis Vulnerability Management Vulnerability Research Web App Security Web Application Security Web Security
Threat Actor All $$$ 8Base Access Brokers Advanced Persistent Threat (APT) groups Advertisers (Data Scraping) AE Industrial Partners Agenda Ransomware Agent Tesla AI-driven attackers Akira Akira ransomware Akira ransomware gang Alan Krysiak Aleksandr Mira Serda Aleksej Besciokov Alexander "Connor" Moucka Alien Txtbase (Telegram Channel Operator) ALIEN TXTBASE (Telegram Channel) Alluring Pisces (aka BlueNoroff, Sapphire Sleet) AlphV ALPHV Andariel Angry Likho Anti-AI activist group (unnamed) Anubis Threat Group APT groups APT Groups (Unspecified) APT-C-36 APT27 APT28 APT30 APT31 APT40 APT41 APT44 Arian Yadegarnia AsyncRAT Avast (and its subsidiary Jumpshop) Azure Abuse Enterprise BadBox 2.0 Badbox botnet BAUXITE BEARHOST BianLian (impersonated) BianLian Group BianLian ransomware group (alleged in scam) Bigpanzi Botnet BitConnect Black Basta BlackByte ransomware BlackJack BlackLock BlackLock ransomware Blacksuit BlackSuit Blind Eagle BlueAlpha BlueDelta Botnet (unnamed) Botnet operators (Mirai, Mettle, Satori, Hajime, Muhstik) BreachForums British government Brute Ratel C4 Brutecat (White Hat) Cactus CACTUS (Nurturing Mantis) Cactus Ransomware Cameron John Wagenius Cameron Wagenius Careless/untrained insiders Cellebrite Cellebrite (indirectly facilitated the attack) Chatty Spider Chen Cheng China China (State-sponsored actor) China-linked actors China-linked threat actor China-nexus adversaries Chinese APT groups Chinese Government Chinese government spies Chinese Ministry of Public Security Chinese Ministry of State Security Chinese Nationals Chinese state hackers Chinese state-sponsored actors Chinese state-sponsored hackers Chinese-affiliated group (unconfirmed) Chinese-speaking threat actor Chinese-speaking threat actors Christopher Hadnagy CL-STA-0049 Cl0p Clop ransomware gang Cobalt Strike Congress of Russian Americans (CRA) Connor Moucka Connor Riley Moucka Contagious Interview Conti Conti Ransomware COZY BEAR Crazy Evil CryptoCore Cyber Army of Russia Reborn Cyber criminals Cybercrime threat actors Cybercriminals Cybercriminals (unnamed) Cybercriminals (Unspecified) CyberVolk Danabot DanaBot Darcula criminals Darcula developers Dark Caracal DarkGate Data brokers Data Brokers David Jose Gomez-Cegarra Davis Lu DcRAT Deceased accomplice DeceptiveDevelopment DeepSeek (China) DeepSeek AI Department of Government Efficiency (DOGE) Desert Dexter DOGE (Department of Government Efficiency) DPRK-affiliated IT workers DPRK-linked actors Dylan Ayrey Earth Freybug Eastern European threat actors Ekaterina Zhdanova ELECTRUM Eleven11bot Elon Musk EncryptHub Equation Group Erudite Mogwai Evil Corp FAMOUS CHOLLIMA Fenix Botnet FIN7 Financially motivated adversaries Financially Motivated Cybercrime Group Financially motivated cybercriminals Fog FOG Ransomware Foreign intelligence service (unnamed) Foreign Nations (Unspecified) FormBook FormBook/XLoader Formjacking Fraudsters French Government Gafgyt (BASHLITE) Gallium Garantex General hacking community Gh0st RAT Ghost Ghost (Cring) Ransomware Ghost Ransomware GhostSec Ghostwriter GitVenom GitVenom actors (unnamed) GitVenom threat actors Glenn Arcaro GobRAT Google Grandoreiro GRAPHITE GRU (Military Intelligence Unit 74455) Hackers Hafnium Handala Hive (potentially related) Hook Hunters International Hydra Hydra dark web market Hydra Market i-Soon (Anxun Information Technology Co. Ltd.) i-Soon (Anxun Information Technology) i-Soon employees Illicit organizations in Myanmar Imgur Impersonators (various) Indian Tax Authorities Individuals associated with pro-Russia organizations Initial Access Brokers (IABs) Intelligence agencies (potential) Iran IRGC-CEC Islamic Revolutionary Guard Corps (IRGC) IT Army of Ukraine Ivan Turõgin Jade Sleet JavaGhost Jesus Segundo Hernandez-Gil John Binns John Erin Binns JustEvil k0shl KAMACITE Kehinde H. Oyetunji kevland Kiberphant0m Kill Security Kimsuky Knight Ransomware Kraken Kremlin Large Tech Monopolies Latrodectus Lazarus Lazarus Group Leaky[.]pro (hacking forum) Lemon Lemon Group Liang Guodong LightSpy operators LIMINAL PANDA LockBit LockBit ransomware LongTV Lotus Blossom Lotus Panda LummaC2 Lynx Lynx Ransomware Lynx Ransomware-as-a-Service (RaaS) group Ma Li Magecart Malicious Actors Malicious Actors (Implied) malicious cyber actors Malicious Model Trainer (Hypothetical) Malware Massgrave hacking collective Matanbuchus Matthew Akande Mattia Astorino (equinusocio) Medusa Ransomware Medusa ransomware gang MedusaLocker Mega-Botnet (130,000+ compromised devices) Metasploit Ministry of Public Security (MPS) Ministry of State Security (MSS) Mirai Mirai-based botnets Moonstone Sleet MoYu MoYu Group Mozi Botnet Multiple China-based Smishing gangs Multiple Ransomware Gangs Multiple unnamed malicious hacking groups Mythic Nation-states Njrat NoName057 Nortade ICT Solutions (through negligence) North Korea-aligned operators North Korea-linked threat actor North Korean cybercriminals North Korean hackers North Korean Hackers North Korean IT workers Not specified, but a single threat actor is implied. Not specified, but likely a financially motivated cybercriminal group. NSA NSA (APT-C-40) NSO Group Online communities (pro-anorexia, pro-self-harm, pedophilic) Online Scammers Operators of GhostSocks Operators of infostealer malware Operators of Lumma Stealer Paragon Solutions People's Republic of China (PRC) People's Republic of China's Ministry of Public Security (MPS) Phát Phùng Tấn Phone call scammers PlugX Plump Spider PolarEdge botnet PolarEdge Botnet Potential threat actors associated with TP-Link devices (under investigation) PrivateLoader Prospero OOO PUKCHONG Qakbot Qbot (QakBot) Qilin Qilin Ransomware Qilin ransomware gang Qilin ransomware group QuasarRAT RA World ransomware operators RansomHub RansomHub (Spoiled Scorpius) Ransomware actors Ransomware actors (general) Ransomware cartels Ransomware criminals Ransomware gang(s) Ransomware gangs Ransomware gangs (Akira, Black Basta) Ransomware group (unnamed) Ransomware groups Ransomware operators Raspberry Robin RedDelta Reddit RedLine Stealer REF7707 Reimage Cyprus Limited Restoro Cyprus Limited Rhadamanthys Stealer Rhysida Ricky Yuen Russia Russia-linked threat actors Russian cybercrime cartels Russian Developer Russian Foreign Intelligence Service (SVR) Ryuk SalesTracker SalesTracker Group Salt Typhoon Salt/Volt Typhoon Sandworm Sandworm (APT44) Sandworm APT Satish Kumbhani Scalping Bots Scammers Scattered Spider SCATTERED SPIDER Scattered Spider (linked) Scattered Spider (Muddled Libra) ScreamedJungle Script Kiddies SectopRAT Serbia’s Security-Information Agency (BIA) Serbian authorities Serbian Authorities Serbian Police Serbian security services Sergei Potapenko Shamara Simmons Shanghai Public Security Bureau Sheng Jing Sidewinder SideWinder SilentCryptoMiner threat actors Silk Typhoon Silver Fox Silver Fox APT Skira Sliver Smishing Triad Snake Keylogger SolarMarker RAT Solnetspek Solntsepek Space Pirates Spearwing Spylix SpyLoan (Malware Family) SquareX labs StaryDobry State-backed groups State-sponsored actors State-sponsored adversaries State-sponsored threat groups Stealc Stealthy infostealers Sticky Werewolf Storm-0408 Storm-1175 Storm-2139 Storm-2372 Storm1747 APT Swedish Government TA451 TA455 TAG-124 Termite ransomware gang the Com TikTok TopSec TraderTraitor Tramp (LARVA-18) Trump Administration Turla Tyrone Rose UAC-0173 UAC-0194 UAC-0212 UK Government UK Home Office Unapprehended accomplice UNC1151 UNC4221 UNC4841 UNC4899 UNC5792 UNK_CraftyCamel Unknown Unknown (likely operating from a compromised system within Alexandrion Saber 1789 Distilleries) Unknown Actor Unknown Attacker Unknown Cybercriminals Unknown Hackers Unknown Threat Actor (IP 8.133.192.98) Unknown Threat Actors Unnamed Cryptocurrency Fraudsters Unnamed Threat Actor Unscrupulous Competitors Unspecified Actors VAULT PANDA Vo1d Botnet Void Arachne Volt Typhoon VOLTZITE Wang Liyu Wang Yan Wang Zhe Webworm Wei Winnti Wu Haibo Wyze Labs XakNet XCSSET Xu Liang XWorm Yin Kecheng Yin KeCheng zhongmaziil992@outlook.com Zhou Shuai Zhou Weiwei
Actor Aliases All Agenda Akira Alien Alien Txtbase Alluring Pisces ALPHV (potential connection to RansomHub) ALPHV/BlackCat Amber Albatross Anubis__media APT-C-36 APT-C-40 APT.Win.Lazarus.* APT.Wins.Lazarus.* APT.Wins.Lazarus.ta.* APT27 APT38 APT44 Asakuri Awaken Likho Bablosoft JS BadPilot Bandidos BASHLITE BEARHOST Behinder BIA (Serbia's security services) Billbug Black Basta Blind Eagle BlueNoroff BlueNorOff (APT38) Bronze Elgin BrowBot CE-6 cg-dot Cg-dot Charcoal Stork Coldface Com Core Werewolf CovertNetwork-1658 Cozy Bear Cring Crypt3r cyb3rph4nt0m Cyber Army of Russia Reborn Cyber KunLun CyberAv3ngers Dark Cloud Shield DarkCrystal RAT DeceptiveDevelopment Department of Government Efficiency (DOGE) dexterlyly Dipo17 Drago DragonEgg E-ZPass (imposter) El Dorado Eldorado Emerald Sleet EMPIREPAST enKrypt equinusocio Erudite Mogwai ESXIArgs EZDriveMA (imposter) Fairbalance FakePay Famous Chollima Fancy Bear FinalDraft Finance Simplified Finance Simplified (com.someca.count) FinStealer Fiz GamaCopy Gh0st RAT GodFather Graphite Guerrilla malware (associated with Lemon Group) H&R Block impersonators Hades (ransomware variant) Hafnium Hello Hive Hive ransomware gang (predecessor) Hive ransomware group HsHarada Ice Scorpion IMSI Catcher Infrared Ibis IRS impersonators IsDLEnabledinAD Jade Sleet Judische Jumpshop JustEvil Khanon kiberphant0m Kiberphant0m KreditApple KreditPro (formerly KreditApple) Kunlun Lab LARVA-18 LARVA-208 Lazarus Lazarus Group LinkDoor Lotus Blossom Mamont Medusa Ransomware Middle Kingdom Midnight Blizzard MoneyAPE Moonscape Mr. LockBit Muddled Libra Mzmess No regrets NoName057 NotPetya NoviSpy Nurturing Mantis PAPERDROP/PAPERTEAR (Mandiant's name for overlapping Saffron Starling activity) Peach Pass (imposter) Peachpit (ad fraud network) Peer Review Pegasus Phantom Phoenix (ransomware variant) Piom PokketMe POOLRAT PseudoGamaredon PUKCHONG Qianyue Overseas Public Opinion AI Assistant Quad7 Rapture Rebeyond RevivalStone Rewardsteal s63 Saffron Starling Salt Typhoon Sandworm Sapphire Sleet Scattered Spider Seashell Blizzard Securehost Silk Typhoon Slow Pisces SmsThief Snooper's Charter Softcell Solnetspek Solntsepek Space Pirates Sparda SparkCat Sparta Spearwing Spoiled Scorpius Spring Dragon SpyLend StashFur State tax agency impersonators Sticky Werewolf Stingray Storm-1175 Storm-1789 Strike SunPass (imposter) superbluestar superredstar supersonic TA445 TGR-UNK-0011 TgToxic The Great Thief of Valley Thrip ToxicPanda TraderTraitor ts01 TurboTax impersonators U.S. Digital Service UAC-0057 UAC-0185 UAC-0195 UNC1151 UNC4899 UNK_CraftyCamel UNSC 2814 ValleyRAT VELVET CHOLLIMA Vengeful Mantis VirtualPie VirtualPita Vo1d Void Arachne Wickrme Winos 4.0 XakNet Xlogin YKCAI You Dun 冰蝎 (Bīng xiē)
Exploit Method All Authentication Bypass Backdoor Implant BeyondTrust RS and PRA argument injection exploit Botnet Brute Force Buffer Overflow (BOF) Business Email Compromise (BEC) Cloud Misconfiguration Code Injection Command Injection Credential Stuffing Cross-Site Request Forgery (CSRF) Cross-Site Scripting (XSS) Cryptojacking Attack Data Breach Data Exfiltration Data Manipulation Deepfake Attack Denial of Service (DoS) Directory Traversal Domain Generation Algorithm (DGA) Drive-by Download Email Spoofing Evasion Techniques Information Disclosure Insecure Deserialization Insider Threat InvokeAI unauthenticated remote code execution exploit Living off the Land (LoL) Malicious Advertisements Malicious Software Updates Malvertising Malware Man-in-the-Middle (MITM) Memory Corruption Multi-Factor Authentication Bypass Password Spraying Path Traversal Phantom DLL Hijacking Phishing PostgreSQL SQL injection exploit Privilege Escalation Prototype Pollution Rainbow Table Ransomware Attack Remote Access Tools (RATs) Remote Code Execution (RCE) Serialization Attack Session Hijacking Shadow IT Attack Side-Channel Attack SMiShing Social Engineering Spear Phishing SQL Injection (SQLi) Steganography Attack Supply Chain Attack UDP Flood Vishing Vulnerability Exploit Watering Hole Attack Web Shell Attack Zero-Day Exploit
Vulnerabilities All CVE-2009-3960 CVE-2010-2861 CVE-2014-8361 CVE-2017-0199 CVE-2017-11882 CVE-2017-3066 CVE-2017-5753 CVE-2017-5754 CVE-2018-0171 CVE-2018-0802 CVE-2018-10561 CVE-2018-13379 CVE-2018-8639 CVE-2019-0604 CVE-2020-1472 CVE-2020-24901 CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065 CVE-2021-28482 CVE-2021-30713 CVE-2021-31207 CVE-2021-34473 CVE-2021-34523 CVE-2021-40444 CVE-2021-42278 CVE-2021-42287 CVE-2021-42321 CVE-2021-44228 CVE-2022-0609 CVE-2022-0847 CVE-2022-1388 CVE-2022-22965 CVE-2022-25927 CVE-2022-26134 CVE-2022-27925 CVE-2022-30190 CVE-2022-34918 CVE-2022-37042 CVE-2022-37969 CVE-2022-41040 CVE-2022-41082 CVE-2022-41352 CVE-2022-43769 CVE-2022-43939 CVE-2023-20118 CVE-2023-20198 CVE-2023-20273 CVE-2023-21716 CVE-2023-22515 CVE-2023-23397 CVE-2023-29357 CVE-2023-34048 CVE-2023-34192 CVE-2023-3466 CVE-2023-3467 CVE-2023-3519 CVE-2023-35628 CVE-2023-36394 CVE-2023-36745 CVE-2023-36844 CVE-2023-36845 CVE-2023-36874 CVE-2023-36884 CVE-2023-38408 CVE-2023-38831 CVE-2023-42115 CVE-2023-42793 CVE-2023-44467 CVE-2023-46229 CVE-2023-4966 CVE-2023-6875 CVE-2023-7027 CVE-2024-0012 CVE-2024-0582 CVE-2024-10644 CVE-2024-10763 CVE-2024-10811 CVE-2024-1086 CVE-2024-1182 CVE-2024-12029 CVE-2024-12084 CVE-2024-12085 CVE-2024-12086 CVE-2024-12087 CVE-2024-12088 CVE-2024-1212 CVE-2024-12213 CVE-2024-12356 CVE-2024-12510 CVE-2024-12511 CVE-2024-12562 CVE-2024-12797 CVE-2024-13159 CVE-2024-13160 CVE-2024-13161 CVE-2024-13182 CVE-2024-13365 CVE-2024-13421 CVE-2024-13513 CVE-2024-1708 CVE-2024-1709 CVE-2024-20399 CVE-2024-20720 CVE-2024-20953 CVE-2024-21338 CVE-2024-21378 CVE-2024-21413 CVE-2024-21447 CVE-2024-21683 CVE-2024-21762 CVE-2024-23108 CVE-2024-23109 CVE-2024-23113 CVE-2024-23897 CVE-2024-24578 CVE-2024-24919 CVE-2024-25600 CVE-2024-26169 CVE-2024-27198 CVE-2024-28916 CVE-2024-32838 CVE-2024-3400 CVE-2024-3408 CVE-2024-34102 CVE-2024-34331 CVE-2024-37085 CVE-2024-37285 CVE-2024-37287 CVE-2024-37288 CVE-2024-38100 CVE-2024-38213 CVE-2024-38657 CVE-2024-38812 CVE-2024-38813 CVE-2024-40591 CVE-2024-41334 CVE-2024-41340 CVE-2024-43047 CVE-2024-43051 CVE-2024-43093 CVE-2024-43451 CVE-2024-43572 CVE-2024-43639 CVE-2024-4577 CVE-2024-47072 CVE-2024-47561 CVE-2024-47908 CVE-2024-48248 CVE-2024-48766 CVE-2024-4885 CVE-2024-49035 CVE-2024-49039 CVE-2024-50302 CVE-2024-50379 CVE-2024-50623 CVE-2024-51138 CVE-2024-51139 CVE-2024-52316 CVE-2024-52577 CVE-2024-53011 CVE-2024-53025 CVE-2024-53104 CVE-2024-53197 CVE-2024-53704 CVE-2024-53870 CVE-2024-53900 CVE-2024-55555 CVE-2024-56131 CVE-2024-56132 CVE-2024-56133 CVE-2024-56134 CVE-2024-56135 CVE-2024-56161 CVE-2024-56325 CVE-2024-56337 CVE-2024-57727 CVE-2024-6387 CVE-2024-7102 CVE-2024-7254 CVE-2024-7587 CVE-2024-8299 CVE-2024-8300 CVE-2024-9474 CVE-2024-9852 CVE-2025-0108 CVE-2025-0110 CVE-2025-0111 CVE-2025-0282 CVE-2025-0283 CVE-2025-0285 CVE-2025-0286 CVE-2025-0287 CVE-2025-0288 CVE-2025-0289 CVE-2025-0364 CVE-2025-0655 CVE-2025-0693 CVE-2025-0994 CVE-2025-0999 CVE-2025-1080 CVE-2025-1094 CVE-2025-1126 CVE-2025-1240 CVE-2025-1316 CVE-2025-1414 CVE-2025-1426 CVE-2025-1492 CVE-2025-1723 CVE-2025-20111 CVE-2025-20206 CVE-2025-20644 CVE-2025-20645 CVE-2025-21297 CVE-2025-21298 CVE-2025-21309 CVE-2025-21391 CVE-2025-21418 CVE-2025-21589 CVE-2025-22224 CVE-2025-22225 CVE-2025-22226 CVE-2025-22467 CVE-2025-22896 CVE-2025-23061 CVE-2025-23359 CVE-2025-23363 CVE-2025-24200 CVE-2025-24494 CVE-2025-24865 CVE-2025-24989 CVE-2025-25012 CVE-2025-25015 CVE-2025-25067 CVE-2025-26465 CVE-2025-26466 CVE-2025-26506 CVE-2025-26793 CVE-2025-27218 CVE-2025-27364 CVE-2025-27423 CVE-2025-27622 CVE-2025-27623 CVE-2025-27840
MITRE ATT&CK TTP All Account Manipulation: T1098 Account Takeover: T1078 AppleScript: T1059.002 Application Layer Protocol: T1071 Brute Force: T1110 Bypass Antivirus: T1562.001 Command and Control: T1071 Command and Scripting Interpreter: T1059 Credential Access: T1003 Credential Dumping: T1003 Credential Stuffing: T1110.004 Data Destruction: T1485 Data Encrypted for Impact: T1486 Data Encryption: T1486 Data Exfiltration: T1041 Data from Cloud Storage: T1530 Data from Local System: T1005 Data Manipulation: T1565 Data Staged - DLL Search Order Hijacking: T1574.001 Data Staged: T1560 DLL Side-Loading: T1574.002 Drive-by Compromise: T1189 Dynamic-Link Library Injection: T1055.001 Exfiltration Over C2 Channel: T1041 Exfiltration Over Web Service: T1567 Exploit Privilege Escalation: T1068 Exploit Public-Facing Application: T1190 Exploitation for Privilege Escalation: T1189 Exploitation of Public-Facing Application: T1190 File and Directory Discovery: T1083 Gather Victim Information: T1590 Indicator Removal: T1070 Initial Access: T1566.002 Initial Compromise: TA0001 Keylogging: T1056.001 Lateral Movement: T1021 NTDS.dit Credential Dumping: T1003.003 Obfuscation: T1027 OS Credential Dumping: T1003.001 Phishing: T1566 PowerShell: T1059.001 Privilege Escalation: T1548 Process Hollowing: T1055.012 Process Injection: T1055 PsExec: T1570 Registry Keys: T1547.001 Registry Modification: T1112 Remote Code Execution (RCE): T1203 Remote Services: T1021 Remote System Discovery: T1018 SAM Credential Dumping: T1003.002 Scheduled Task: T1053 Social Engineering: T1566.005 Software Discovery: T1592.002 Spear Phishing: T1566.001 Spearphishing Link: T1566.002 Startup Items: T1547.001 Supply Chain Attack: T1195 System Information Discovery: T1082 System Network Configuration Discovery: T1016 System Owner/User Discovery: T1033 Targeted Phishing: T1566.001 UAC Bypass: T1548.002 Unsecured Credentials: T1552 User Execution Malicious File: T1204.002 User Execution Malicious Link: T1204.001 User Execution: T1204 Valid Accounts: T1078 Visual Basic: T1059.005 Web Protocol Defense Evasion: T1071.001 Whaling: T1566.002
Exploited Software All .NET .NET framework .NET Framework 1Password (indirectly) 1Password (mentioned as a victim of a past attack, not directly exploited by the new browser) 7-Zip (older versions) Access Management Systems (AMS) Active Directory Active Directory Certificate Services Active Directory sync credentials (AADConnect) Ad networks (Unity, Facebook, Google, Microsoft, Apple, Amazon, ironSource, etc.) Adobe ColdFusion Advanced Data Protection (ADP) AI image generation tool AI voice cloning software from Descript, ElevenLabs, Lovo, PlayHT, Resemble AI, and Speechify AI-enabled browser extensions AlarmWorX64 MMX Alexa (Amazon) Alibaba Qwen2.5-Coder-32B-Instruct Amazon Amazon App Store Amazon EC2 server Amazon Elastic Cloud Compute (EC2) Amazon Machine Images (AMIs) Amazon S3 Amazon Simple Email Service (SES) Amazon Web Services (AWS) AMD Processors Android Android Automotive OS Android Call Functions Android devices Android Framework Android Open Source Project (AOSP) Android Open Source Project (AOSP) based devices Android OS Android OS (AOSP) Android OS (Linux kernel driver for Human Interface Devices, USB Video Class driver, ALSA USB-sound driver), Android Framework Android OS (Linux Kernel USB Drivers) Android OS (Linux Kernel) Android System SafetyCore Android TV (off-brand, AOSP based) Android TV Boxes Android TV Devices Android USB Kernel Drivers Android's Linux kernel USB drivers Ansible Anthropic's Claude AnyDesk Apache Apache BlazeDS Apache Fineract Apache Ignite Apache Pinot Apache Tomcat APIs Apple 'Find My' Apple iCloud Apple iCloud Advanced Data Protection Apple iMessage Apple iOS and iPadOS Apple iOS Dictation Apple Keychain Apple macOS Apple Pay Apple Services Apple software (at-rest encryption) Apple Xcode Apple's AI-powered news assistant ASN.1 library (msasn1.dll) aspnet_compiler.exe ASUS devices AsyncRAT AT&T network AT&T systems (implied) Atlassian Confluence ATM Software (Unspecified) Authenticator Autodesk Navisworks Freedom AutoIt AutoIT Avast antivirus software Avast browser extensions AWS AWS (Amazon Web Services) AWS CloudTrail AWS Control Tower AWS Directory Service (DS) AWS IAM AWS Identity and Access Management (IAM) AWS KMS AWS Macie AWS S3 AWS S3 (potentially) AWS Security Token Service (STS) AWS Web Console AWS WorkMail Azure Azure AI services Azure DevOps Azure Run Commands Azure services Azure VMs BabySentry patient management system BackConnect BadPotato Barracuda Email Security Gateway (ESG) appliance Barracuda Networks email gateway bashupload[.]com Basic Authentication BeamNG.drive BeaverTail BeyondTrust BeyondTrust Remote Support BeyondTrust RS and PRA BigAntSoft BigAnt BigAntSoft BigAnt Server (versions 5.6.06 and below) Binance BioNTdrv.sys driver Bitbucket BitTorrent clients (uTorrent, Deluge, qBittorrent, Vuze) BlackConnect malware BORE Brave Brave Browser Brick Builders WordPress Theme Browser Assistant (adware) Burp Suite Bybit (cryptocurrency exchange) Bybit Exchange C C# C++ Campress theme cdb.exe Cellebrite forensic software Cellebrite UFED System certutil Certutil Character.AI ChatGPT ChatGPT Android App ChatGPT Operator ChatGPT Web Interface Check Point Quantum Security Gateways Check Point VPN Chrome Chrome (for credential stealing) Chrome Extensions Chromecast (second generation) Chromecast Audio Chromium Chromium-based web browsers (Google Chrome, Microsoft Edge, Brave, Opera) Chub AI CISA systems Cisco Cisco Application Policy Infrastructure Controller (APIC) Cisco BroadWorks Cisco IOS Cisco IOS XE Cisco networking equipment Cisco Nexus 3000 and 9000 series switches Cisco NX-OS Cisco Secure Client for Windows Cisco small business routers (CVE-2023-20118) Cisco Small Business RV Series Routers Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers Cisco software Cisco Webex for BroadWorks Citrix NetScaler Citrix NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateways Citrix NetScaler Console and Agent Citrix server CleanTalk plugin Cleo Harmony Cleo managed file transfer software Cleo MFT (Managed File Transfer products) Cloud Applications Cloud Data Management Companies Cloud Instances Cloud servers Cloud Services (Unspecified) Cloud-based Application Providers Cloudflare Cloudflare Pages Cloudflare R2 Cloudflare Workers CloudFront CloudFront (potentially) cmd.exe Cobalt Strike Cobalt Strike framework Cobeacon com.google.android.services (Android System App) Command-Line Tools Common Linux utilities Company VPN conhost.exe ConnectWise RAT ConnectWise ScreenConnect Copilot for Telegram Copilot for WhatsApp copilot.ai copilot.microsoft.com CrushOn.AI Cryptocurrency Wallets CryptoJobsList csc.exe CUPS cups-browsed curl CURL curl.exe Cyberoam appliances D-Link devices D-Tale Darcula V2 Darcula V3 Dasan GPON home routers Data Management Companies Decentralized Exchanges Deed RAT DeepSeek (impersonated) Delta Electronics ISPSoft Descript DHS systems Digiwin ERP software DingTalk Discord Disney Slack Docker Docker Desktop Dockutil Doenerium Domain controller Draytek routers Dropbox Dropbox API dwm.exe Dyson Sphere Program eBay Edge Edimax IC-7100 Edimax IC-7100 IP Cameras Elastic Kibana Elasticsearch ElasticSearch Electron ElevenLabs Email Clients Email servers Email System Email Systems Email Systems (Unspecified) EmEditor Encrypted Messaging Systems Endpoint Detection and Response (EDR) Endpoint Detection and Response (EDR) software Endpoint Protection Platforms (EPP) Enterprise Resource Planning System Entra Connect Entra ID ESP32 Bluetooth Chip Firmware ESXi ETH Cold Wallet ETH multisig cold wallet eth-account (inferred) Ethereum Ethereum Cold Wallet Exchange Web Services (EWS) API Exim ExpressVPN F5 Big-IP Facebook Facebook Ads Fastly FIDDLER File Explorers FileZilla Firefox Fortinet FortiOS Fortinet FortiOS appliances Fortinet FortiSIEM Fortinet FortiWeb FTP Garble Obfuscator Garry's Mod Gen-AI applications GenAI tools (Unspecified) GenBroker32 GENESIS32 GENESIS64 GitHub Gitlab GitLab GitLab CE/EE Gmail gnmic Gnosis Safe Multisig Go Programming Language Compiler GoDaddy Gofile Google Android Google Bard Google Chrome Google Chrome (Extensions) Google Cloud Products Google Cloud Security Command Center Google Drive Google Forms Google Home Google Meet Google Messages Google Messages (RCS) Google Messages app Google OAuth Google Pay Google People API Google Pixel Recorder Google Play Services Google Play Store Google Services (Gmail, Google Play, Maps, Workspace, YouTube) Google Workspace Google's Gemini LLMs GraphQL APIs Great Firewall of China (GFW) DNS injection subsystem Group Policy Objects HashFlare (web-based dashboard) Havoc C2 Framework Hirsch Enterphone MESH Hitachi Vantara Pentaho BA Server Hitachi Vantara Pentaho Business Analytics Server Hitachi Vantara software Home internet routers (including ISP-provided fiber modems) HP LaserJet HP LaserJet Pro MFP 3301fdw HP LaserJet Pro MFP 3301fdw printer's PostScript interpreter HR systems Hugging Face Hugging Face platform Huorong HVAC Systems (Target) IBM Lotus Domino iCloud Iconics Genesis64 ICONICS Suite Identity Management Platforms IIS iMessage iMessages Imgur Impacket impacket's smbserver.py Infini DeFi Protocol Inno Setup Instagram InstallUtil.exe Intel Internal Email Services Internal Logistics Management Software Internal Secure File Transfer Platform Internet Archive Internet Explorer Internet Information Services (IIS) Internet-facing services with outdated software and firmware Inventory system InvisibleFerret Invoice Ninja InvokeAI io_uring (Linux kernel) iOS iOS/iPadOS IoT devices IoT devices (routers, cameras) IRS systems IT providers, identity management, privileged access management, and RMM solutions Ivanti Ivanti Cloud Services Application Ivanti Connect Secure Ivanti devices Ivanti Endpoint Manager Ivanti Pulse Connect VPN Ivanti VPN and security products JanitorAI Java Java SDK of Apache Avro JavaScript Jenkins JetBrains Juniper OS Juniper Session Smart Routers Kafka Kali Linux KeePass Keychain Keysight Ixia Vision Kibana KickIdler Grabber KillAV KillAVDriver Kingsoft Security Kitty Kometa krbrelayx Kropyva (Ukrainian Military Application) Krpano ksmbd Kubernetes Laravel LastPass LastPass Google Chrome Extension Launchpad LDAP Leeds United retail website Let's Encrypt Lexmark Print Management Client libc libcupsfilters libppd LibreOffice LINE LinkedIn Linux Linux (implied) Linux Kernel Linux operating system Linux operating systems (AcidPour targets UBI directories in embedded devices) Linux systems Linux Tomcat server Linux udev Linux USB Video Class (UVC) driver LLMs Logitech Hub Lovo LSASS (Local Security Authority Subsystem Service) LuckyStrike Agent Lumma Stealer Lynx Ransomware macOS macOS I/O Kit framework macOS System Binaries (ping, chmod, sudo, id, cat) Magento Mail Master Manx and Sandcat agents Mediatek Chipsets MelSim2ComProc.exe Mesh Agent MeshAgent Message Master SMS SDK MetaMask Microsoft 365 Microsoft 365 (spoofed) Microsoft AADConnect (Entra Connect) Microsoft Accounts Microsoft Active Directory Microsoft Active Directory (AD) Microsoft API Keys Microsoft Azure Microsoft Azure OpenAI Microsoft Azure OpenAI Service Microsoft Copilot Microsoft Defender Microsoft Defender for Cloud Microsoft Dev Tunnels Microsoft Dynamics 365 Microsoft email system Microsoft Entra Connect Microsoft Entra ID Microsoft Excel Microsoft Exchange Microsoft Exchange Server Microsoft Exchange servers Microsoft Exchange Servers Microsoft Generative AI Services Microsoft Graph Microsoft Graph API Microsoft Internet Information Services (IIS) Microsoft Management Console Microsoft Network Access Accounts (NAA) (implied) Microsoft O365 Microsoft Office Microsoft Office (DOCX, RTF) Microsoft Office Applications Microsoft OneDrive Microsoft Outlook Microsoft Partner Center Microsoft Power Pages Microsoft Quick Assist Microsoft Quick Assist (inferred) Microsoft services Microsoft Services (including MSGraph, OneDrive, SharePoint) Microsoft services (including OneDrive, SharePoint, MSGraph API) Microsoft SharePoint Microsoft SQL Server Microsoft Teams Microsoft Time Travel Debugging (TTD) Microsoft Visual Studio 2022 Microsoft Win32k Microsoft Windows Microsoft Windows (cmd.exe, mshta.exe) Microsoft Windows (Registry) Microsoft Windows Ancillary Function Driver for WinSock Microsoft Windows KDC Proxy Microsoft Windows OLE Microsoft Windows PC (implied) Microsoft Windows Storage Microsoft Word 2010 Mimikatz Mirai malware Mirth Connect MITRE Caldera Mitsubishi Electric MC Works64 MMCfg.exe MMXCall_in.exe Mobile apps (various) Mobile web apps Modbus TCP/502 MongoDB Mongoose ODM library Moskollektor (municipal organization maintaining Moscow's communication system for gas, water, and sewage network) MoveIt Transfer Mozilla Firefox MSBuild.exe MSHTA msiexec.exe mspaint.exe mticomp0 component mySCADA myPRO Manager MySCADA MyPro Manager Mythic Framework NAKIVO Backup & Replication NAKIVO Backup & Replication (version 10.11.3.86570 and prior) Navicat NetAlertX netfilter (Linux kernel) NetScan NetSupport RAT Network infrastructure Network Video Recorders (NVRs) Neverwinter Nights: Enhanced Edition nf_tables (Linux kernel) NFCGate Ngrok NI DAQExpress NMAP Node.js Noninteractive Sign-in feature Notes NotFound Notion NPM modules Ntdsutil NTT Communications Order Information Distribution System Nullsoft Scriptable Install System Nullsoft Scriptable Install System (NSIS) NVIDIA Container Toolkit OAuth applications OAuth Applications Office Documents Offshore ticket vendor's platform Okta Oliver POS Ollama (impersonated) Online Banking Applications Online banking/investment platforms Online file converters (unspecified) OpenAI GPT-4o OpenAI's ChatGPT OpenSSH OpenSSL OpenVPN Opera GX Stable Opera Neon Opera Stable OPM systems Oracle Agile PLM Oracle Agile Product Lifecycle Management (PLM) Oracle Cloud VMWare (OCVS) Outlook PACER (Public Access to Court Electronic Records) Palo Alto Global Protect Palo Alto Networks Firewall Software Palo Alto Networks firewalls Palo Alto Networks Firewalls Palo Alto Networks GlobalProtect Palo Alto Networks GlobalProtect Gateway Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS OpenConfig Plugin Palo Alto Networks PAN-OS software PAN-OS Paragon Driver Paragon Partition Manager Parallels Desktop for Mac Password Management Vault PayPal PDF4PRO PDFBean PDFCOFFEE PDQ Deploy PDQ Inventory Philips DICOM viewer Philips DICOM viewers Phone by Google PHP-CGI (Windows) Picklescan Ping Identity PingAM Java Agent Pixel 9+ Pixel devices PlayHT Plutocracy Polygon RPC endpoint 'rpc-amoy.polygon.technology' PostgreSQL PostgreSQL pg_cron extension PostgreSQL psql PostHog PowerShell Privileged Access Management (PAM) Platforms Privileged Access Management Tools Privileged Access Manager Progress Kemp LoadMaster Progress Software's MOVEit Progress Software's WhatsUp Gold Progress WhatsUp Gold Protocol Buffers Publicly exposed API Puppeteer (likely) PuTTY PyInstaller Python Python 2 Interpreter Python ctypes library Python Package Index (PyPI) PyTorch Qakbot QakBot (QBot) Qakbot malware Qbot (QakBot) QNAP devices QNX QQ Installer QQ Talk Qualcomm Chipsets Quasar Quasar RAT RADIUS RAR Archive Raspberrymatic Rclone RCS (Google Messages) RDP RDPWRAPPER Real Estate 7 theme Real-time bidding (RTB) systems Realtek SDK Red Hat OpenShift Reddit Redis RegAsm.exe RegSvcs.exe Reimage Remote access tools Remote Assistance Technologies Remote Desktop Protocol (RDP) remote management tools Remote Management Tools Remote Registry Service Resemble AI Responder Restoro Reverb (online marketplace) RMM software Robocopy RoboCopy Rosetta 2 Rsync RVTools Ryuk Ransomware s2Member Pro plugin SaaS applications SaaS Applications Safari Safe.global platform Safe.global Platform Safe{Wallet} SafeWallet Sagerunex family of backdoor malware Salesforce Samsung Galaxy A32 Sanity.io dependency SectopRAT Security Cameras SENDMAIL Servers (Unspecified) Services Systems Manager (SSM) SEW-EURODRIVE MOVITOOLS MotionStudio SharePoint SharePoint Online Shopify SIEM Siemens Teamcenter Signal Signal Messenger SilentCryptoMiner SimpleHelp SimpleHelp (Intelerad) Sitecore Skype Slack Smart Contract Smart Contracts SMB SMB (Server Message Block) SMS SNMP Snowflake Snowflake Cloud Services Social Media SolarWinds Orion SolarWinds Platform SonicWall NSv SonicWall SonicOS SonicWall SonicOS SSLVPN SonicWall VPN Sparta/Sparda Speechify Spicy Chat Splashtop Remote Service SQL database (Sunflower Medical Group) SSA systems SSH SSH (implied) Steam Stowaway Strikingly Stripe StubHub online ticket marketplace suidexec svcctl named pipe svchost.exe Synacor Zimbra Collaboration Suite (ZCS) Synology devices System Center Configuration Manager (SCCM) System Security Services TACACS taskhostw.exe TawkTo Widget Teams Telecommunication networks Telegram Telegram Bot API Telnet Tencent QQ Terraform TFTP Third-party scripts (e.g., checkout, analytics, live chat, fraud detection) Third-Party Software TikTok TikTok Shop TON Wallet Tornado Cash Toshiba executable (toshdpdb.exe) Total Commander TP-Link routers Traefik (reverse proxy) Treasury systems Trimble Cityworks Trimble SketchUp TrueSight Driver Truesight.sys (RogueKiller Antirootkit Driver, version 2.0.2) Truesight.sys (RogueKiller Antirootkit Driver) TTDAnalyze.dll Twitter Twitter API ua-parser-js Universe Sandbox University Website Login Portals Unspecified AI tool Unspecified Browser Extensions Unspecified Cloud-Based Software Unspecified software with insecure APIs (Medefer incident) Uranium Finance smart contracts Uranium Finance Smart Contracts USAID email systems UserAssist Registry VA.gov systems various Android apps various cloud applications Various Generative AI tools (e.g., ChatGPT) Various Generative AI Web Products (anonymized) various iOS systems various Linux systems various macOS systems Various Mobile Banking Apps Various Multi-vendor Network Devices various routers Various web applications Various Web Browsers Various Web Browsers (implicitly) Various Websites (YC Hacker News, Booking.com, The Guardian) various Windows systems vCenter Venmo Venom RAT Verizon network Vidar Video conferencing software Vim Virtual camera software Visual Studio Visual Studio Code (VSCode) extensions Vivaldi VMProtect vmtoolsd.exe VMware VMware Cloud Foundation VMware ESXi VMware Fusion VMware PowerCLI VMware Spring VMware Telco Cloud Platform VMware vCenter VMware vCenter Server VMware vSphere VMware Workstation VoIP platforms (Zoom, Microsoft Teams, etc.) VooV Meeting VPN VPNs VSCode Waterfox WearOS Web Browsers WebDAV Client Webex for BroadWorks Webflow CDN WeChat WellFound WhatsApp WhatsApp (Third-party mods) WhatsUp Gold Wifite WinDbg Windows Windows (all supported versions) Windows 10 Windows Active Directory Windows API (UuidFromStringA) Windows Batch Windows Command Prompt Windows Defender Windows environments Windows Management Instrumentation (WMI) Windows Operating System Windows OS Windows Packet Divert drivers Windows PowerShell Windows Quick Assist Windows Registry Windows Remote Desktop Services Windows Scheduled Tasks Windows Scripting Host (wscript.exe) Windows Security Features (Firewall, SmartScreen, Task Manager, Command Prompt, Remote Desktop Access) Windows Services Windows SMB Client Windows SSH Service Windows Subsystems Windows Task Scheduler WinRAR WinSCP WinZip Wireshark Wix WMI WMIC WordPress WordPress SMTP plugins WP Directorybox Manager plugin WP Job Board Pro plugin Wyze Cam X Xcode XCOPY Xerox VersaLink C7025 XMRig XMRig (open-source miner) XMRig (open-source mining tool) XNU Kernel XStream library XWorm XWORM YouTube Zelle Zendesk Zimbra Zimbra API Zloader ZNFC (Android App) Zoho ADSelfService Plus Zoom Zyxel Zyxel routers
Involved Countries All Afghanistan Albania Algeria Angola Argentina Asia Australia Austria Bahamas Bangladesh Belarus Belgium Brazil Bulgaria Cambodia Canada Central African Republic Chile China Colombia Cuba Cyprus Czech Republic Denmark Djibouti Dominican Republic Ecuador Egypt Estonia Europe Fiji Finland France Georgia Germany Ghana Hungary India Indonesia Iran Ireland Israel Italy Jamaica Japan Kazakhstan Kenya Laos Lebanon Libya Lithuania Malaysia Maldives Malta Mexico Mongolia Mozambique Myanmar (Burma) Nepal Netherlands New Zealand Nigeria North Korea Pakistan Panama Papua New Guinea Paraguay Peru Philippines Poland Portugal Qatar Romania Russia Rwanda Samoa Saudi Arabia Serbia Singapore Slovakia South Africa South Korea Spain Sri Lanka Sweden Switzerland Taiwan Thailand Tunisia Turkey Uganda Ukraine United Arab Emirates United Kingdom United States Uruguay Venezuela Vietnam Yemen
Affected Industries All Aerospace Manufacturing Agriculture Architecture Automotive Automotive Manufacturing Aviation Banking Biopharmaceuticals Biotechnology Blockchain Technology Brokerage Construction Consumer Services Critical Infrastructure Cryptocurrency Cryptocurrency Exchange Cybersecurity Cybersecurity Vendors Data Centers Defense Defense Department Education Electricity Energy Entertainment Entertainment Sector Finance Financial Financial Institutions Financial Services FinTech Gaming Government Healthcare Hospital Hospitality ICS Industrial Automation Industrial Control Systems Insurance Internet Service Provider IT Services Law Enforcement Law Firm Legal Services Logistics Transportation Machine Learning Services Manufacturing Media Company Medical Devices Medical Research Military Mining Non-Profit Nuclear Power Operational Technology (OT) Pharmaceuticals Port Private Equity Public Administration Public Sector Real Estate Religious Institutions Retail Satellite Communication Semiconductor Industry Software Company Software Development Technology Telecom Telecommunications Tourism Transportation Utilities Venture Capital Water Treatment Wealth Management