threat-intel Iran-linked hackers expand infrastructure across Europe and Middle East, report says Iranian-linked hackers, known as Tortoiseshell, are expanding their operations across Europe and the Middle East, including establishing infrastructure in Britain. The group, associated with Iran's Islamic Revolutionary Guard Corps, utilizes tools like a TwoStroke backdoor and reverse SSH tunnels to conduct espionage o… The Record · 3d ago High UKBESAiranaptssh tunnel
threat-intel NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions A new phishing toolkit called NovaCookies is being used to steal Microsoft 365 sessions by abusing legitimate Docusign notifications and mimicking genuine email shares. Developed by an adversary-in-the-middle (AitM) oper… The Hacker News · 4d ago High USUKCAphishingaitmmicrosoft 365
threat-intel Interpol's Jackal IV Disrupts West African Crime Infrastructure Interpol's Jackal IV operation successfully disrupted West African crime infrastructure networks involved in various cybercrime activities, including business email compromise, romance scams, and money laundering. The op… Dark Reading · 4d ago High ARAUCAcybercrimefraudmoney laundering
threat-intel INTERPOL Operation Jackal IV Arrests 58, Identifies 263 in Global Cyber Fraud Crackdown INTERPOL’s fourth iteration of Operation Jackal has resulted in the arrest of 58 individuals and the identification of 263 suspects globally, targeting West African organized crime groups involved in cyber fraud, includi… The Hacker News · 4d ago High AUARBEcybercrimefraudmoney laundering
threat-intel Ukraine says cyberattack hit Russian e-commerce giant Wildberries amid drone strikes Ukraine’s military intelligence, in collaboration with hacker groups, reportedly launched a cyberattack against Russia’s largest e-commerce platform, Wildberries, coinciding with drone strikes targeting the company’s inf… The Record · Aug 17, 2026 High UARUcyberwardroneecommerce
threat-intel Who’s Tracking You? Use This New Service to Find Out DecryptAds is a new service designed to expose the complex ecosystem of adtech companies tracking users online. By scraping data from files like ads.txt, app-ads.txt, and sellers.json, it reveals a network of data broker… Krebs on Security · Aug 14, 2026 High CHRUUAadtechdata-brokermalvertising
threat-intel Russian businesses erase Durov-linked products after 'terrorist' designation Following Russia's designation of Telegram founder Pavel Durov as a terrorist and extremist, numerous Russian businesses are removing products associated with him, including books, films, and merchandise. Despite these e… The Record · Aug 4, 2026 High RUFRUAcensorshipduraovtelegram
vulnerability INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws The INC Ransomware operation has become the dominant threat actor exploiting a series of zero-day vulnerabilities in SonicWall SMA 1000 VPN appliances. Since the beginning of August 2026, the group has been aggressively… The Hacker News · Aug 3, 2026 High CVE-2026-15409CVE-2026-15410AUU.UAzero-dayvpnransomware
vulnerability Recent SonicWall Vulnerabilities Exploited in Ransomware Attacks The INC Ransomware group has been aggressively exploiting two vulnerabilities in SonicWall’s SMA1000 secure remote access appliances to deploy ransomware, targeting organizations across multiple countries. These vulnerab… SecurityWeek · Aug 3, 2026 High CVE-2026-15409CVE-2026-15410USAUUAvulnerabilityransomwarezero-day
threat-intel Russia accuses Telegram founder of aiding terrorism, seeks international arrest Russia has formally accused Telegram founder Pavel Durov of aiding terrorism, seeking an international arrest warrant due to allegations that the messaging app was used by Ukrainian intelligence to organize terrorist att… The Record · Jul 29, 2026 High RUUKFRrussiatelegramukraine
threat-intel Russia Charges Telegram Founder Pavel Durov With Aiding Terrorist Activity Russia has charged Telegram founder Pavel Durov with aiding terrorist activity, alleging that the platform was used by Ukrainian special services and terrorist organizations to plan attacks and facilitate cybercrime with… The Hacker News · Jul 29, 2026 High RUUArussiaukraineintelligence
threat-intel Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets Russian state-sponsored threat actors, dubbed ‘Laundry Bear,’ have been exploiting a zero-day vulnerability (CVE-2025-66376) in Zimbra Collaboration Suite to target Western governments and enterprises, including US and U… Dark Reading · Jul 23, 2026 High CVE-2025-66376NLUSUAzimbraxssphishing
threat-intel Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine Russian intelligence services are systematically exploiting internet-connected security cameras across Europe and Ukraine to gather military intelligence, including tracking military transport routes and targeting Ukrain… The Hacker News · Jul 20, 2026 High CVE-2016-7407CVE-2021-39275NLUAcameravulnerabilityespionage
threat-intel Zelensky appoints Ukraine's acting security service chief as acting defense minister Volodymyr Zelensky has appointed Yevhenii Khmara, a former head of Ukraine's SBU and a veteran of long-range strike operations, as Ukraine's acting defense minister following a government reshuffle and widespread protest… The Record · Jul 17, 2026 Info UAukrainedefenseintelligence
threat-intel Ukrainians rally against dismissal of tech-minded defense minister Fedorov Ukrainian citizens have taken to the streets to protest the dismissal of Defense Minister Mykhailo Fedorov, who was a key figure in integrating drone technology and digital innovation into Ukraine’s military and combatin… The Record · Jul 16, 2026 Medium UAukrainedefensedigitalization
threat-intel Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware This article details a new phishing and malware tactic called "phantom squatting," where large language models (LLMs) generate non-existent domain names that attackers quickly register and use to host malicious content.… The Hacker News · Jul 1, 2026 High USUAEUllmphishingdomain squatting
threat-intel Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse The Gamaredon APT group continued its aggressive cyberattacks against Ukraine throughout 2025, utilizing a range of new malware and exploiting vulnerabilities to steal sensitive information. The group expanded its tactic… The Hacker News · Jun 29, 2026 High CVE-2025-8088RUUAspear-phishingpersistencecloud-services
ransomware Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered A coordinated international law enforcement operation, involving Bitdefender, Bitsight, ESET, Microsoft, and Europol, successfully disrupted the Amadey and StealC malware networks, recovering 27 million stolen credential… The Hacker News · Jun 24, 2026 High NLCADEmaascredential theftransomware
data-breach Third DraftKings Hacker Sentenced to 18 Months in Prison A third individual, Nathan Austad, has been sentenced to 18 months in prison for his involvement in a 2022 hacking attack against DraftKings. The attack, utilizing credential stuffing, compromised over 60,000 DraftKings… SecurityWeek · Jun 24, 2026 High USALUAcredential stuffingonline gamblingcybercrime
malware New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer A new malware loader, dubbed OXLOADER, is being used to distribute the CastleStealer information stealer through malicious Google Ads. The campaign, codenamed REF8372, leverages deceptive advertising and PowerShell execu… The Hacker News · Jun 22, 2026 Medium RUUAgoogle adsmalware loadercastlestealer
