threat-intel Dark Caracal Adds New Malware to Cyber Espionage Arsenal The Dark Caracal cyber-espionage group, linked to Lebanon, has added a new modular malware framework called GoCaracal to its arsenal. This framework, developed since 2026, is used for data theft, maintaining persistent access, and intelligence gathering, and is being deployed alongside existing malware like Bandook. Th… Dark Reading · 4d ago High LBVEBRcyber-espionagedata theftmalware
threat-intel Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler Iranian state-sponsored hacking group Nimbus Manticore (linked to Charming Kitten) has expanded its toolset with a TWOSTROKE-like backdoor and SSH tunneling utility, furthering its espionage activities targeting defense,… The Hacker News · 4d ago High IRMIEUsshbackdoorc2
threat-intel Ukraine to give Britain access to battlefield data to train AI Ukraine is sharing a massive dataset of battlefield imagery and video with the United Kingdom to train AI systems for defense purposes. This partnership, part of a broader effort to utilize war-generated data, will allow… The Record · 5d ago Medium UKUNRUaibattlefield dataukraine
vulnerability Exploited Zimbra Flaw Highlights Shrinking Window to Patch A critical vulnerability in Zimbra Unified Communications Suite (ZCS) is being aggressively exploited, prompting CISA to issue a three-day deadline for federal agencies to patch. The flaw, CVE-2026-73570, allows unauthen… Dark Reading · 6d ago High CVE-2026-73570CVE-2026-73750CVE-2025-66376PORULIpatchingvulnerabilityremote code execution
threat-intel Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight Multiple banking trojans – Manic, Grandoreiro, and ToxicPanda 2.0 – are actively targeting users worldwide, with a particular focus on financial institutions in Europe, Latin America, and increasingly, Russia. These troj… SecurityWeek · Aug 22, 2026 High BRUKRUbanking trojanmobile malwaresupply chain
vulnerability Hackers Target Zimbra Servers in Active Exploitation Campaign A recently patched Zimbra vulnerability (CVE-2026-73570) is currently being actively exploited by threat actors, primarily linked to Russian and Chinese state-sponsored hackers. Attackers are leveraging this flaw to gain… SecurityWeek · Aug 20, 2026 Critical CVE-2026-73570PLzimbravulnerabilitysnmp
threat-intel Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices Manic, a sophisticated Android malware, is actively targeting financial institutions and government services across Ukraine, Russia, Central and Western Europe, and the U.K. This malware combines banking malware capabili… The Hacker News · Aug 20, 2026 High UKRUCEandroidbanking malwarespyware
threat-intel China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud The China-linked threat actor Jewelbug, operating as a ‘hack-for-hire’ group, is engaged in both sophisticated government espionage targeting nations across the Middle East, Southeast Asia, and South Asia, and cryptocurr… The Hacker News · Aug 14, 2026 High CHMISOespionagecryptocurrencyhack-for-hire
threat-intel 'Jewelbug' APT Balances State Espionage & Cryptocurrency Theft The ‘Jewelbug’ APT group, operating out of China, balances state-sponsored espionage and cryptocurrency theft, targeting governments, military organizations, and corporations globally. They utilize a custom command-and-c… Dark Reading · Aug 13, 2026 High CHMISOcyber espionagecryptocurrency theftnation-state
threat-intel Water utilities group partners with DEF CON offshoot for Water Watch Center The National Rural Water Association (NRWA) has partnered with DEF CON Franklin to establish the Water Watch Center (WWC), a program designed to provide cybersecurity services to underfunded water and wastewater systems… The Record · Aug 7, 2026 High IRUNcybersecuritywater systemsoperational technology
threat-intel Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine Russian intelligence services are systematically exploiting internet-connected security cameras across Europe and Ukraine to gather military intelligence, including tracking military transport routes and targeting Ukrain… The Hacker News · Jul 20, 2026 High CVE-2016-7407CVE-2021-39275NLUAcameravulnerabilityespionage
threat-intel NATO logistics, Ukrainian troops are top subjects of Russian camera hacks, advisory says Russian state-backed hackers are systematically compromising internet-connected security cameras across Europe and Ukraine to gather intelligence on NATO military logistics and identify Ukrainian troops for targeting. Th… The Record · Jul 14, 2026 High NEUKCHcyber espionagerussian hackingmilitary intelligence
threat-intel Valarian Raises $50 Million for Sovereign Infrastructure Control Layer Valarian, a UK-based company focused on sovereign infrastructure control, has secured $50 million in Series A funding to bolster its platform, ACRA. ACRA is designed to provide a layer of control and governance for AI mo… SecurityWeek · Jul 14, 2026 Medium UKsovereigntydata-controlkubernetes
threat-intel China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors A China-linked advanced persistent threat group, UAT-7810, has expanded its arsenal with new backdoors, including LongLeash, DogLeash, and JarLeash, as part of a long-running espionage campaign. The group primarily targe… SecurityWeek · Jul 8, 2026 High CVE-2020-22653CVE-2020-22658CVE-2023-25717CNbackdooraptespionage
malware USB drives carrying China-linked malware infected Japanese military networks for nearly a year Japanese military networks, specifically the Ground Self-Defense Force (JGSDF), were compromised by a year-long campaign utilizing counterfeit USB drives loaded with malware. The incident, discovered in February 2025, in… Graham Cluley · Jun 30, 2026 High JACHusb drivesmalwarejapan
threat-intel US posts $10 million reward over Russian cyber campaign targeting Signal, WhatsApp The United States government is offering a $10 million reward for information leading to the identification of Russian cyber groups involved in targeting Signal and WhatsApp accounts. These groups, UNC5792 and UNC4221, a… The Record · Jun 29, 2026 High USUKRUsocial engineeringencryptionespionage
threat-intel ⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More This week’s security news highlights several concerning vulnerabilities and attacks, including a DirtyClone Linux kernel flaw, exploitation of PTC Windchill vulnerabilities, and the emergence of new malware like Gaslight… The Hacker News · Jun 29, 2026 High CVE-2026-43503CVE-2026-12569CVE-2026-47729UKRUlinuxkernelai
threat-intel Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse The Gamaredon APT group continued its aggressive cyberattacks against Ukraine throughout 2025, utilizing a range of new malware and exploiting vulnerabilities to steal sensitive information. The group expanded its tactic… The Hacker News · Jun 29, 2026 High CVE-2025-8088RUUAspear-phishingpersistencecloud-services
threat-intel Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets Russia-linked APT Turla has been deploying a new .NET backdoor, dubbed StockStay, to conduct ongoing cyber espionage against Ukrainian government and military organizations, as well as entities with interests in Italian… SecurityWeek · Jun 26, 2026 High CVE-2025-8088UKRUITespionagebackdoorphishing
threat-intel Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks Google Threat Intelligence Group (GTIG) has identified a new backdoor, STOCKSTAY, developed and deployed by the Russian state-sponsored threat actor Turla. This multi-component backdoor, built using .NET and leveraging a… The Hacker News · Jun 26, 2026 High CVE-2025-8088UKITNEespionagebackdoorrussia
