Cyber Security Intelligence
Real-time aggregation of the most critical cybersecurity news, vulnerabilities, and threat warnings.
Latest Intel Feed
Warlock Ransomware Hits Large Spanish, Portuguese Orgs
A Chinese ransomware outfit is exploiting Microsoft technologies to extort large and critical organizations in the Spanish- and Portuguese-speaking world. The Warlock ransomware group — tracked by Symantec as "Longlegs"...
Russian hackers Star Blizzard expand targeting, change up tactics to reach Ukraine and beyond
A group of Russian government hackers is refining its attacks to make it easier to eavesdrop on victims and significantly expand its targets among governments, think tanks and nonprofits around the world, with an...
Treasury Blacklists Most-Wanted ATM Malware Developer and His Network
The US Treasury Department has sanctioned the alleged developer of malware used in ATM jackpotting attacks linked to Tren de Aragua (TdA), along with members of his network and two Mexico-based companies. Anibal...
Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader
Europol says a 16-year-old is believed to be the administrator and main operator of KillSec, a ransomware group linked to roughly 1,000 suspected attacks worldwide. The teen was identified in Operation KillSwitch , an...
Russian state hackers use new RedFlick technique to push malware
The Russian state actor Star Blizzard has been using a new malware installation tactic dubbed “RedFlick” to deploy its signature CosmicPulse backdoor. Although the tactic is not a new cybersecurity technique, it is a...
Police dismantle KillSec ransomware gang allegedly led by 16-year-old
An international law enforcement operation dubbed “Operation KillSwitch” seized the KillSec ransomware gang’s data leak site and servers, led to three arrests, and identified a 16-year-old as the group’s alleged...
Star Blizzard refines phishing and malware delivery with the RedFlick technique
Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a...
'NeedyMantis' Provides Long-Term Access to Compromised Networks
A previously unidentified malware family is giving attackers long-term stealth access to targeted networks once they've already infiltrated a system, revealing a potential blind spot for defenders that tend to focus...
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family observed in a limited number of targeted operations affecting telecommunications organizations, universities, medical...
Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation
Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters . In the days immediately following the...
Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts
A newly discovered Docker botnet is implanting AI agents onto compromised hosts in order to send stolen credentials back to the attackers. ThreatDown researchers recently uncovered Carbonato, a botnet that compromises...
80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking
The summer of 2026 taught the security industry a new phrase: the stolen AI login. In late August, as BleepingComputer reported, Anthropic responded to infostealer-driven hijacking of Claude sessions by signing users...