Cyber Security Intelligence
Real-time aggregation of the most critical cybersecurity news, vulnerabilities, and threat warnings.
Latest Intel Feed
New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining
A threat actor has been selling access to a new Windows botnet that relies on AI to maintain persistence on infected hosts, Qrator reports. Dubbed x47.c , it is advertised by a threat actor named WraithTools as...
GitHub Actions re-enabled with Mini Shai-Hulud payload still active
Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code. After being...
ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw
The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced through an unpatched Grav CMS flaw that BleepingComputer has learned is an...
In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure
SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape. This curated...
New Carbonato malware uses AI agents to hijack exposed Docker hosts
A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. The malware features worm-like capabilities and was discovered in an...
MacSync malware uses public iCloud calendars to deliver new payloads
A new variant of the MacSync info-stealing malware targeting macOS systems now uses public iCloud calendar events to deliver fresh payloads. MacSync is a Swift-based malware that emerged in April 2025 and has been...
3 Cyber Threats That Defined the Summer of 2026
Summer 2026 was marked by a number of cyber threats that fundamentally changed how enterprise defenders view the current threat landscape, but three incidents stood out: Ransomware halted production at Coca-Cola...
US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks
Karen Vardanyan, a 35-year-old Armenian national, has been sentenced to prison by a US court for his role in Ryuk ransomware attacks, the Justice Department announced this week. Vardanyan was charged by a grand jury in...
New RemControl Android banking malware targets users in Europe and Canada
A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application. Although the infrastructure has been active since at...
Ryuk ransomware operator gets 2-year sentence after extorting victims for $1.2 million
Image: Soumil Kumar / Pexels Ryuk ransomware operator gets 2-year sentence after extorting victims for $1.2 million An Armenian national was sentenced to two years in U.S. federal prison after pleading guilty in July to...
Ryuk ransomware operator sentenced to 2 years in prison
A 35-year-old Armenian national was sentenced to two years in prison for his involvement in a series of Ryuk ransomware attacks while living in Ukraine and Russia in 2019 and 2020, the Justice Department said Tuesday....
Ryuk ransomware member sentenced to 24 months in prison
An Armenian man was sentenced to 24 months in prison and 3 years of supervised release for hacking U.S. companies and encrypting their systems in Ryuk ransomware attacks. 35-year-old Karen Serobovich Vardanyan (also...