Threat Intelligence
Latest APT activity, actively exploited CVEs, and curated threat intelligence sources.
Hand-curated · Last updated
Latest APT activity, actively exploited CVEs, and curated threat intelligence sources.
Hand-curated · Last updated
Curated with multi-source verification. Every card links to the primary source; strong claims (attribution, in-the-wild status) carry corroborating references. The full, filterable feed lives in the APT Encyclopedia.
GTIG and Mandiant say a suspected PRC-nexus actor has exploited CVE-2026-102764, an unauthenticated file-upload / auth bypass in BeyondTrust Remote Support ≤ 26.2.3, since 29 August. Post-exploitation runs on the appliance itself: the SAWFLY PHP webshell (mangoapi.php), a SUID copy of /bin/sh saved as /usr/bin/dbus-authd, the vault dumped with the built-in bt-secrets CLI, persistent passwordless sudo and wiped logs. A compromised admin's Jump Item rights were then widened to reach downstream endpoints, with traffic tunnelled through BARECLAW, a SOCKS5-over-WebSocket proxy hidden behind a modified HAProxy route. BeyondTrust rates the attribution moderate to high confidence. Patch per BT26-05; KEV since 16 Oct.
Volexity watched UTA0576 chain CVE-2026-104935 (auth bypass in welcome.cgi plus a race-condition RCE in wu.cgi) with a local privilege escalation that still has no CVE or fix. The actor re-exploited the box for every command and kept its Python and Perl tooling in memory. From the VPN it pulled LDAP service-account credentials, sniffed NTLM hashes and cleartext logins with a renamed tcpdump (dsstatmond), read LAPS passwords and BitLocker keys from AD, then Kerberoasted. It edited audit.log; Ivanti's Integrity Checker saw nothing. Volexity leans criminal (low confidence) and thinks an LLM helped write the exploit (medium). Upgrade to 22.8R2.5, 25.1.1.2 or 25.1.3.x and hunt for credential reuse.
Genians documents Kimsuky phishing Ukrainian diplomacy and security specialists, with shared infrastructure also aimed at Japanese- and Korean-speaking North Korea researchers. The opener is clean: a fake KCSCON 2026 speaker invite or a request to review a paper on Russia–North Korea military ties. Only after a reply does the payload arrive as .pdf.lnk, VBE or a fake zoominstaller.exe, loading PowerShell from INI files and adding scheduled tasks named like Google and OneDrive updaters. GitHub, GitLab and Codeberg carry both payloads and stolen data. Genians reads the target as intelligence on North Korean troop losses and POW handling. Most attempts failed.
DOJ and FBI seized domains behind two platforms run by Beijing contractor Integrity Technology Group. MicroScan is a 1,300-script scanning and exploitation framework partly driven through a Mirai-variant botnet; it hit a South Carolina power utility, airports in Japan and Poland, and Taiwanese gas and power firms. FishHub handles phishing and malware delivery, with about 20 Taiwanese universities confirmed as victims. Joint advisory AA26-281A (CISA, FBI, NSA and seven partner agencies) covers EBurst spraying against Exchange, EWS mailbox theft, DCSync and SoftEther VPN persistence, plus a run of old CVEs; five went into KEV the same day. No indictments.
Two hijacked maintainer accounts (including the owner of Uber's athenadriver and the author of pyxel) pushed .github/workflows/security-audit.yml to about 345 repositories in two automated sweeps. Besides the usual Actions secrets (PyPI, crates.io tokens), this version greps the working tree and the full git history for 13 credential formats, AWS, GCP, GitHub and GitLab PATs, Slack, SendGrid and Anthropic / OpenAI / OpenRouter keys among them, and POSTs the hits in cleartext to 193.32.204[.]199. Socket later counted 500+ affected accounts. Any key that ever touched a commit in those repos should be treated as burned.
CVE-2026-105133 (auth bypass in checkSysPwd) plus CVE-2026-105134 (command injection in the Replication Receiver API) give unauthenticated SYSTEM on AhsayCBS, a backup server common at MSPs. Huntress saw five victims from 7 Oct: JSP webshells, a rogue replication receiver and XMRig running as a fake MicrosoftEdgeUpdateSvc with WinRing0x64.sys, hidden whenever Task Manager opens. Bitdefender handled three more intrusions that installed OpenSSH for persistence. Nobody has encrypted yet, but a foothold on the backup server is what a ransomware crew looks for first. The first patches were incomplete, so go to v10.3.4.45 / v9.15.2.70.
SoftBank's IDC Frontier isolated IDCF Cloud East Japan Region 1 after an intrusion that began around 03:40 JST on 7 Oct, and suspended customer consoles in every region. 495 companies and local governments are affected, including prefectural websites and JR East's email. IDCF says some server data may only come back from customers' own backups. An unverified image on X claims 239 hypervisors and 550,000+ snapshots were hit; IDCF has not confirmed it and no group has claimed the attack. Recovery is ongoing (sixth update, 18 Oct).
Citrix bulletin CTX697096 patches CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5) after watchTowr flags active exploitation; CISA adds both to KEV the same day. Mandiant / GTIG attribute the campaign to a suspected state-backed actor using two unseen tools: WHIPSHOT, a PHP webshell disguised as a Debian package reading Base64 commands from sequential HTTP headers over loopback, and SLAPSHOT, a Python TCP tunneller for internal reconnaissance. CVE-2026-88772 exploited since at least early September; dozens of orgs across government, finance, education, telecoms, legal/professional services in North America and Europe.
Microsoft Threat Intelligence publishes a technical walkthrough of NeedyMantis, a modular framework seen in targeted intrusions at telecoms, universities, medical nonprofits, intergovernmental organisations and government contractors since at least Oct 2025. DLL sideloading against signed binaries (poedit.exe, curl.exe, vim.exe, tvnserver.exe), C2 over HTTPS + WebSockets with downloadable plugin modules. Microsoft tracks the DAEMON Tools supply-chain operator as Storm-3069 and assesses the activity originates in China, though not yet tied to a specific nation-state actor; signed, trojanised DAEMON Tools Lite installers were seeded from 8 Apr 2026 per Kaspersky.
Microsoft Security Research links Storm-3168 to JADEPUFFER, the agentic ransomware Sysdig first documented in July 2026. An employee had posted a service principal's client ID, secret and tenant ID in a public GitHub issue and later redacted it; the credential stayed retrievable through the issue's edit history. One principal performed 300+ reads over 15 h 30 m; a second executed 150+ destructive or credential operations in ~35 m, including 100+ Storage Account deletions compressed into a 7-minute window. On a failed first login the agent analysed the error and recovered access in 31 seconds. No geographic attribution.
On Friday 18 Sep, ShinyHunters abuse an unauthenticated file-upload flaw in Grav (the flat-file CMS running Cl0p's leak site), post a pwn3d text file, then replace the home page with an ASCII Umbreon. They claim to have exfiltrated source code, server logs and the onion private keys, demanding an eight-figure bitcoin ransom. Motive: ShinyHunters say the Oracle E-Business Suite zero-day (CVE-2025-61882) Cl0p used in its October 2025 extortion wave was originally theirs, leaked by a member of the Scattered Lapsus$ Hunters umbrella and resold to a Cl0p affiliate. BleepingComputer broke the story but could not independently verify the keys / source-code claims.
A private researcher reported CVE-2026-85046 on 4 Aug. The Chromium fix landed on 7 Aug. Chrome stable did not ship it until 3 Sep. Between those two dates, five clusters (TA412 (APT31/JungleBamboo), UTA0560, UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket, most with a suspected China nexus) all deployed the same three-CVE chain, V8 type confusion → WebAssembly sandbox escape (CVE-2026-87491) → Windows ALPC LPE (CVE-2026-85880), with byte-for-byte identical shellcode. Five distinct post-exploitation branches, including a Chrome extension (LONGTALE / GemStone) that walks around Secure Preferences hardening. Full technical walk on the blog.
Operation Dream Job came back carrying CVE-2026-68820, a use-after-free race in afd.sys exploited in the wild for five weeks before the August Patch Tuesday fix. Chain: SEO-poisoned fake vendor sites → trojanized MuPDF viewer → MISTPEN downloader riding the Microsoft Graph API → SYSTEM → FudModule 3.1, which blinds 94 ETW providers and resets Smart App Control's policy state. Defence and aerospace targets in France, Germany, India and Brazil. Full technical breakdown on the blog.
JFrog patched CVE-2026-82329 on Aug 28; by Sep 1 watchTowr was observing attackers minting administrator tokens on default-configuration self-hosted instances, then enumerating users, groups, credentials and federated access to decide whether the environment was worth going deeper into. SaaS is unaffected. An artifact repository is a build-pipeline root of trust, so admin there is downstream code execution everywhere.
Same playbook as MOVEit and Cleo, new target: CVE-2026-12569 in PTC Windchill and FlexPLM, exploited as a zero-day from early June. The chain pairs a pre-auth information disclosure in the FlexPLM WSDL endpoint with a flaw in the Windchill login servlet for unauthenticated RCE, then drops hex-named JSP webshells under /Windchill/login/. Shell, Philips, Fiserv, Zebra and Largan Precision are among those named on the leak site. PLM systems hold product designs, so the exfil target is engineering IP, not customer records.
Darktrace tracked a China-nexus campaign across APJ finance and sports targets using DLL sideloading against legitimate binaries (biz_render.exe, dfsvc.exe) to load a .NET RAT speaking a custom DMTP protocol. Persistence via registry plugin storage plus COM object registration; the framework self-updates every five minutes from icloud-cdn[.]net, AES-decrypting a payload straight into Assembly.Load(). C2 domains impersonate CDNs. A near-complete emulation target: ~12 mapped techniques, no exploit required.
Mandiant's APTnn/FINnn numbering and TAG's separate identifiers merge into one scheme: a memorable first word plus a category word: CASTLE (China), RELIC (Russia), NEPTUNE (North Korea), ION (Iran), COMET (cybercrime). APT44 → SANDWORM RELIC, APT41 → SPIRE CASTLE, FIN7 → WILD COMET. Old names stay searchable and UNC survives for unattributed clusters. Practical impact: actor names are aliases, technique IDs are the stable key.
Confirmed in-the-wild activity
Q3 2026
146 ransomware brands were active as of June 2026, 61 of them new in the preceding year, so the long tail is now most of the problem. Emulate the shared playbook, not the brand.