Storm-3068 Steals Kubernetes Credentials via Microsoft Azure DevOps
After a password reset, Storm-3068 used an authorized Azure DevOps pipeline to collect Kubernetes credentials. Trace pipeline changes and restrict resource access.
Read article →threats
Threat actors, malware campaigns, phishing, exploitation, and incident activity.
Zimbra Mail Clusters Face Secret Theft After Server Intrusions
Microsoft traces a mail-server intrusion from an optional SNMP notification path to root persistence, shared authentication secrets and peer mailbox nodes.
Read article →
Antino Backdoor Uses Microsoft 365 for Espionage Tasking
Talos traces a phishing-to-Windows backdoor chain affecting Asian institutions. Hunt the script host and sideloaded DLL, then restrict script execution.
Read article →
CISA Flags Exploited SharePoint Code Injection for Authorized Users
Three on-premises SharePoint editions have affected build ranges. Match each server to its edition's update threshold and triage suspected compromise.
Read article →
NetScaler Intruders Hide Web Shells Behind Icons and Tunnel Into Networks
Mandiant traces exploited NetScaler packet-engine crashes to disguised PHP shells and an internal proxy. Hunt the config edits and appliance egress, then patch both flaws.
Read article →
ShinyHunters Bypass PeopleSoft WAF Rules and Plant Web Shells
An encoded request reaches PeopleSoft's vulnerable EMHub servlet past literal path filters. Patch PeopleTools and search every WebLogic node for encoded paths and new JSPs.
Read article →
Check Point Management Servers Face Script-Upload Attacks
Check Point reports customer attacks through an unauthenticated management-server flaw. Match Jumbo Hotfix takes, restrict TCP/19009 and inspect CPM logs.
Read article →
Attackers Exploit Two NetScaler Flaws That Permit Code Execution
CISA lists two exploited NetScaler flaws. Match ADC and Gateway builds to their release branches, then preserve evidence on appliances suspected of compromise.
Read article →
Storm-3168 Deletes Azure Storage Accounts With Stolen Service Principals
Two compromised service principals drove a rapid Azure deletion campaign. Trace their ARM operations, rotate exposed secrets and verify recovery-resource locks.
Read article →
Sogou's Link Handler Let UNC3569 Install GRAYRABBIT
A crafted Sogou URI reached an old, unsandboxed Chromium renderer. Verify the fixed build, then hunt the process, file, and network chain.
Read article →
BlueMoon Exploit Kit Breaks Out of Chrome to Deploy Espionage Malware
Four espionage groups used a shared Chrome-to-Windows exploit chain. Build checks show current exposure; campaign artifacts support a separate compromise hunt.
Read article →
RubyDoc Builds Let Malicious Gems Run Code on Shared Servers
More than 100 malicious gems used RubyDoc documentation builds to execute supplied code. Maintainers should review package and account changes tied to legacy API keys.
Read article →
Attackers Exploit ScreenConnect Flaw to Run Files Without Host Approval
CISA confirms exploitation of CVE-2026-84869. ScreenConnect clients before 26.6.5 can transfer and run files through active sessions without authorization or host confirmation.
Read article →Showing 40–52 of 156