T1012 - Query Registry is a mitre_attack tracked across 7 threat clusters and 8 intelligence report mentions on ThreatCluster. First observed April 15, 2026; most recent activity June 11, 2026.
A sophisticated backdoor malware named Firestarter has been discovered on Cisco Firepower devices, attributed to the state-sponsored threat actor UAT-4356. The malware exploits two vulnerabilities, CVE-2025-20333 and…
From mid-2024 to early 2026, the Vietnam-aligned APT group OceanLotus has intensified its focus on domestic espionage, utilizing the SPECTRALVIPER backdoor in two major campaigns. The first campaign targeted a…
Researchers at SentinelOne have uncovered a malware framework named fast16, which dates back to 2005 and predates the infamous Stuxnet worm by five years. Fast16 is designed to subtly corrupt high-precision mathematical…
On March 22, 2026, Huntress identified a campaign involving signed adware from Dragon Boss Solutions LLC that disabled antivirus protections on over 23,500 endpoints across 124 countries. The software, marketed as…
The InstallFix campaign targets users by creating fake installation pages for Anthropic's Claude AI, tricking them into executing malware. This sophisticated social engineering tactic exploits the growing reliance on AI…
In May 2026, a malspam campaign utilizing the Google DoubleClick domain was identified, delivering the DesckVB remote access trojan (RAT). The attack begins with an HTML email attachment that redirects users through…
Threat actors are exploiting ChatGPT's content-sharing feature to deliver malware through a campaign dubbed 'LLMShare.' This attack involves creating fake outage pages on the legitimate chatgpt.com domain, tricking…