Precursor Intelligence
Threat News
Latest cyber threat intelligence, breaches and exploitation
98 stories
Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password
Red Hat disclosed a critical vulnerability in Keycloak's reset-credentials flow that allows a remote unauthenticated attacker to bypass the email verification step and reset the password for any user account in any realm.
Trend Micro ZDI: Windows Shell Link zero-day exploited by 11 state-backed groups since 2017
Trend Micro's Zero-Day Initiative disclosed a new Windows Shell Link (.lnk) zero-day (ZDI-CAN-25373) exploited in the wild by 11 state-backed groups since 2017, which Microsoft declined to patch as 'not meeting the bar servicing'.
Sophos X-Ops: 34 Confirmed Cases of Attackers Faking Claude, ChatGPT, and Copilot to Drop Malware
Sophos X-Ops analyzed 34 confirmed incidents where attackers spoofed Claude, ChatGPT, and Copilot interfaces to deliver malware through malvertising and infostealer payloads.
Russian State Actors Exploit Exposed IP Cameras to Track NATO Troop Movements in Ukraine
The Netherlands' AIVD and MIVD released a joint advisory warning that Russian state actors are systematically exploiting publicly exposed IP cameras to track NATO troop and supply movements in the ongoing Ukraine war.
Fancy Bear AI-Enabled Attacks Surge 89% in CrowdStrike 2026 Report
CrowdStrike's 2026 Global Threat Report shows Fancy Bear (APT28) AI-enabled adversary activity up 89% year-over-year, eCrime average breakout time at 29 minutes, and GenAI prompt injection confirmed at 90+ organizations.
Aikido reproduces OpenClaw's autonomous hack of an Australian gym booking system with Claude Opus 4.6
Aikido Security built a synthetic Docker environment for an Australian gym booking system and ran OpenClaw v2026.4.1 on Claude Opus 4.6, which successfully exploited the booking flaw in 9/10 runs.
Palo Alto Unit 42: 405 AI-enabled malware samples show 12 in production
Palo Alto Networks Unit 42 analyzed 405 AI-enabled malware samples and found the space is dominated by PoC and researcher code, with only 12 samples hitting production endpoints across five distinct malware families.
Palo Alto Unit 42 Breaks Down ChainDrop: Self-Propagating npm Worm Infects 400+ Packages
Palo Alto Networks Unit 42 published a research report on the ChainDrop npm worm, a self-propagating supply-chain attack that compromised 400+ packages including keyv and cacheable-request by trojanizing the maintainer's monorepo and using stolen credentials to backdoor all co-owned packages.
Storm-1175 deploys new StormEncryptor ransomware via N-central NCM auth bypass
Microsoft Threat Intelligence identifies a new StormEncryptor ransomware strain deployed by the China-based Storm-1175 actor, which uses CVE-2026-18577 in N-central NCM for initial access and moves from compromise to encryption within days.
LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay
LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.
Gen Digital Researchers Unveil WordlistLoader and SynkLoader Malware Loaders for ClickFix Infostealer Delivery
Gen Digital researchers identified two new malware loaders, WordlistLoader and SynkLoader, that deliver infostealers and phishing credentials through the ClickFix technique and are sold to ransomware affiliates.
ClearFake Drops Amatera Stealer via WordlistLoader and SynkLoader on Ethereum
ClearFake's new WordlistLoader and SynkLoader loaders deliver Amatera stealer to Windows targets through ClickFix-style social engineering, with C2 traffic routed through EtherHiding on Ethereum smart contracts.
Penta Security: South Korean Startup Platform Returns Encryption Key in Same API Response as Encrypted Data
A government-backed South Korean startup support platform leaked personal data for startup founders and business owners because its API returned the encryption key alongside the encrypted payload, a finding from Penta Security's analysis.
274 Zimbra Servers Compromised in the Wild via CVE-2026-73570
Shadowserver found 274 internet-facing Zimbra Collaboration Suite servers compromised in-the-wild via CVE-2026-73570, an unauthenticated OS command injection in the zimbra-snmp package that lets attackers execute arbitrary commands as the zimbra user via crafted SMTP requests.
StormEncryptor ransomware deployed via N-central auth-bypass CVE-2026-18577
A former Medusa affiliate (Storm-1175) is actively deploying StormEncryptor ransomware through an incomplete patch for CVE-2026-18556 in N-able N-central, allowing unauthenticated remote attackers to bypass authentication and take over the RMM server to reach managed endpoints.
95 TB KnownSec leak exposes 12,000+ classified docs, state tools, and global target lists
A 95 TB leak from Chinese cybersecurity firm KnownSec exposes 12,000+ classified documents, state-backed RATs, AI-driven exploits, and a target database covering 24,241 organizations with 378M IPs and 3.5M domains across 20 countries.
MuddyWater Disguises Chaos Ransomware as Decoy in Microsoft Teams Vishing Attacks
MuddyWater used Chaos ransomware as a decoy in a Microsoft Teams vishing campaign to harvest credentials, establish persistence, and exfiltrate data before attempting extortion, per Rapid7's May 2026 analysis.
Head Mare Exploits Three Zero-Days to Trojanize TrueConf, Atlassian Rovo, and Progress LoadMaster
The Head Mare APT group is actively exploiting three zero-day vulnerabilities in Atlassian Rovo, Progress LoadMaster, and Metabase, with Progress LoadMaster CVE-2026-8037 now on CISA KEV after 792 observed exploitation attempts.
Fidelis Security Discloses wp2shell Attack Chain for Unauthenticated WordPress RCE
Fidelis Security has disclosed the wp2shell attack chain, a two-CVE exploit that lets unauthenticated attackers achieve remote code execution on WordPress Core via the REST API batch endpoint and a WP_Query SQL injection in the author__not_in parameter.
UNC6671 Rebrands as Redact, Pink, Helix, and Falcon After Millions in Vishing Extortion
UNC6671, a data extortion group that rebranded from BlackFile in May 2026, has expanded into four new leak site brands — Redact, Pink, Helix, and Falcon — after raking in millions in extortion via vishing campaigns targeting enterprise employees.
Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs
Silent Ransom Group has published data from 64 law firms on its data leak site, including Troutman Pepper Locke, exposing tens of thousands of client SSNs and privileged legal documents.
CISA KEV adds N-Able N-Central RCE with 3-day federal deadline
CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog for N-able N-central, an unauthenticated authentication bypass that grants remote administrative access on versions through 2026.1, with a 3-day federal deadline and active in-the-wild exploitation.
Forescout researchers identify new ransomware coterie 'Mora_001' running 'SuperBlack' built from leaked LockBit 3.0
Forescout researchers have identified a new ransomware coterie named Mora_001, active since January 2026, that runs SuperBlack ransomware built from leaked LockBit 3.0 source code and exploits two Fortinet authentication bypass flaws (CVE-2024-55591 and CVE-2025-24472) to gain super-admin access on FortiOS and FortiProxy appliances.
Dark Project ransomware group hits Brainhunter Companies LLC and Brainhunter Systems Ltd.
Dark Project, a ransomware group first seen in April 2026, has published Brainhunter Companies LLC and Brainhunter Systems Ltd. as its latest victims, bringing its total to 19 known targets with 9 active extortion links on ransomware.live.
Showing 24 of 98