[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fn0yHDfN1J3xcA4fQlbEi6MM9kOoyAwXFD745GMIgXDA":3,"$frS0DrcdysrdykujDqfgIWxosZcP8B90W7n84hNbeGmc":337},{"articles":4,"total":333,"page":334,"limit":335,"sort":336},[5,22,37,52,67,81,96,109,124,138,152,164,176,191,204,215,230,243,257,271,284,296,307,321],{"slug":6,"title":7,"subtitle":8,"summary":9,"tags":10,"hero_image_url":17,"story_type":18,"created_at":19,"published_at":20,"source_count":21},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","CVE-2026-18963 (CVSS 9.1) in the reset-credentials flow bypasses email verification to force full account takeover.","Red Hat disclosed a critical vulnerability in Keycloak's reset-credentials flow that allows a remote unauthenticated attacker to bypass the email verification step and reset the password for any user account in any realm.",[11,12,13,14,15,16],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a","vulnerability_disclosure","2026-09-30T12:09:12.456253+00:00",null,2,{"slug":23,"title":24,"subtitle":25,"summary":26,"tags":27,"hero_image_url":34,"story_type":18,"created_at":35,"published_at":20,"source_count":36},"trend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-","Trend Micro ZDI: Windows Shell Link zero-day exploited by 11 state-backed groups since 2017","ZDI-CAN-25373 in .lnk files hit by North Korea, Iran, Russia, and China; Microsoft declined to patch as 'not meeting the bar servicing'.","Trend Micro's Zero-Day Initiative disclosed a new Windows Shell Link (.lnk) zero-day (ZDI-CAN-25373) exploited in the wild by 11 state-backed groups since 2017, which Microsoft declined to patch as 'not meeting the bar servicing'.",[28,29,30,31,32,33],"windows","shell-link","zero-day","ZDI","Trend Micro","state-sponsored","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-.png?v=a2818b0e7b","2026-09-30T12:04:13.324344+00:00",6,{"slug":38,"title":39,"subtitle":40,"summary":41,"tags":42,"hero_image_url":48,"story_type":49,"created_at":50,"published_at":20,"source_count":51},"sophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t","Sophos X-Ops: 34 Confirmed Cases of Attackers Faking Claude, ChatGPT, and Copilot to Drop Malware","A year of MR casework (Jul 2025–Jun 2026) shows 34 victims hit via malvertising and infostealers impersonating major AI brands.","Sophos X-Ops analyzed 34 confirmed incidents where attackers spoofed Claude, ChatGPT, and Copilot interfaces to deliver malware through malvertising and infostealer payloads.",[43,44,45,46,47],"The Gentlemen","Sophos X-Ops","AI brand impersonation","malvertising","infostealer","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t.png?v=7a1343b754","campaign","2026-09-30T07:09:51.117027+00:00",4,{"slug":53,"title":54,"subtitle":55,"summary":56,"tags":57,"hero_image_url":64,"story_type":65,"created_at":66,"published_at":20,"source_count":51},"russian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in","Russian State Actors Exploit Exposed IP Cameras to Track NATO Troop Movements in Ukraine","AIVD and MIVD confirm systematic digital espionage via internet-facing IP cameras targeting EU, NATO, and Ukraine.","The Netherlands' AIVD and MIVD released a joint advisory warning that Russian state actors are systematically exploiting publicly exposed IP cameras to track NATO troop and supply movements in the ongoing Ukraine war.",[58,59,60,61,62,63],"Russia","IP Camera","NATO","Ukraine","AIVD","MIVD","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Frussian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in.png?v=74b95987f5","threat_actor_activity","2026-09-30T07:07:04.966623+00:00",{"slug":68,"title":69,"subtitle":70,"summary":71,"tags":72,"hero_image_url":79,"story_type":65,"created_at":80,"published_at":20,"source_count":51},"fancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report","Fancy Bear AI-Enabled Attacks Surge 89% in CrowdStrike 2026 Report","eCrime breakout time drops to 29 minutes and GenAI prompt injection hits 90+ orgs as APT28 scales LLM-powered malware.","CrowdStrike's 2026 Global Threat Report shows Fancy Bear (APT28) AI-enabled adversary activity up 89% year-over-year, eCrime average breakout time at 29 minutes, and GenAI prompt injection confirmed at 90+ organizations.",[73,74,75,76,77,78],"Fancy Bear","APT28","CrowdStrike","LLM malware","GenAI prompt injection","eCrime","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report.png?v=f7ed8c119c","2026-09-29T12:06:38.382267+00:00",{"slug":82,"title":83,"subtitle":84,"summary":85,"tags":86,"hero_image_url":92,"story_type":93,"created_at":94,"published_at":20,"source_count":95},"aikido-reproduces-openclaw-s-autonomous-hack-of-an-australian-gym-booking-system","Aikido reproduces OpenClaw's autonomous hack of an Australian gym booking system with Claude Opus 4.6","The AI agent exploited the booking flaw in 9 out of 10 runs against a Dockerized environment.","Aikido Security built a synthetic Docker environment for an Australian gym booking system and ran OpenClaw v2026.4.1 on Claude Opus 4.6, which successfully exploited the booking flaw in 9\u002F10 runs.",[87,88,89,90,91],"Claude Opus 4.6","OpenClaw","Aikido Security","AI pentesting","gym booking","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Faikido-reproduces-openclaw-s-autonomous-hack-of-an-australian-gym-booking-system.png?v=d25aa9bab9","exploitation","2026-09-28T07:04:35.514964+00:00",11,{"slug":97,"title":98,"subtitle":99,"summary":100,"tags":101,"hero_image_url":107,"story_type":65,"created_at":108,"published_at":20,"source_count":21},"palo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production","Palo Alto Unit 42: 405 AI-enabled malware samples show 12 in production","FunkSec ransomware leads with 7 LLM-assisted variants compiled in six days, while 393 samples remain PoC or researcher code.","Palo Alto Networks Unit 42 analyzed 405 AI-enabled malware samples and found the space is dominated by PoC and researcher code, with only 12 samples hitting production endpoints across five distinct malware families.",[102,103,104,105,106],"AI malware","FunkSec","Palo Alto Unit 42","ransomware","LLM","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production.png?v=efb3f6f578","2026-09-26T12:10:59.266452+00:00",{"slug":110,"title":111,"subtitle":112,"summary":113,"tags":114,"hero_image_url":120,"story_type":121,"created_at":122,"published_at":20,"source_count":123},"palo-alto-unit-42-breaks-down-chaindrop-self-propagating-npm-worm-infects-400-pa","Palo Alto Unit 42 Breaks Down ChainDrop: Self-Propagating npm Worm Infects 400+ Packages","The worm steals npm and GitHub tokens from the keyv maintainer, then auto-republishes every co-owned package with a three-step preinstall hook and Ethereum C2 resolver.","Palo Alto Networks Unit 42 published a research report on the ChainDrop npm worm, a self-propagating supply-chain attack that compromised 400+ packages including keyv and cacheable-request by trojanizing the maintainer's monorepo and using stolen credentials to backdoor all co-owned packages.",[115,116,117,118,119],"ChainDrop","npm","supply-chain","Shai-Hulud","Ethereum C2","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-breaks-down-chaindrop-self-propagating-npm-worm-infects-400-pa.png?v=49478b78c8","supply_chain","2026-09-26T12:08:48.531258+00:00",5,{"slug":125,"title":126,"subtitle":127,"summary":128,"tags":129,"hero_image_url":135,"story_type":136,"created_at":137,"published_at":20,"source_count":36},"storm-1175-deploys-new-stormencryptor-ransomware-via-n-central-ncm-auth-bypass","Storm-1175 deploys new StormEncryptor ransomware via N-central NCM auth bypass","China-based actor shifts from Medusa to a C++-based locker, exploiting CVE-2026-18577 in N-central NCM for initial access.","Microsoft Threat Intelligence identifies a new StormEncryptor ransomware strain deployed by the China-based Storm-1175 actor, which uses CVE-2026-18577 in N-central NCM for initial access and moves from compromise to encryption within days.",[130,131,132,133,134],"StormEncryptor","Storm-1175","N-central NCM","CVE-2026-18577","Medusa","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstorm-1175-deploys-new-stormencryptor-ransomware-via-n-central-ncm-auth-bypass.png?v=316922394f","ransomware_incident","2026-09-26T07:12:34.821288+00:00",{"slug":139,"title":140,"subtitle":141,"summary":142,"tags":143,"hero_image_url":149,"story_type":136,"created_at":150,"published_at":20,"source_count":151},"lockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay","LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay","Gang exploits CVE-2021-36942 on domain controllers after initial access via ProxyShell on Exchange servers.","LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.",[105,144,145,146,147,148],"PetitPotam","NTLM relay","ProxyShell","LockFile","CVE-2021-36942","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay.png?v=3ebd8c1c3f","2026-09-26T07:06:42.867972+00:00",8,{"slug":153,"title":154,"subtitle":155,"summary":156,"tags":157,"hero_image_url":162,"story_type":65,"created_at":163,"published_at":20,"source_count":95},"gen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for","Gen Digital Researchers Unveil WordlistLoader and SynkLoader Malware Loaders for ClickFix Infostealer Delivery","Two new loaders drop infostealers and phishing credentials via ClickFix, sold to ransomware affiliates.","Gen Digital researchers identified two new malware loaders, WordlistLoader and SynkLoader, that deliver infostealers and phishing credentials through the ClickFix technique and are sold to ransomware affiliates.",[158,159,160,161,47,105],"Gen Digital","ClickFix","WordlistLoader","SynkLoader","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for.png?v=ea5de72eef","2026-09-25T12:05:45.613962+00:00",{"slug":165,"title":166,"subtitle":167,"summary":168,"tags":169,"hero_image_url":173,"story_type":49,"created_at":174,"published_at":20,"source_count":175},"clearfake-drops-amatera-stealer-via-wordlistloader-and-synkloader-on-ethereum","ClearFake Drops Amatera Stealer via WordlistLoader and SynkLoader on Ethereum","Two new Windows loaders use ClearFake + ClickFix to deploy Amatera with EtherHiding C2 on Ethereum smart contracts.","ClearFake's new WordlistLoader and SynkLoader loaders deliver Amatera stealer to Windows targets through ClickFix-style social engineering, with C2 traffic routed through EtherHiding on Ethereum smart contracts.",[170,160,161,171,172,159],"ClearFake","Amatera","EtherHiding","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fclearfake-drops-amatera-stealer-via-wordlistloader-and-synkloader-on-ethereum.png?v=9ddcd54bf4","2026-09-25T07:08:58.057093+00:00",7,{"slug":177,"title":178,"subtitle":179,"summary":180,"tags":181,"hero_image_url":188,"story_type":189,"created_at":190,"published_at":20,"source_count":21},"penta-security-south-korean-startup-platform-returns-encryption-key-in-same-api-","Penta Security: South Korean Startup Platform Returns Encryption Key in Same API Response as Encrypted Data","The decryption key ships in the same JSON response as the ciphertext, making the encryption a no-op for any attacker who gets the response.","A government-backed South Korean startup support platform leaked personal data for startup founders and business owners because its API returned the encryption key alongside the encrypted payload, a finding from Penta Security's analysis.",[182,183,184,185,186,187],"Penta Security","South Korea","API","encryption key","data breach","PIPA","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpenta-security-south-korean-startup-platform-returns-encryption-key-in-same-api-.png?v=15d19611aa","breach","2026-09-25T07:03:08.188421+00:00",{"slug":192,"title":193,"subtitle":194,"summary":195,"tags":196,"hero_image_url":202,"story_type":93,"created_at":203,"published_at":20,"source_count":36},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Unauthenticated RCE in Zimbra's SNMP notification handler is being actively exploited against internet-facing servers, with CISA ordering a 3-day patch deadline.","Shadowserver found 274 internet-facing Zimbra Collaboration Suite servers compromised in-the-wild via CVE-2026-73570, an unauthenticated OS command injection in the zimbra-snmp package that lets attackers execute arbitrary commands as the zimbra user via crafted SMTP requests.",[197,198,199,200,201],"Zimbra","CVE-2026-73570","RCE","CISA KEV","Shadowserver","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2","2026-09-24T07:12:41.74195+00:00",{"slug":205,"title":206,"subtitle":207,"summary":208,"tags":209,"hero_image_url":213,"story_type":136,"created_at":214,"published_at":20,"source_count":36},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","StormEncryptor ransomware deployed via N-central auth-bypass CVE-2026-18577","Former Medusa affiliate Storm-1175 exploits incomplete patch to drop ransomware on managed endpoints","A former Medusa affiliate (Storm-1175) is actively deploying StormEncryptor ransomware through an incomplete patch for CVE-2026-18556 in N-able N-central, allowing unauthenticated remote attackers to bypass authentication and take over the RMM server to reach managed endpoints.",[210,133,130,211,212],"N-able N-central","Ransomware","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":216,"title":217,"subtitle":218,"summary":219,"tags":220,"hero_image_url":227,"story_type":228,"created_at":229,"published_at":20,"source_count":36},"95-tb-knownsec-leak-exposes-12-000-classified-docs-state-tools-and-global-target","95 TB KnownSec leak exposes 12,000+ classified docs, state tools, and global target lists","Beijing-based KnownSec contractor's 95 TB internal server dump reveals 12,000+ classified documents, RATs for five platforms, and 24,241 high-priority targets across 20 countries.","A 95 TB leak from Chinese cybersecurity firm KnownSec exposes 12,000+ classified documents, state-backed RATs, AI-driven exploits, and a target database covering 24,241 organizations with 378M IPs and 3.5M domains across 20 countries.",[221,222,223,224,225,226],"KnownSec","China","data leak","ZoomEye","RAT","MSS","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F95-tb-knownsec-leak-exposes-12-000-classified-docs-state-tools-and-global-target.png?v=c7a5a17130","data_leak","2026-09-23T17:10:27.728879+00:00",{"slug":231,"title":232,"subtitle":233,"summary":234,"tags":235,"hero_image_url":241,"story_type":65,"created_at":242,"published_at":20,"source_count":51},"muddywater-disguises-chaos-ransomware-as-decoy-in-microsoft-teams-vishing-attack","MuddyWater Disguises Chaos Ransomware as Decoy in Microsoft Teams Vishing Attacks","Rapid7 attributes a Chaos ransomware intrusion to MuddyWater based on a shared code-signing certificate and infrastructure overlap, with the ransomware used to mask the primary cyber-espionage objective.","MuddyWater used Chaos ransomware as a decoy in a Microsoft Teams vishing campaign to harvest credentials, establish persistence, and exfiltrate data before attempting extortion, per Rapid7's May 2026 analysis.",[236,237,238,239,240],"MuddyWater","Chaos Ransomware","Microsoft Teams","Vishing","Rapid7","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmuddywater-disguises-chaos-ransomware-as-decoy-in-microsoft-teams-vishing-attack.png?v=1010bd2eb1","2026-09-23T17:04:58.902559+00:00",{"slug":244,"title":245,"subtitle":246,"summary":247,"tags":248,"hero_image_url":254,"story_type":18,"created_at":255,"published_at":20,"source_count":256},"head-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog","Head Mare Exploits Three Zero-Days to Trojanize TrueConf, Atlassian Rovo, and Progress LoadMaster","Progress LoadMaster CVE-2026-8037 added to CISA KEV with 792 exploitation attempts; Atlassian Rovo and Metabase also actively exploited in the wild.","The Head Mare APT group is actively exploiting three zero-day vulnerabilities in Atlassian Rovo, Progress LoadMaster, and Metabase, with Progress LoadMaster CVE-2026-8037 now on CISA KEV after 792 observed exploitation attempts.",[249,30,250,251,252,253],"Head Mare","Atlassian Rovo","Progress LoadMaster","Metabase","CVE-2026-8037","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog.png?v=48acc20ab2","2026-09-22T12:04:22.141581+00:00",3,{"slug":258,"title":259,"subtitle":260,"summary":261,"tags":262,"hero_image_url":269,"story_type":18,"created_at":270,"published_at":20,"source_count":51},"fidelis-security-discloses-wp2shell-attack-chain-for-unauthenticated-wordpress-r","Fidelis Security Discloses wp2shell Attack Chain for Unauthenticated WordPress RCE","CVE-2026-63030 and CVE-2026-60137 chain REST API route confusion with WP_Query SQL injection to achieve pre-auth RCE on WordPress 6.8–7.0.","Fidelis Security has disclosed the wp2shell attack chain, a two-CVE exploit that lets unauthenticated attackers achieve remote code execution on WordPress Core via the REST API batch endpoint and a WP_Query SQL injection in the author__not_in parameter.",[263,264,265,266,267,268],"WordPress","wp2shell","CVE-2026-60137","CVE-2026-63030","REST API","SQL Injection","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffidelis-security-discloses-wp2shell-attack-chain-for-unauthenticated-wordpress-r.png?v=b1c1aa3d09","2026-09-22T07:08:43.775939+00:00",{"slug":272,"title":273,"subtitle":274,"summary":275,"tags":276,"hero_image_url":282,"story_type":49,"created_at":283,"published_at":20,"source_count":21},"unc6671-rebrands-as-redact-pink-helix-and-falcon-after-millions-in-vishing-extor","UNC6671 Rebrands as Redact, Pink, Helix, and Falcon After Millions in Vishing Extortion","The group previously known as BlackFile has split its operations across four new DLS brands after generating millions in revenue through IT helpdesk voice phishing.","UNC6671, a data extortion group that rebranded from BlackFile in May 2026, has expanded into four new leak site brands — Redact, Pink, Helix, and Falcon — after raking in millions in extortion via vishing campaigns targeting enterprise employees.",[277,278,279,280,281],"UNC6671","vishing","extortion","BlackFile","DLS","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Func6671-rebrands-as-redact-pink-helix-and-falcon-after-millions-in-vishing-extor.png?v=bbab46fe3b","2026-09-22T07:04:26.729885+00:00",{"slug":285,"title":286,"subtitle":287,"summary":288,"tags":289,"hero_image_url":294,"story_type":136,"created_at":295,"published_at":20,"source_count":95},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs","SRG's DLS now lists 64 law firms, including Troutman Pepper Locke, with client SSNs and privileged documents exposed.","Silent Ransom Group has published data from 64 law firms on its data leak site, including Troutman Pepper Locke, exposing tens of thousands of client SSNs and privileged legal documents.",[290,291,292,223,293,105],"Silent Ransom Group","Troutman Pepper Locke","law firm","SSN","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0","2026-09-21T17:04:06.647891+00:00",{"slug":297,"title":298,"subtitle":299,"summary":300,"tags":301,"hero_image_url":305,"story_type":18,"created_at":306,"published_at":20,"source_count":51},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-Able N-Central RCE with 3-day federal deadline","CVE-2026-18556 is an unauthenticated authentication bypass in N-central through 2026.1, actively exploited in the wild, with a 3-day federal remediation deadline.","CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog for N-able N-central, an unauthenticated authentication bypass that grants remote administrative access on versions through 2026.1, with a 3-day federal deadline and active in-the-wild exploitation.",[302,303,200,199,304],"CVE-2026-18556","N-Able N-Central","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","2026-09-21T12:03:34.769619+00:00",{"slug":308,"title":309,"subtitle":310,"summary":311,"tags":312,"hero_image_url":319,"story_type":65,"created_at":320,"published_at":20,"source_count":36},"forescout-researchers-identify-new-ransomware-coterie-mora-001-running-superblac","Forescout researchers identify new ransomware coterie 'Mora_001' running 'SuperBlack' built from leaked LockBit 3.0","Mora_001, active since January 2026, exploits CVE-2024-55591 and CVE-2025-24472 to break into FortiOS\u002FFortiProxy and deploys SuperBlack ransomware with a shared qTox ID tying it to LockBit.","Forescout researchers have identified a new ransomware coterie named Mora_001, active since January 2026, that runs SuperBlack ransomware built from leaked LockBit 3.0 source code and exploits two Fortinet authentication bypass flaws (CVE-2024-55591 and CVE-2025-24472) to gain super-admin access on FortiOS and FortiProxy appliances.",[313,314,315,316,317,318],"Mora_001","SuperBlack","LockBit 3.0","FortiOS","FortiProxy","CVE-2024-55591","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fforescout-researchers-identify-new-ransomware-coterie-mora-001-running-superblac.png?v=ed02f05fb9","2026-09-21T07:06:18.647672+00:00",{"slug":322,"title":323,"subtitle":324,"summary":325,"tags":326,"hero_image_url":331,"story_type":136,"created_at":332,"published_at":20,"source_count":256},"dark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys","Dark Project ransomware group hits Brainhunter Companies LLC and Brainhunter Systems Ltd.","The new group has 19 known victims and 9 active extortion links on ransomware.live.","Dark Project, a ransomware group first seen in April 2026, has published Brainhunter Companies LLC and Brainhunter Systems Ltd. as its latest victims, bringing its total to 19 known targets with 9 active extortion links on ransomware.live.",[327,328,105,329,330],"Dark Project","Brainhunter","double extortion","ransomware.live","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys.png?v=d6c0e0a4ac","2026-09-21T07:02:16.98855+00:00",98,1,24,"newest",{"tags":338,"tagTotal":692,"storyTypes":693,"articles":333},[339,341,342,344,346,348,350,352,354,356,358,360,362,363,364,366,368,369,370,372,374,376,378,380,382,384,386,387,389,391,393,395,396,398,400,401,403,405,407,409,410,412,413,415,417,418,420,421,423,425,426,428,429,431,432,433,434,436,438,440,441,443,445,446,447,448,449,451,452,453,454,456,458,459,460,461,462,464,466,468,470,472,474,476,478,480,482,484,486,488,489,491,492,493,495,497,499,500,502,504,506,508,510,512,514,515,517,519,521,523,525,527,528,530,532,533,535,537,539,541,543,545,547,549,551,552,554,556,558,560,562,564,566,568,569,570,572,574,576,578,580,582,584,586,588,590,592,593,594,596,598,600,601,603,605,607,609,611,613,615,617,619,621,623,625,627,629,631,632,634,636,638,640,642,643,644,646,648,650,652,654,656,658,660,662,664,666,668,670,671,673,674,676,678,680,682,684,686,688,690],{"tag":211,"count":340},22,{"tag":199,"count":36},{"tag":343,"count":123},"Data Breach",{"tag":345,"count":123},"Phishing",{"tag":347,"count":51},"Extortion",{"tag":349,"count":51},"Infostealer",{"tag":351,"count":51},"Iran",{"tag":353,"count":51},"Spear-Phishing",{"tag":355,"count":51},"Windows",{"tag":357,"count":51},"Zero-Day",{"tag":359,"count":256},"APT",{"tag":361,"count":256},"Authentication Bypass",{"tag":222,"count":256},{"tag":200,"count":256},{"tag":365,"count":256},"Cybersecurity Threats",{"tag":367,"count":256},"Data Leak",{"tag":316,"count":256},{"tag":317,"count":256},{"tag":371,"count":256},"Microsoft",{"tag":373,"count":256},"RaaS",{"tag":375,"count":256},"ShinyHunters",{"tag":377,"count":256},"Supply-Chain",{"tag":379,"count":21},"Acronis",{"tag":381,"count":21},"Agentic AI",{"tag":383,"count":21},"AhnLab ASEC",{"tag":385,"count":21},"AI Agent",{"tag":74,"count":21},{"tag":388,"count":21},"APT42",{"tag":390,"count":21},"Armored Likho",{"tag":392,"count":21},"AWS",{"tag":394,"count":21},"Azure",{"tag":237,"count":21},{"tag":397,"count":21},"CISA",{"tag":399,"count":21},"Cisco",{"tag":159,"count":21},{"tag":402,"count":21},"CoinbaseCartel",{"tag":404,"count":21},"Cyber-Espionage",{"tag":406,"count":21},"Cybercrime",{"tag":408,"count":21},"Data Exfiltration",{"tag":281,"count":21},{"tag":411,"count":21},"Double Extortion",{"tag":73,"count":21},{"tag":414,"count":21},"Fox-IT",{"tag":416,"count":21},"Gunra",{"tag":249,"count":21},{"tag":419,"count":21},"Kaspersky",{"tag":221,"count":21},{"tag":422,"count":21},"Kubernetes",{"tag":424,"count":21},"Law Firm",{"tag":106,"count":21},{"tag":427,"count":21},"LPE",{"tag":252,"count":21},{"tag":430,"count":21},"MFA Bypass",{"tag":238,"count":21},{"tag":236,"count":21},{"tag":303,"count":21},{"tag":435,"count":21},"Nightmare-Eclipse",{"tag":437,"count":21},"NPM",{"tag":439,"count":21},"Palo Alto Networks",{"tag":104,"count":21},{"tag":442,"count":21},"PoC",{"tag":444,"count":21},"Ransomware.live",{"tag":240,"count":21},{"tag":225,"count":21},{"tag":130,"count":21},{"tag":161,"count":21},{"tag":450,"count":21},"TAMECAT",{"tag":43,"count":21},{"tag":32,"count":21},{"tag":61,"count":21},{"tag":455,"count":21},"Unit 42",{"tag":457,"count":21},"US",{"tag":239,"count":21},{"tag":160,"count":21},{"tag":31,"count":21},{"tag":224,"count":21},{"tag":463,"count":334},"0xFFF",{"tag":465,"count":334},"Account Takeover",{"tag":467,"count":334},"Active Exploitation",{"tag":469,"count":334},"AD CS",{"tag":471,"count":334},"Adobe",{"tag":473,"count":334},"Adobe ColdFusion",{"tag":475,"count":334},"Adobe Commerce",{"tag":477,"count":334},"AI Agents",{"tag":479,"count":334},"AI Brand Impersonation",{"tag":481,"count":334},"AI Malware",{"tag":483,"count":334},"AI Pentesting",{"tag":485,"count":334},"AI Vulnerability Discovery",{"tag":487,"count":334},"AI-SAST",{"tag":89,"count":334},{"tag":490,"count":334},"Aitm",{"tag":62,"count":334},{"tag":171,"count":334},{"tag":494,"count":334},"Android",{"tag":496,"count":334},"Anthropic",{"tag":498,"count":334},"Apache",{"tag":184,"count":334},{"tag":501,"count":334},"AppInject",{"tag":503,"count":334},"ARCrypter",{"tag":505,"count":334},"Arctic Wolf",{"tag":507,"count":334},"AS213790",{"tag":509,"count":334},"Asa",{"tag":511,"count":334},"ASEC",{"tag":513,"count":334},"Atlassian",{"tag":250,"count":334},{"tag":516,"count":334},"Auth-Bypass",{"tag":518,"count":334},"BadPaw",{"tag":520,"count":334},"Banking Botnet",{"tag":522,"count":334},"Beacon CRM",{"tag":524,"count":334},"BEC-phishing",{"tag":526,"count":334},"BERT",{"tag":280,"count":334},{"tag":529,"count":334},"Blacktor",{"tag":531,"count":334},"Blister",{"tag":328,"count":334},{"tag":534,"count":334},"BRC4",{"tag":536,"count":334},"BSidesLV",{"tag":538,"count":334},"Bucklog",{"tag":540,"count":334},"BusySnake Stealer",{"tag":542,"count":334},"C&C Panel",{"tag":544,"count":334},"Cactus Ransomware",{"tag":546,"count":334},"Cato Networks",{"tag":548,"count":334},"Certighost",{"tag":550,"count":334},"CEVA Logistics",{"tag":115,"count":334},{"tag":553,"count":334},"Charities",{"tag":555,"count":334},"Charming Kitten",{"tag":557,"count":334},"Chemical Manufacturing",{"tag":559,"count":334},"ChileLocker",{"tag":561,"count":334},"CI\u002FCD",{"tag":563,"count":334},"Cisco FMC",{"tag":565,"count":334},"Citrix NetScaler",{"tag":567,"count":334},"Claude Mythos",{"tag":87,"count":334},{"tag":170,"count":334},{"tag":571,"count":334},"ClearSky",{"tag":573,"count":334},"Cloud Security",{"tag":575,"count":334},"Cloudflare",{"tag":577,"count":334},"Cloudforce One",{"tag":579,"count":334},"Cobalt Strike",{"tag":581,"count":334},"Code Security",{"tag":583,"count":334},"Commerce Cloud",{"tag":585,"count":334},"CoolClient",{"tag":587,"count":334},"Credential Attack",{"tag":589,"count":334},"Credential Exposure",{"tag":591,"count":334},"Critical Infrastructure",{"tag":75,"count":334},{"tag":14,"count":334},{"tag":595,"count":334},"CVSS 9.8",{"tag":597,"count":334},"Cyber Resilience",{"tag":599,"count":334},"Cyberattack",{"tag":327,"count":334},{"tag":602,"count":334},"Dark-Web",{"tag":604,"count":334},"DarkMe",{"tag":606,"count":334},"Data Extortion",{"tag":608,"count":334},"Data-Leak-Site",{"tag":610,"count":334},"DDoS",{"tag":612,"count":334},"Department of War",{"tag":614,"count":334},"DGFiP",{"tag":616,"count":334},"Diffpatch",{"tag":618,"count":334},"DNS Flood",{"tag":620,"count":334},"Dos",{"tag":622,"count":334},"DPRK",{"tag":624,"count":334},"Dr.Web",{"tag":626,"count":334},"DragonForce",{"tag":628,"count":334},"Driver Abuse",{"tag":630,"count":334},"Eagle Werewolf",{"tag":78,"count":334},{"tag":633,"count":334},"Education Sector",{"tag":635,"count":334},"Elasticsearch",{"tag":637,"count":334},"Encoder Trojans",{"tag":639,"count":334},"Encryption Key",{"tag":641,"count":334},"ESXiArgs",{"tag":119,"count":334},{"tag":172,"count":334},{"tag":645,"count":334},"Evil Corp",{"tag":647,"count":334},"Executive Order 14409",{"tag":649,"count":334},"Financial",{"tag":651,"count":334},"Fingerprinting",{"tag":653,"count":334},"Fintech",{"tag":655,"count":334},"FMC",{"tag":657,"count":334},"FortiBleed",{"tag":659,"count":334},"FortiGate",{"tag":661,"count":334},"FortiGuard",{"tag":663,"count":334},"FortiGuard Labs",{"tag":665,"count":334},"Fortinet",{"tag":667,"count":334},"France",{"tag":669,"count":334},"Ftd",{"tag":103,"count":334},{"tag":672,"count":334},"GDLockerSec",{"tag":158,"count":334},{"tag":675,"count":334},"GenAI Prompt Injection",{"tag":677,"count":334},"Git Hooks",{"tag":679,"count":334},"Gitea",{"tag":681,"count":334},"GitHub",{"tag":683,"count":334},"GOLD EAGLE",{"tag":685,"count":334},"Google",{"tag":687,"count":334},"Government Security",{"tag":689,"count":334},"GPT-5.6 Sol",{"tag":691,"count":334},"GPT-J",369,[694,697,700,703,706,708,710,711,713],{"value":65,"label":695,"count":696},"Threat Actor Activity",31,{"value":136,"label":698,"count":699},"Ransomware Incident",19,{"value":18,"label":701,"count":702},"Vulnerability Disclosure",17,{"value":49,"label":704,"count":705},"Campaign",14,{"value":93,"label":707,"count":36},"Exploitation",{"value":189,"label":709,"count":123},"Breach",{"value":228,"label":367,"count":256},{"value":121,"label":712,"count":21},"Supply Chain",{"value":714,"label":715,"count":334},"not_news","Not News"]