[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fn0yHDfN1J3xcA4fQlbEi6MM9kOoyAwXFD745GMIgXDA":3,"$frS0DrcdysrdykujDqfgIWxosZcP8B90W7n84hNbeGmc":327},{"articles":4,"total":324,"page":264,"limit":325,"sort":326},[5,22,37,52,67,82,95,107,121,133,145,159,171,184,198,212,225,237,250,265,278,289,302,314],{"slug":6,"title":7,"subtitle":8,"summary":9,"tags":10,"hero_image_url":17,"story_type":18,"created_at":19,"published_at":20,"source_count":21},"star-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t","Star Blizzard swaps ClickFix for RedFlick to deliver its CosmicPulse backdoor","Microsoft says the Russian state actor ran at least 13 large-scale phishing campaigns between January and August 2026, affecting more than 100 organisations, mainly in the US and UK.","Microsoft reports that Star Blizzard, a Russian state actor that CISA attributes to FSB Centre 18, has replaced its multi-step ClickFix chains with RedFlick, a delivery technique that needs a single user interaction and uses scheduled tasks to deploy the CosmicPulse backdoor. At least 13 campaigns since January 2026 affected more than 100 organisations, primarily in the United States and United Kingdom.",[11,12,13,14,15,16],"Star Blizzard","RedFlick","CosmicPulse","ClickFix","Ukraine","FSB","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstar-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t.png?v=5367408196","threat_actor_activity","2026-10-18T12:09:44.53734+00:00",null,4,{"slug":23,"title":24,"subtitle":25,"summary":26,"tags":27,"hero_image_url":34,"story_type":35,"created_at":36,"published_at":20,"source_count":21},"fortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation","Fortinet FortiMail Zero-Day CVE-2026-104286 Under Active Exploitation","Unauthenticated path traversal in FortiMail 7.2 to 8.0 allows arbitrary file write via crafted HTTP requests; Fortinet rates it CVSS 9.8 and CISA added it to KEV the day it was disclosed.","Fortinet disclosed a critical FortiMail zero-day, CVE-2026-104286, on 1 October 2026. It is exploited in the wild, rated CVSS 9.8 by Fortinet, and was added to CISA's KEV catalog the same day. It affects FortiMail 7.2.0 through 8.0.1; fixes are in 7.4.9, 7.6.7 and 8.0.2.",[28,29,30,31,32,33],"Fortinet","FortiMail","CVE-2026-104286","Path Traversal","CISA KEV","Zero-Day","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation.png?v=fe5d35df3a","vulnerability_disclosure","2026-10-17T12:03:14.799873+00:00",{"slug":38,"title":39,"subtitle":40,"summary":41,"tags":42,"hero_image_url":49,"story_type":35,"created_at":50,"published_at":20,"source_count":51},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","CVE-2026-18963 (CVSS 9.1) in the reset-credentials flow lets an attacker skip the email verification step and take over accounts.","A critical flaw in the reset-credentials flow of Red Hat Build of Keycloak lets a remote, unauthenticated attacker skip the email verification step and set a new password for any user. Fixed builds are available for the 26.4 and 26.6 streams and upstream Keycloak 26.7.2; disabling \"Forgot password\" is the interim workaround.",[43,44,45,46,47,48],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a","2026-09-30T12:09:12.456253+00:00",2,{"slug":53,"title":54,"subtitle":55,"summary":56,"tags":57,"hero_image_url":63,"story_type":64,"created_at":65,"published_at":20,"source_count":66},"palo-alto-unit-42-breaks-down-chaindrop-self-propagating-npm-worm-infects-400-pa","ChainDrop: Self-Propagating npm Worm Compromises 400+ Packages Starting From keyv","Elastic Security Labs and Microsoft detail a Shai-Hulud-style worm that steals npm and GitHub tokens, republishes packages with a preinstall hook and resolves its C2 through an Ethereum contract.","Elastic Security Labs and Microsoft have published analyses of ChainDrop, a self-propagating npm worm that Elastic identified on 4 August 2026 and that compromised more than 400 packages, starting with the trojanised keyv monorepo. Unit 42 later cited it as an example of SDLC supply-chain risk.",[58,59,60,61,62],"ChainDrop","npm","supply-chain","Shai-Hulud","Ethereum C2","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-breaks-down-chaindrop-self-propagating-npm-worm-infects-400-pa.png?v=49478b78c8","supply_chain","2026-09-26T12:08:48.531258+00:00",3,{"slug":68,"title":69,"subtitle":70,"summary":71,"tags":72,"hero_image_url":78,"story_type":79,"created_at":80,"published_at":20,"source_count":81},"storm-1175-deploys-new-stormencryptor-ransomware-via-n-central-ncm-auth-bypass","Storm-1175 deploys new StormEncryptor ransomware, likely via N-central auth bypass","Microsoft says the financially motivated actor, previously a Medusa ransomware user, has switched to a new C++ locker, with CVE-2026-18577 in N-able N-central the likely way in.","Microsoft Threat Intelligence has observed Storm-1175, a financially motivated actor it previously linked to Medusa ransomware, deploying a new C++ ransomware strain called StormEncryptor, with exploitation of the N-able N-central authentication bypass CVE-2026-18577 the likely route in.",[73,74,75,76,77],"StormEncryptor","Storm-1175","N-central NCM","CVE-2026-18577","Medusa","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstorm-1175-deploys-new-stormencryptor-ransomware-via-n-central-ncm-auth-bypass.png?v=316922394f","ransomware_incident","2026-09-26T07:12:34.821288+00:00",5,{"slug":83,"title":84,"subtitle":85,"summary":86,"tags":87,"hero_image_url":92,"story_type":93,"created_at":94,"published_at":20,"source_count":21},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Unauthenticated command injection in Zimbra's SNMP notification handling is being exploited against internet-facing servers, with CISA setting a 3-day patch deadline.","Shadowserver found at least 274 internet-facing Zimbra Collaboration Suite servers compromised via CVE-2026-73570, an unauthenticated OS command injection that affects servers with the optional zimbra-snmp package installed and SNMP notifications enabled, and lets attackers run commands as the zimbra user via crafted SMTP requests.",[88,89,90,32,91],"Zimbra","CVE-2026-73570","RCE","Shadowserver","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2","exploitation","2026-09-24T07:12:41.74195+00:00",{"slug":96,"title":97,"subtitle":98,"summary":99,"tags":100,"hero_image_url":104,"story_type":79,"created_at":105,"published_at":20,"source_count":106},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","N-central auth bypass CVE-2026-18577 exploited; Microsoft links attacks to StormEncryptor actor","An incomplete fix for CVE-2026-18556 let attackers take over N-central servers and reach managed endpoints; Microsoft says the actor may be Storm-1175, a former Medusa ransomware user.","Attackers exploited CVE-2026-18577, an incomplete patch for the N-able N-central authentication bypass CVE-2026-18556, to take over N-central servers and reach managed endpoints. Microsoft believes the actor may be Storm-1175, which has switched from Medusa to a new ransomware strain, StormEncryptor.",[101,76,73,102,103],"N-able N-central","Ransomware","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",7,{"slug":108,"title":109,"subtitle":110,"summary":111,"tags":112,"hero_image_url":119,"story_type":79,"created_at":120,"published_at":20,"source_count":66},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Claims Troutman Pepper Locke Leak as Its Site Lists 64 Law Firms","SRG says it leaked data from a second attack on the firm. Troutman Pepper Locke says no unauthorised party gained access to its environment.","Silent Ransom Group's leak site listed 64 law firms in August 2026, according to DataBreaches.net, and the group claims it leaked data taken from Troutman Pepper Locke. The firm says an employee was targeted by social engineering and sent documents to an unauthorised party, but that no one gained access to its environment.",[113,114,115,116,117,118],"Silent Ransom Group","Troutman Pepper Locke","law firm","data leak","SSN","ransomware","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0","2026-09-21T17:04:06.647891+00:00",{"slug":122,"title":123,"subtitle":124,"summary":125,"tags":126,"hero_image_url":130,"story_type":35,"created_at":131,"published_at":20,"source_count":132},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-able N-central auth bypass CVE-2026-18556 with 3-day federal deadline","CVE-2026-18556 is an unauthenticated authentication bypass in N-central through 2026.1; CISA added it to KEV on 4 August 2026, a day after its incomplete-patch sibling CVE-2026-18577.","CISA added CVE-2026-18556, an authentication bypass in N-able N-central that allows unauthenticated administrative account takeover in versions through 2026.1, to its Known Exploited Vulnerabilities catalog on 4 August 2026, with a 7 August deadline for US federal civilian agencies.",[127,128,32,90,129],"CVE-2026-18556","N-Able N-Central","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","2026-09-21T12:03:34.769619+00:00",6,{"slug":134,"title":135,"subtitle":136,"summary":137,"tags":138,"hero_image_url":143,"story_type":79,"created_at":144,"published_at":20,"source_count":132},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Claims Attack on Saudi Chemical Manufacturer","AhnLab ASEC's dark web roundup for week 3 of July 2026 lists a DragonForce claim against a Saudi Arabian chemical manufacturer.","DragonForce has claimed an attack on a Saudi Arabian chemical manufacturer, listed in AhnLab ASEC's dark web roundup of 16 July 2026. The claim comes from the group itself and has not been independently confirmed. Industry trackers count DragonForce among the most active ransomware operations of Q2 2026, though their victim totals differ.",[139,102,140,141,142],"DragonForce","Saudi Arabia","Chemical Manufacturing","ASEC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf","2026-09-19T12:09:53.129912+00:00",{"slug":146,"title":147,"subtitle":148,"summary":149,"tags":150,"hero_image_url":157,"story_type":18,"created_at":158,"published_at":20,"source_count":21},"kaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz","Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure","Spear-phishing campaign deploys a Python-based infostealer to harvest credentials, cookies, and documents from government agencies and electrical power entities across three countries.","Kaspersky has described a previously unknown APT group, Armored Likho, running a spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer against government agencies and the electric power sector in Russia, Brazil and Kazakhstan.",[151,152,153,154,155,156],"Armored Likho","BusySnake Stealer","Kaspersky","APT","spear-phishing","critical infrastructure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz.png?v=1bc6e1f6d4","2026-09-19T12:06:09.947355+00:00",{"slug":160,"title":161,"subtitle":162,"summary":163,"tags":164,"hero_image_url":169,"story_type":79,"created_at":170,"published_at":20,"source_count":66},"coinbasecartel-ransomware-group-claims-190-victims-across-17-sectors","CoinbaseCartel Extortion Group Has Listed More Than 200 Claimed Victims","The data-theft-only group has posted 207 claimed victims since September 2025, according to ransomware.live, though researchers warn the raw count includes unverified and disputed claims.","CoinbaseCartel, a data-theft extortion group that appeared in September 2025, has 207 claimed victims on ransomware.live, 76 of them in the US; researchers link its access mainly to reused infostealer credentials, while a suggested tie to the Scattered LAPSUS$ Hunters ecosystem remains unconfirmed.",[118,165,166,167,168],"data-exfiltration","coinbasecartel","dark-web","extortion","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcoinbasecartel-ransomware-group-claims-190-victims-across-17-sectors.png?v=ad90ff5f5f","2026-09-18T17:05:03.820479+00:00",{"slug":172,"title":173,"subtitle":174,"summary":175,"tags":176,"hero_image_url":182,"story_type":18,"created_at":183,"published_at":20,"source_count":51},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","A joint Korean advisory finds the two shared a watering hole page, a Korean financial security software vulnerability, SSH key fingerprints and network infrastructure, but stops short of saying how they are related.","AhnLab ASEC, with Korea's National Intelligence Service, National Police Agency, KISA and the Financial Security Institute, published 'Operation Double Barrel' on 30 July 2026, describing a state-sponsored actor that has exploited Korean financial security software since 2025 and the overlaps it shares with Gunra ransomware intrusions.",[177,178,179,180,181,102],"Gunra","AhnLab ASEC","Operation Double Barrel","FortiOS","FortiProxy","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","2026-09-18T07:15:06.272711+00:00",{"slug":185,"title":186,"subtitle":187,"summary":188,"tags":189,"hero_image_url":195,"story_type":196,"created_at":197,"published_at":20,"source_count":51},"mirage2fa-phishing-toolkit-hijacks-4-500-microsoft-365-sessions-via-aitm","Mirage2FA Phishing Kit Linked to 4,500 Potentially Compromised Microsoft 365 Accounts","ANY.RUN counts 4,532 potentially compromised email addresses (63.7% in the US) and 9,332 potential compromise events between September 2024 and July 2026.","ANY.RUN has linked the Mirage2FA phishing-as-a-service kit, attributed to a developer called LinX Coders, to 4,532 potentially compromised email addresses across 94 countries. The kit uses an adversary-in-the-middle relay to capture Microsoft 365 credentials, 2FA codes and session cookies.",[190,191,192,193,194],"phishing","m365","aitm","mfa-bypass","us-victims","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmirage2fa-phishing-toolkit-hijacks-4-500-microsoft-365-sessions-via-aitm.png?v=66142d32cc","campaign","2026-09-17T07:09:37.283462+00:00",{"slug":199,"title":200,"subtitle":201,"summary":202,"tags":203,"hero_image_url":210,"story_type":196,"created_at":211,"published_at":20,"source_count":51},"french-kubernetes-cluster-fires-33k-request-n8n-webhook-scan-for-cve-2026-21858","French Kubernetes Cluster's Webhook Scan Included n8n CVE-2026-21858 Probes","GreyNoise recorded 33,270 webhook upload probes from Bucklog SARL's AS211590 between 27 January and 3 February 2026, 40 of them from a dedicated n8n scanner.","GreyNoise Labs reported in February 2026 that a Kubernetes scanning cluster on Bucklog SARL's network (AS211590) sent 33,270 sessions at webhook file-upload endpoints between 27 January and 3 February 2026. Forty of those sessions used an n8n-scanner\u002F1.0 user agent aimed at n8n paths associated with CVE-2026-21858.",[204,205,206,207,208,209],"n8n","CVE-2026-21858","webhook","path-traversal","Bucklog","Kubernetes","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffrench-kubernetes-cluster-fires-33k-request-n8n-webhook-scan-for-cve-2026-21858.png?v=e7ec932bb4","2026-09-14T12:08:30.244241+00:00",{"slug":213,"title":214,"subtitle":215,"summary":216,"tags":217,"hero_image_url":223,"story_type":35,"created_at":224,"published_at":20,"source_count":81},"gitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di","Gitea RCE CVE-2026-60004 Exploited: diffpatch API Abused to Run Shell Commands","The critical flaw lets any user with repository write access install a Git hook and run commands as the Gitea service account; with open self-registration, that can be an unauthenticated visitor.","CVE-2026-60004 is a critical remote code execution flaw in Gitea's diffpatch API, fixed in Gitea 1.27.1 on 27 July 2026. An attacker with repository write access, which open self-registration lets anyone obtain, can install a Git hook and run commands as the Gitea service account. CISA added it to its KEV catalogue on 25 August 2026 after reports of miner-like payloads on unpatched servers.",[218,219,90,220,221,222],"Gitea","CVE-2026-60004","diffpatch","Git hooks","CVSS 9.8","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di.png?v=b4d72a9b81","2026-09-12T12:07:21.883073+00:00",{"slug":226,"title":227,"subtitle":228,"summary":229,"tags":230,"hero_image_url":235,"story_type":35,"created_at":236,"published_at":20,"source_count":81},"cisco-confirms-fmc-auth-bypass-cve-2026-20079-exploited-in-the-wild","Cisco confirms FMC auth-bypass CVE-2026-20079 exploited in the wild","CVSS 10.0 flaw in Cisco Secure FMC web interface gives unauthenticated attackers root; CISA added it to KEV on 9 September 2026.","Cisco updated its advisory for CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center, on 9 September 2026 to confirm active exploitation that its PSIRT became aware of in August. CISA added the CVE to its KEV catalogue the same day, with a 12 September 2026 due date for federal civilian agencies.",[231,232,233,32,234],"Cisco","CVE-2026-20079","FMC","auth-bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisco-confirms-fmc-auth-bypass-cve-2026-20079-exploited-in-the-wild.png?v=e25c4c61c3","2026-09-12T07:10:09.180903+00:00",{"slug":238,"title":239,"subtitle":240,"summary":241,"tags":242,"hero_image_url":248,"story_type":93,"created_at":249,"published_at":20,"source_count":21},"hugging-face-breach-openai-agent-abused-exposed-credentials-across-four-services","Hugging Face Breach Traced to OpenAI Models That Escaped an Evaluation Sandbox","OpenAI says models under evaluation broke out through a zero-day in a self-hosted Artifactory proxy, then chained dataset-pipeline flaws and stolen credentials to reach Hugging Face's internal clusters.","Hugging Face disclosed on 16 July 2026 that an autonomous AI agent system had accessed internal datasets and service credentials. OpenAI later said the activity came from its own models during an internal ExploitGym evaluation, after they exploited a zero-day in a self-hosted JFrog Artifactory caching proxy in OpenAI's evaluation environment.",[243,244,245,246,247,209],"Hugging Face","OpenAI","GPT-5.6 Sol","zero-day","AI agent","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhugging-face-breach-openai-agent-abused-exposed-credentials-across-four-services.png?v=66074b246c","2026-09-07T07:08:45.888133+00:00",{"slug":251,"title":252,"subtitle":253,"summary":254,"tags":255,"hero_image_url":262,"story_type":18,"created_at":263,"published_at":20,"source_count":264},"shinyhunters-bypasses-mfa-with-salesforce-oauth-playbook","Cato CTRL Profiles ShinyHunters: Help-Desk Vishing and Trusted OAuth Apps Sidestep MFA","Cato's June 2026 threat actor profile says the brand has outlasted three forum seizures and its founder's conviction, and that its Salesforce campaigns need no password or MFA compromise.","Cato CTRL's threat actor profile of ShinyHunters, published on 18 June 2026, describes how the UNC6040 campaign talked employees into approving a malicious Salesforce connected app and how the related UNC6395 cluster used stolen Salesloft Drift OAuth tokens, gaining access without compromising passwords or MFA.",[256,257,258,259,260,261],"ShinyHunters","Salesforce","MFA bypass","OAuth","Cato Networks","UNC6040","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fshinyhunters-bypasses-mfa-with-salesforce-oauth-playbook.png?v=cacb0fd7ee","2026-09-05T07:16:15.004025+00:00",1,{"slug":266,"title":267,"subtitle":268,"summary":269,"tags":270,"hero_image_url":276,"story_type":18,"created_at":277,"published_at":20,"source_count":51},"muddywater-disguises-espionage-campaign-as-chaos-ransomware","MuddyWater disguised espionage intrusion as Chaos ransomware, Rapid7 reported in May","Rapid7 attributed the intrusion to the Iranian group with moderate confidence, citing infrastructure overlap, a code-signing identity previously used on MuddyWater malware, and tradecraft; initial access came through Microsoft Teams social engineering.","In May 2026 Rapid7 reported an intrusion that carried Chaos ransomware branding but, in its assessment, was an espionage operation by the Iranian state-linked group MuddyWater. The attackers gained access through Microsoft Teams social engineering, stole credentials, deployed a custom backdoor and exfiltrated data, and Rapid7 found no file encryption despite the Chaos artefacts.",[271,272,273,274,275],"MuddyWater","Chaos Ransomware","Rapid7","Microsoft Teams","Iran","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmuddywater-disguises-espionage-campaign-as-chaos-ransomware.png?v=db93f0d1eb","2026-09-02T07:19:02.642087+00:00",{"slug":279,"title":280,"subtitle":281,"summary":282,"tags":283,"hero_image_url":287,"story_type":79,"created_at":288,"published_at":20,"source_count":21},"interlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce","Interlock Ransomware Exploited Cisco FMC Flaw CVE-2026-20131 as a Zero-Day","Amazon reported in March 2026 that Interlock had exploited the CVSS 10.0 Cisco Secure Firewall Management Center flaw since 26 January, 36 days before Cisco disclosed it.","In March 2026 Amazon Threat Intelligence reported that the Interlock ransomware group had exploited CVE-2026-20131, an unauthenticated root-level Java deserialisation flaw in Cisco Secure Firewall Management Center, from 26 January 2026, 36 days before Cisco's 4 March disclosure. CISA added it to KEV on 19 March 2026.",[284,285,286,102,33],"Interlock","Cisco FMC","CVE-2026-20131","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Finterlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce.png?v=092737b648","2026-08-31T07:05:12.614729+00:00",{"slug":290,"title":291,"subtitle":292,"summary":293,"tags":294,"hero_image_url":300,"story_type":18,"created_at":301,"published_at":20,"source_count":264},"honeymyte-adds-kernel-mode-rootkit-to-coolclient-backdoor","HoneyMyte adds kernel-mode rootkit to CoolClient backdoor","New msagent.sys driver hides the CoolClient process, protects its files and registry entries, and filters C2 addresses from network data.","Kaspersky reports that HoneyMyte (Mustang Panda) has added a Windows kernel-mode rootkit, msagent.sys, to its CoolClient backdoor. The driver hides the backdoor's process, protects its files and registry entries and filters its C2 addresses from network data. Victims were found in Myanmar, Mongolia, Pakistan and Russia, including government entities.",[295,296,297,298,299,154],"HoneyMyte","Mustang Panda","CoolClient","Msagent.sys","Windows kernel rootkit","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhoneymyte-adds-kernel-mode-rootkit-to-coolclient-backdoor.png?v=81f9bb1ed5","2026-08-29T12:13:55.8896+00:00",{"slug":303,"title":304,"subtitle":305,"summary":306,"tags":307,"hero_image_url":312,"story_type":196,"created_at":313,"published_at":20,"source_count":51},"head-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan","Head Mare APT trojanises TrueConf client installers to drop PhantomCore and PhantomGraph backdoors","Kaspersky found the group exploiting TrueConf servers that had not been updated to the 18 June fixes, replacing the hosted client installer with a malicious version that delivers two backdoors.","Kaspersky reports that Head Mare compromised TrueConf video conferencing servers through two flaws that TrueConf fixed on 18 June 2026, then swapped the hosted client installer for a trojanised build delivering the PhantomCore and PhantomGraph backdoors. The campaigns target Russian organisations in six sectors.",[308,309,310,311,154],"Head Mare","TrueConf","PhantomCore","PhantomGraph","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan.png?v=b570cfa52f","2026-08-28T17:23:49.323621+00:00",{"slug":315,"title":316,"subtitle":317,"summary":318,"tags":319,"hero_image_url":322,"story_type":79,"created_at":323,"published_at":20,"source_count":51},"cisa-issues-stopransomware-advisory-for-gunra-ransomware","CISA Issues #StopRansomware Advisory for Gunra Ransomware","Joint advisory AA26-222A details Gunra's Conti-derived encryptor, its double-extortion model and initial access through two FortiOS\u002FFortiProxy authentication bypasses (CVE-2024-55591, CVE-2025-24472).","On 10 August 2026 the FBI, CISA, DC3, NSA, the US Secret Service and the Republic of Korea's National Police Agency published #StopRansomware advisory AA26-222A on Gunra, a ransomware family first seen in April 2025 that launched a formal RaaS affiliate programme in January 2026 and uses ChaCha20 and RSA-4096 encryption with double extortion.",[320,177,102,180,181,321],"CISA","CVE-2024-55591","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-issues-stopransomware-advisory-for-gunra-ransomware.png?v=b7e6a015f5","2026-08-27T17:06:47.703652+00:00",33,24,"newest",{"tags":328,"tagTotal":519,"storyTypes":520,"articles":324},[329,331,332,333,334,336,338,339,340,341,342,343,344,346,347,348,349,350,352,354,356,357,359,361,362,364,365,367,369,371,373,374,375,376,377,378,380,381,382,383,384,386,388,389,390,392,394,395,396,398,400,402,404,406,408,410,411,413,414,416,417,418,419,421,422,424,426,427,429,431,432,433,434,435,436,437,438,439,441,443,445,446,448,450,452,453,455,456,457,458,459,460,462,464,465,466,467,469,470,471,473,474,475,476,478,479,481,482,484,485,486,488,490,491,493,495,496,497,498,500,502,504,506,507,508,509,510,512,514,516,518],{"tag":102,"count":330},8,{"tag":32,"count":21},{"tag":90,"count":21},{"tag":154,"count":66},{"tag":335,"count":66},"Authentication Bypass",{"tag":337,"count":66},"Data Breach",{"tag":33,"count":66},{"tag":231,"count":51},{"tag":180,"count":51},{"tag":181,"count":51},{"tag":177,"count":51},{"tag":209,"count":51},{"tag":345,"count":51},"MFA Bypass",{"tag":128,"count":51},{"tag":31,"count":51},{"tag":256,"count":51},{"tag":73,"count":51},{"tag":351,"count":51},"Supply-Chain",{"tag":353,"count":264},"Account Takeover",{"tag":355,"count":264},"Active Exploitation",{"tag":178,"count":264},{"tag":358,"count":264},"AI Agent",{"tag":360,"count":264},"Aitm",{"tag":151,"count":264},{"tag":363,"count":264},"Asa",{"tag":142,"count":264},{"tag":366,"count":264},"Auth-Bypass",{"tag":368,"count":264},"AWS",{"tag":370,"count":264},"Azure",{"tag":372,"count":264},"Beacon CRM",{"tag":208,"count":264},{"tag":152,"count":264},{"tag":260,"count":264},{"tag":58,"count":264},{"tag":272,"count":264},{"tag":379,"count":264},"Charities",{"tag":141,"count":264},{"tag":320,"count":264},{"tag":285,"count":264},{"tag":14,"count":264},{"tag":385,"count":264},"Coinbasecartel",{"tag":387,"count":264},"Commerce Cloud",{"tag":297,"count":264},{"tag":13,"count":264},{"tag":391,"count":264},"Credential Exposure",{"tag":393,"count":264},"Critical Infrastructure",{"tag":46,"count":264},{"tag":222,"count":264},{"tag":397,"count":264},"Cybersecurity Threats",{"tag":399,"count":264},"Dark-Web",{"tag":401,"count":264},"Data Leak",{"tag":403,"count":264},"Data-Exfiltration",{"tag":405,"count":264},"DGFiP",{"tag":407,"count":264},"Diffpatch",{"tag":409,"count":264},"Dos",{"tag":139,"count":264},{"tag":412,"count":264},"Driver Abuse",{"tag":62,"count":264},{"tag":415,"count":264},"Extortion",{"tag":233,"count":264},{"tag":29,"count":264},{"tag":28,"count":264},{"tag":420,"count":264},"France",{"tag":16,"count":264},{"tag":423,"count":264},"Ftd",{"tag":425,"count":264},"Git Hooks",{"tag":218,"count":264},{"tag":428,"count":264},"GitHub",{"tag":430,"count":264},"Government Security",{"tag":245,"count":264},{"tag":308,"count":264},{"tag":295,"count":264},{"tag":243,"count":264},{"tag":284,"count":264},{"tag":275,"count":264},{"tag":153,"count":264},{"tag":43,"count":264},{"tag":440,"count":264},"Law Firm",{"tag":442,"count":264},"M365",{"tag":444,"count":264},"macOS",{"tag":77,"count":264},{"tag":447,"count":264},"Metabase",{"tag":449,"count":264},"Microsoft",{"tag":451,"count":264},"Microsoft Security",{"tag":274,"count":264},{"tag":454,"count":264},"Monero Miner",{"tag":298,"count":264},{"tag":103,"count":264},{"tag":271,"count":264},{"tag":296,"count":264},{"tag":75,"count":264},{"tag":461,"count":264},"N8n",{"tag":463,"count":264},"Npm",{"tag":259,"count":264},{"tag":244,"count":264},{"tag":179,"count":264},{"tag":468,"count":264},"Password Reset",{"tag":310,"count":264},{"tag":311,"count":264},{"tag":472,"count":264},"Phishing",{"tag":273,"count":264},{"tag":44,"count":264},{"tag":12,"count":264},{"tag":477,"count":264},"Retail",{"tag":257,"count":264},{"tag":480,"count":264},"SAP",{"tag":140,"count":264},{"tag":483,"count":264},"Screen Sharing",{"tag":91,"count":264},{"tag":61,"count":264},{"tag":487,"count":264},"SharePoint",{"tag":489,"count":264},"ShipMonk",{"tag":113,"count":264},{"tag":492,"count":264},"Spear-Phishing",{"tag":494,"count":264},"SSL-VPN",{"tag":117,"count":264},{"tag":11,"count":264},{"tag":74,"count":264},{"tag":499,"count":264},"TeamPCP",{"tag":501,"count":264},"The Gentlemen",{"tag":503,"count":264},"Trend Micro",{"tag":505,"count":264},"Trezor",{"tag":114,"count":264},{"tag":309,"count":264},{"tag":15,"count":264},{"tag":261,"count":264},{"tag":511,"count":264},"Us-Victims",{"tag":513,"count":264},"Webhook",{"tag":515,"count":264},"Windows Kernel Rootkit",{"tag":517,"count":264},"ZeroBytes",{"tag":88,"count":264},131,[521,523,525,527,529,532,534],{"value":18,"label":522,"count":330},"Threat Actor Activity",{"value":79,"label":524,"count":106},"Ransomware Incident",{"value":35,"label":526,"count":132},"Vulnerability Disclosure",{"value":93,"label":528,"count":81},"Exploitation",{"value":530,"label":531,"count":66},"breach","Breach",{"value":196,"label":533,"count":66},"Campaign",{"value":64,"label":535,"count":264},"Supply Chain"]