A new threat discovered by Palo Alto Networks' Unit42 shows how attackers can use Telegram as a command‑and‑control channel and an LLM to translate natural‑language requests into shell commands, enabling even non‑technical users to remotely control compromised machines while evading traditional detection.
The article details the capture of 23‑year‑old Jacob Butler, known as “Dort,” who ran the KimWolf IoT botnet that infected nearly two million devices, launched over 30,000 DDoS attacks with peaks near 30 Tbps, and examines the botnet’s tactics, the legal fallout, and defensive lessons for the IoT ecosystem.
The article dissects the May 2026 leak of the ransomware‑as‑a‑service group The Gentlemen, detailing its rapid rise, profit‑sharing model, edge‑device entry points, AI‑assisted tool development, supply‑chain attacks, internal breach, and concrete blue‑team mitigation recommendations.
A threat actor named MrLucxy is selling a purported "OpenAI dataset" on the dark web, claiming a compressed size of about 14.6 GB and over 62 GB uncompressed, containing chat logs, Slack exports, internal tickets, infrastructure SQL dumps, contractor PII, API key files, and monitoring data, but a veteran security analyst doubts its authenticity, noting the unusually large 8 MB API‑key file and suggesting it may be repackaged old leaks or fabricated data, as reported by Undercode News.
In May 2026, Google Threat Intelligence disclosed that a cybercrime group used a large‑language model to autonomously identify a semantic‑logic flaw in a popular open‑source Python‑based web management tool, generate a Python exploit that bypasses its two‑factor authentication, and launch mass automated attacks, prompting new blue‑team detection and defense strategies.
In May 2026, VECERT flagged threat actor NormalLeVrai for stealing credentials and admin access from France’s Fédération Française de Ball‑Trap (FFBT), selling the data on dark‑web markets; the breach, still under investigation, highlights the actor’s focus on French organizations, low‑price bulk sales, and the need for immediate password resets, MFA, and continuous monitoring.
A U.S. analyst mistakenly labeled Russia's notorious Sandworm group as Team R70—the former name of Yemen's cyber army—triggering a humorous yet instructive episode that highlights the dangers of naming confusion and the need for rigorous threat‑intel verification in cybersecurity.
TeamPCP, a newly identified cloud‑native threat group, has compromised at least 60,000 servers worldwide by exploiting exposed Docker APIs, Kubernetes clusters, Redis instances, and the React2Shell vulnerability, employing automated tools such as proxy.sh, kube.py, and react.py, with detailed MITRE ATT&CK mapping and concrete defense recommendations.
Ransomware groups are increasingly using double‑extortion "shaming" tactics, publicly leaking stolen data to pressure victims, with Breachsense reporting more than 2,000 compromised firms in 2026, a 40% rise projected for the year, prompting new defensive strategies across industries.
Security firm CloudSEK uncovered a sophisticated smishing campaign that disguises a fake Red Alert APK as an official wartime update, allowing attackers to steal contacts, messages, GPS data and verification codes, turning a life‑saving warning app into a serious information‑security threat.
As U.S. and Israeli forces target Iranian nuclear sites, analysts warn that Iran and its proxy hackers are poised to launch large‑scale cyber retaliation against critical U.S. and Israeli infrastructure, with sophisticated APT groups, upgraded attack methods, and high‑risk targets spanning energy, finance, and public utilities.
Researchers discovered that threat actors have automated large‑scale FortiGate compromises by feeding reconnaissance data into DeepSeek and Claude, building a continuous attack pipeline, while a separate AI‑Agent framework, OpenClaw, was weaponized within 72 hours to hijack over 30,000 instances, exposing critical design flaws and prompting urgent mitigation guidance.
A Darktrace‑detected campaign shows AI‑generated malware leveraging the React2Shell vulnerability to compromise an intentionally exposed Docker daemon, download LLM‑crafted payloads, and install XMRig mining software, highlighting a new low‑skill threat vector that evades traditional signature defenses.
The article traces the rapid evolution of cybercrime from scattered early malware to a highly organized, global underground industry, highlighting the rise of Ransomware‑as‑a‑Service, state‑backed actors, AI‑driven attacks, and why enterprises must shift from slow, reactive defenses to proactive resilience.
Google senior security leaders warn that attackers are already using AI for tasks like phishing and data‑theft command generation, and that fully automated, end‑to‑end AI attack kits are only a matter of time, forcing defenders to rethink protection strategies.
OpenClaw has partnered with Google’s VirusTotal to automatically scan every AI Agent Skill on its ClawHub marketplace, using threat‑intelligence hashes and Gemini‑powered behavior analysis to block malicious code, flag suspicious content, and establish a deeper security baseline for the emerging AI Agent ecosystem.
An in‑depth investigation reveals the rise and takedown of the RapperBot DDoS botnet, detailing its malware lineage, sample analysis, sophisticated attack techniques, criminal profit models, and practical security recommendations, while showcasing Tencent’s Zeus Shield intelligence platform and AI‑enhanced threat analysis.
This article dissects modern phishing and ransomware threats, detailing preparation, bait construction, email header spoofing, and open‑source tools like Gophish, then outlines comprehensive defensive measures—from endpoint security and threat intelligence to risk‑based response economics—offering a systematic, technology‑to‑tactics‑to‑strategy framework for information security teams.
Check Point’s 2025 cybersecurity report, based on data from 170 countries, reveals a 44% surge in global attacks, rapid ransomware evolution, massive exploitation of edge devices, a 96% reuse of known vulnerabilities, and highlights urgent recommendations for CISOs to strengthen BYOD, patch management, and incident response.
This article provides a comprehensive analysis of bot management, covering bot definitions, classification, current traffic trends, major vendor solutions, a four‑layer architecture, feature engineering, rule management, event operations, detection techniques, and practical steps for implementing a robust bot defense system.
The article delivers a technical overview of modern botnet threats, detailing the PBot and Xanthe families, their infection vectors, command‑and‑control operations, and provides practical detection, mitigation, and statistical analysis methods for defending against large‑scale DDoS, spam, and other malicious activities.
The 2022 H1 Radware report reveals a 203% rise in malicious DDoS attacks, a shift from pandemic‑related threats to patriotic hacker activity driven by the Russia‑Ukraine conflict, record‑size attacks, resurging RDoS ransomware, and retail and high‑tech sectors emerging as top targets.
A recent threat intelligence report reveals that Navicat Premium has been poisoned via a cracked version distributed from www.macwk.com, prompting users to urgently check for infections, change database passwords, and consider safer alternatives like Sequel Pro or IntelliJ IDEA's built‑in database client.
Huorong’s threat intelligence team discovered that the Qike PDF Converter carries a malicious proxy module that silently spreads via download‑site installers, hijacks system processes, persists as a startup service, and can turn infected machines into high‑CPU‑usage botnets, prompting immediate security updates.
This report provides a comprehensive technical analysis of the malicious "Le Bao" app that masquerades as a WeChat‑like chat tool, detailing its sample characteristics, hidden QR‑code group joining mechanism, payment flow, server‑side tracing, and profit model, highlighting its covert distribution of pornographic content and associated illicit activities.
This article explores five primary correlation analysis models—rule‑based, statistical, threat‑intelligence‑based, context‑based, and big‑data‑driven—detailing their principles, typical use cases such as single‑log alerts, event‑count thresholds, multi‑value detections, temporal sequences, and how accurate log parsing underpins effective security analytics.
In a Sanya digital summit speech, Zhou Hongyi warned that cyber warfare has become a major national‑level threat, outlined four key shifts in enterprise security, and described 360's big‑data security brain and future plans to build a nation‑wide defensive ecosystem.
This article explains how threat intelligence is generated by defining it as judged security information, outlines methods for collecting and evaluating security data, introduces a two‑dimensional reliability/quality rating system, and provides a step‑by‑step engineering workflow for enterprise threat‑intelligence operations.
The article explains how situational awareness—covering pre‑attack, during‑attack, and post‑attack stages—leverages big data, AI, threat intelligence, UEBA and visualization to turn security platforms into proactive “security brains,” while also critiquing current product implementations and market practices.
The article explains what threat intelligence is, classifies it into strategic, tactical, and operational categories, illustrates its critical role in modern cyber‑warfare and e‑commerce defense, and discusses the challenges of timeliness, accuracy, and sharing within the security ecosystem.
On December 14, Tencent's security intelligence team uncovered a “DriverLife” Trojan that exploited the high‑severity EternalBlue vulnerability to propagate like a worm, infecting up to 100,000 users within two hours, and detailed its infection chain, malicious payloads, and mitigation recommendations.
