Sparrow Malware Unites China-Linked Cyber Espionage Campaigns
Researchers link three China-affiliated espionage clusters through a shared Sparrow malware ecosystem targeting telcos, governments, and research.
Yesterday
Turla's Cereal Toolset Targets Government Emails in Kazakhstan and Romania
ESET reports Turla's new 'Cereal' toolset targeting Microsoft Exchange to silently steal government email correspondence.
Microsoft's November 2026 Patch Tuesday: Over 1,000 Vulnerabilities Addressed
Microsoft patched over 1,000 vulnerabilities including an actively exploited Outlook zero-day; prioritize Outlook and critical updates immediately.
Monday, November 9
Dark Project Ransomware Group Tempts Cybercriminals with Lucrative Commissions
PremiumDark Project ransomware recruits affiliates offering 80% commission, combining data theft, encryption, and public leak extortion tactics.
Critical Windows Paint Vulnerability Demands Immediate Attention
PremiumCVE-2026-83844 in Windows Paint enables 0-click remote code execution, complicating patch verification for administrators.
Friday, November 6
White House IP Addresses Misused for Anonymized Traffic Rental
PremiumResearchers found White House network IP addresses used as residential-proxy exits, enabling anonymized traffic rental and abuse.
Sogou Input Method Exploited by SlippyNunchucks in Cyberespionage Campaign
PremiumChina-aligned SlippyNunchucks abused Sogou Input Method to deploy DarkVigil backdoor to Windows victims across Asia.
Wednesday, November 4
Hackers Exploit Microsoft Teams and AD CS Vulnerabilities to Breach Corporate Data
Threat actors used Teams social engineering and insecure AD CS to obtain privileged login certificates and compromise domain controllers.
UK School Ransomware Attack Shows Hybrid AI Tactics
3AM ransomware affiliate used model-generated command loops during breach, suggesting semi-automated playbooks in school attack.
BlackX UEFI Bootkit Exploits Secure Boot Flaw on Patched Windows Systems
BlackX UEFI bootkit infected patched Windows machines, exploiting Secure Boot ambiguities to persist at firmware level.
Monday, November 2
NetamLoader Malware Exploits .NET Injection to Target Asian Government Systems
PremiumNetamLoader uses .NET assembly injection to compromise Windows 10 government builds in Asia, delivering persistent backdoors and tooling.
Compromised Claude Code Extension Briefly Hits Cursor Marketplace
PremiumTrojanized Claude Code extension briefly distributed on Cursor installed SSH backdoors on developer systems.
Friday, October 30
Wednesday, October 28
Flawed Popcorn Time Updater Puts Millions at Risk, But Help Arrives
A Popcorn Time updater ran at boot and executed code served from its update domain with full privileges.
Cybercriminals Exploit Fake FedEx Invoices to Deploy Advanced Sirius Backdoor
Phishing emails with fake FedEx invoices deliver Sirius Backdoor hidden in blank PDFs, loading code directly into memory.
Lazarus Group Exploits South Korean Software for Advanced Malware Deployment
North Korea-linked Lazarus Group used South Korean security software to deploy malware and used post-quantum encryption techniques.
Monday, October 26
Stolen Session Tokens Compromise Microsoft 365 Accounts Across 79 Organizations
PremiumStolen Microsoft 365 session tokens led to account compromises across 79 organizations, enabling unauthorized access and email tampering.
Russian Hackers Exploit New Backdoor in Attack on Ukrainian Logistics
PremiumESET links Sandworm and partners to a destructive wiping attack using a new mesh network backdoor targeting Ukrainian logistics firms.
BlackX Bootkit Targets Central Asian Diplomats by Bypassing Secure Boot Protections
PremiumBlackX UEFI bootkit exploited Baton Drop to bypass Secure Boot, deployed in espionage targeting diplomatic entities in Central Asia.
Friday, October 23
Get these articles delivered to your inbox.
Subscribe free