Vect and TeamPCP partner for ransomware campaigns
Counter Threat Unit™ (CTU) researchers investigated two interconnected threat groups known as Vect and TeamPCP. The two groups announced a...
threat
SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT
Ravie LakshmananJul 01, 2026Malware / SEO Poisoning Unknown threat actors are leveraging the ScreenConnect remote access tool as a way...
Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints
Threat actors are continuing to exploit a critical Langflow vulnerability as part of fresh attacks designed to deliver a Monero...
Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer
An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously...
Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse
Ravie LakshmananJun 29, 2026Cloud Security / Malware A Russian advanced persistent threat (APT) group has continued to evolve and expand...
Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign
Ravie LakshmananJun 26, 2026Cyber Espionage / Malware A Chinese-speaking advanced persistent threat (APT) actor has been linked to a new...
Google Details Turla’s New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks
The Russian state-sponsored threat actor known as Turla has been attributed to a previously undocumented .NET backdoor called STOCKSTAY that...
Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access
Ravie LakshmananJun 25, 2026Vulnerability / Threat Intelligence An unknown threat actor exploited a recently disclosed high-severity security flaw impacting Cisco...
Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments
Ravie LakshmananJun 17, 2026Malware / Social Engineering An unknown threat actor has been observed leveraging paid or promoted posts on...
Suspected North Korean actors use fake ‘coding assignments’ to steal crypto
Suspected North Korean threat actors are targeting developers with fake job offers and “coding assignments” that lead to the deployment...
Nintendo Alleged Data Breach: Threat Actor Demands $2M Ransom
Nintendo is facing a potential incident after a threat actor claimed to have stolen nearly a decade’s worth of internal...
AI in the underground: Curiosity, claims, and concerns
Counter Threat Unit™ (CTU) researchers have observed artificial intelligence (AI) emerging into a prominent topic in underground communities, with threat...
Sophos recognized for endpoint leadership in SE Labs Awards 2026
Simon Edwards (L), SE Labs Founder and CEO, presents awards to Richard Cohen (R), Sophos Threat Research DirectorWe’re proud to...
New Threat Cluster OP-512 Targets Microsoft IIS Servers with Custom Web Shell Framework
Ravie LakshmananJun 05, 2026Cyber Espionage / Threat Intelligence Cybersecurity researchers have discovered a previously unreported threat cluster dubbed OP-512 (where...
Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites
Threat actors are actively exploiting a critical security flaw in Everest Forms Pro, a WordPress plugin with about 4,000 active...
