ThreatVectr

Threat Intelligence — Page 17

An industrial water treatment control room with rows of SCADA monitors and pump system gauges, one screen showing a lockout notification and operator unable to
Threat Intelligence

CISA Warns Hackers Are Breaking Into Water Plant Controllers Left Exposed on the Internet

The US cyber agency says attackers are locking operators out of the small industrial computers that run water systems, forcing boil-water notices and manual operations.

4 min read
A collection of small Android TV streaming sticks arranged on a desk with a computer showing ad-fraud traffic analytics and suspicious network activity maps to
Threat Intelligence

Cheap TV streaming sticks are secretly clicking ads and pretending to be phones

Researchers say around 38,000 H96 Android TV boxes are pulling double duty as ad-fraud bots and residential proxies, funnelling roughly $50,000 a day to a mainland China outfit called the Fengwo Group.

4 min read
A composite image showing multiple computer screens in an office with reused password prompts, fake software installation windows, and phone calls on Teams, all
Threat Intelligence

This Week's Security Roundup: Trust, Trickery, and the Weak Seams Attackers Keep Finding

From reused passwords to fake install guides and abused recruiter calls, this week's incidents share a pattern: attackers exploited the moments people expect a screen to behave normally.

3 min read
A network diagram showing malware removal on the screen, but in the reflection of the monitor glass, an attacker's entry point remains open in the background sh
Threat Intelligence

What Hackers Actually Do After They're Inside Your Network

A Huntress case study shows why cleaning up the malware is only half the job. If you don't find the front door, they walk back in.

4 min read
A Japanese factory floor's industrial control systems monitor showing security tools being disabled by malicious driver exploitation, with system alert windows
Threat Intelligence

Silver Fox Hackers Chain Three Vulnerable Drivers to Plant ValleyRAT on Japanese Factory

The Chinese crew abused legitimate but flawed Windows drivers to switch off security tools before dropping a remote-access trojan.

4 min read
An npm package repository screen showing the hijacked 'Debug' and 'Chalk' packages with suspicious version uploads and download statistics, with attribution mar
Threat Intelligence

Amazon Traces September npm Hijack of Debug and Chalk to North Korean Hackers

What looked like a wallet-draining crypto heist ten months ago now points to Pyongyang, according to fresh analysis from Amazon.

3 min read
A map of Southeast Asia with digital fraud operation networks illustrated, showing cryptocurrency flows and AI-assisted scam infrastructure spread across the re
Threat Intelligence

Southeast Asia's Fraud Factories Have Gone Global

A UN report puts the cost of the region's industrialised cyber-fraud industry at up to $114 billion in 2025. Corruption, cryptocurrency and AI have made it almost impossible to shut down.

4 min read
A computer monitor displaying an email interface with a subtle, barely-visible code injection overlaid on the message list, representing a hidden backdoor plant
Threat Intelligence

Russian hackers used an Outlook Web Access flaw to plant hidden backdoor in mailboxes

Proofpoint says Laundry Bear, tracked as TA488, exploited a zero-day in Microsoft's webmail to install OWAReaper, a stealthy tool that survives password resets and credential rotations.

4 min read
A split-screen showing a legitimate Russian petrochemical company website on one side and an identical fake clone on the other, with payment forms and wire tran
Threat Intelligence

Fake Russian company websites ran a nine-year scam on foreign buyers

Fraudsters cloned real Russian fertilizer and petrochemical firms, then pocketed advance payments from international customers.

3 min read
Illustration: A loading dock at night with a cargo truck parked under harsh
Threat Intelligence

Criminals Are Hijacking Cargo Trucks With Laptops, Not Crowbars

Cargo theft powered by hacking has surged more than 1,500 percent since 2021. The freight industry's patchwork of old systems and thin security budgets has made it an easy mark, and the criminals running these operations are sophisticated enough to move stolen truckloads across borders.

4 min read
A network operations center with analysts examining traffic flows and IP address mappings on large displays, anonymized user profiles being traced back to real
Threat Intelligence

Spur Intelligence Raises $200 Million to Unmask Hidden Internet Traffic

The IP intelligence firm has operated without outside funding since 2017. Now it has the backing to scale tools that help companies see who is really behind anonymised web traffic.

3 min read
A network map showing 170 server nodes spread globally, each connected to a central spyware toolkit icon, with Android phone symbols at the endpoints representi
Threat Intelligence

Flying Eagle Android Spyware Kit Leaks Onto Telegram, Traced to 170 Servers

Researchers link the free-to-copy surveillance toolkit to a fake Chinese police services app aimed at Android phone users.

3 min read
A water treatment plant's control room with darkened screens and disabled automation systems, operators working manually with printed readouts, one facility's g
Threat Intelligence

More Than 30 Minnesota Water Utilities Hit in Coordinated Cyberattack

Attackers knocked out automated controls at water and wastewater plants across the state on July 26 and 27. Drinking water stayed safe, but one city briefly shut its plant down entirely.

3 min read
A developer's IDE with the Joyfill package imported, malicious code highlighted in the dependency tree, a remote-control trojan's command structure revealed in
Threat Intelligence

Booby-trapped @joyfill npm packages hide a remote-control trojan

Two beta versions of the popular Joyfill JavaScript packages were tampered with to plant malware that runs the moment a developer imports them.

4 min read
A smartphone showing dating app and social media interfaces, a conversation thread escalating to sextortion demands, with victims' faces blurred and a backgroun
Threat Intelligence

Matched, Manipulated, Blackmailed: How Sextortion Scams Target Young Men

Organised criminal networks are using dating apps and social media to trap young men into sharing intimate images, then demanding money. Two Australian survivors explain what happened and what they wish they had known.

3 min read
© 2026 Threat Vectr