ThreatVectr

Threat Intelligence — Page 30

Illustration: a dimly lit server room corridor in a Southeast Asian energy utility
Threat Intelligence

TinyRCT Backdoor Surfaces in CL-STA-1062 Intrusions Across Southeast Asia

Palo Alto Networks ties the previously undocumented implant to a Chinese-speaking cluster targeting state-owned energy and government entities.

2 min read
Illustration: a circuit board with a faint green glow emanating from one chip cluster
Threat Intelligence

North Korean Malware Tells AI Analyzers to Look Away

A macOS sample attributed to Pyongyang-linked actors contains prompts designed to make LLM-assisted security tools abandon their analysis. Defenders are starting to notice the pattern.

3 min read
Illustration: a large industrial power substation at dusk, high-voltage transmission lines converging on transformer banks
Threat Intelligence

ASIO Found State Hackers Pre-Positioned for Sabotage Inside Australian Critical Infrastructure

Australia's domestic intelligence agency says a foreign state actor had stolen valid credentials from IT staff at a critical infrastructure operator and was staging for disruption, not just espionage.

2 min read
Illustration: A cracked smartphone screen resting on a dark steel surface
Threat Intelligence

Week in Brief: Russia's Cellebrite Use, Five Eyes AI Warning, macOS Backdoor, Scattered Spider Pleas

State-backed mobile forensics against an activist, an intelligence alliance's AI advisory, a new Mac implant, and a cybercrime case moving toward sentencing.

2 min read
Illustration for the story: Mini Shai-Hulud Worm Jumps to Go, Hits LeoPlatform and RStreams npm Packages
Threat Intelligence

Mini Shai-Hulud Worm Jumps to Go, Hits LeoPlatform and RStreams npm Packages

The self-propagating supply chain campaign tied to Miasma and Hades has spread again, abusing GitHub Actions workflows and now reaching Go modules.

3 min read
Illustration: a dimly lit hotel reception desk at night
Threat Intelligence

Hotel Front Desks Hit by Photo-ZIP Phishing Dropping Node.js Implant

Microsoft flags an unattributed campaign active since April 2026 against hospitality targets in Europe and Asia.

3 min read
Illustration: a dimly lit server rack room with cool blue and amber LED indicators reflecting off polished dark floor tiles
Threat Intelligence

Turla's STOCKSTAY: A Fresh .NET Backdoor Aimed at Kyiv and Rome

Google's threat hunters tie the Russian FSB-linked crew to a previously undocumented Windows implant hitting Ukrainian military targets and Italy-focused diplomatic entities.

3 min read
Illustration: a generic laptop screen showing a blurred unbranded browser window with an abstract puzzle-piece icon glowing
Threat Intelligence

Featured Chrome Ad Blocker with 10M+ Installs Carries Dormant JS Injection Capability

Researchers flagged a Featured-badge extension that can pull and execute remote JavaScript, a capability common to supply-chain abuse clusters tracked across the Chrome Web Store.

3 min read
Illustration: a cluttered office desk at night, glowing keyboard, several browser windows reflected on a dark monitor
Threat Intelligence

The Week in Cheap Crime: Stale Creds, Trusted Apps, and Phishing Through the Front Door

Not elite. Not cinematic. Just effective, and that's the problem.

3 min read
Illustration: a large municipal water treatment facility at dusk, concrete reservoir tanks and pipe infrastructure visible
Threat Intelligence

Iranian Group Handala Claimed It Could Poison California's Water. Forensics Say Otherwise.

California Water Service brought in Mandiant after Handala threatened disruption. Investigators found no evidence the group ever touched operational technology.

3 min read
Illustration: a dimly lit office workstation at night, glow of a generic terminal window reflecting on a glass desk
Threat Intelligence

Mistic Backdoor Shows Up in IAB-Brokered Intrusions Across Four Verticals

A quiet new implant tied to the KongTuke access broker is landing on insurance, education, IT, and professional services networks, and it's not riding a CVE to get there.

3 min read
Illustration: a circuit board with green and amber indicator lights glowing in low light
Threat Intelligence

Mistic Backdoor Ties to IAB Selling Enterprise Footholds to Ransomware Gangs

A new in-memory backdoor named Mistic has been active since April, and the threat actor behind it has reportedly funneled access to Qilin, Akira, Black Basta, and others.

3 min read
Illustration: a darkened server room with one rack physically unplugged, cables draped loose on the floor
Threat Intelligence

Operation Endgame Hits Amadey and StealC, Pulls 27M Credentials From Loader Infrastructure

Europol-led takedown dismantled command servers behind two prolific malware-as-a-service families, with Bitdefender, Bitsight, ESET and Microsoft providing technical support.

3 min read
Illustration: a vast server farm at night, rows of blinking rack lights stretching to the horizon
Threat Intelligence

Law Enforcement and Microsoft Tear Down Command Infrastructure Behind Amadey and StealC

Hundreds of C2 servers went dark in a coordinated takedown targeting the shared hosting backbone used by two prolific infostealer families.

2 min read
Illustration: a rack-mounted enterprise firewall appliance glowing with dim amber status LEDs in a darkened server room
Threat Intelligence

FortiBleed: Russian-Speaking Broker Tied to 430K FortiGate Credential Harvest

Researchers attribute the long-running operation to a financially motivated IAB, with credential lists feeding brute-force runs against exposed FortiGate appliances since February.

3 min read
© 2026 Threat Vectr