ThreatVectr

Threat Intelligence — Page 32

Illustration: a dimly lit apartment workstation in a generic Eastern European city at night
Threat Intelligence

Tracing 'The Gentlemen' RaaS: OPSEC Trail Points to an Izhevsk Operator

A 90/10 affiliate split rocketed the crew to second place by victim count. The administrator's forum breadcrumbs are considerably less disciplined.

3 min read
Illustration: an empty modern law-firm reception desk at dusk
Threat Intelligence

UNC3753 Hit U.S. Professional Services Firms With Vishing and Walk-In Intrusions

Dozens of legal and financial firms were hit between January and May 2026 in a data-theft extortion campaign that blended phone-based social engineering with physical office visits.

3 min read
Illustration: a dark server room with cascading green code reflections on glass partitions
Threat Intelligence

Miasma Self-Replicating Worm Reaches Microsoft GitHub Orgs, 73 Repos Affected

The campaign tracked publicly as Miasma propagated into Azure, Azure-Samples, Microsoft, and MicrosoftDocs before GitHub pulled access.

3 min read
Illustration: a generic Android-
Threat Intelligence

Asin Android Spyware Surfaces in Arabic-Language Lures, ESET Says

ESET ties early-2025 campaigns to decoy sites posing as utilities, war-tracking tools and a fake government news portal.

3 min read
Illustration: a fuel storage tank farm at dusk, large white cylindrical tanks with catwalks and piping
Threat Intelligence

Feds Sound Alarm on Exposed Fuel Tank Gauges as Hackers Probe Critical Infrastructure

CISA, the FBI, NSA and DOE warn that internet-facing ATG systems at fuel depots, hospitals and military sites are being scanned and hit. The fix is mostly operator hygiene.

3 min read
Illustration: a darkened workstation desk with an open laptop showing an abstract file archive extraction interface glowing
Threat Intelligence

Gamaredon Keeps Riding the WinRAR Path-Traversal Bug Into Ukrainian Endpoints

CVE-2025-8088 is months old and patched. The Russian crew is still landing GammaPhish, GammaWorm, and GammaSteel with it.

3 min read
Illustration: a dimly lit operations center at night, blue and amber monitor glow
Threat Intelligence

GREYVIBE: New Russian-Speaking Cluster Tied to Sustained Operations Against Ukraine

Researchers attribute an August 2025 campaign wave to a previously undocumented actor whose tasking patterns align with Kremlin interests.

3 min read
Illustration: AI-driven cyber attack visualization
Threat Intelligence

The Bot That Learned to Lie: Inside the New Generation of AI-Driven DDoS

Defenders describe attack waves that pause, study traffic patterns, and resume from fresh infrastructure, behavior that looks less like a script and more like a sparring partner.

3 min read
Illustration: cybersecurity experts analyzing a network map with highlighted compromised routers
Threat Intelligence

GRU Operators Drained Microsoft 365 Tokens by Rewriting DNS on 18,000 SOHO Routers

Forest Blizzard shifted from targeted router malware to mass DNS hijacking after a UK advisory in August, intercepting OAuth tokens on Outlook on the web.

3 min read
Illustration: A digital representation of cybersecurity chaos, featuring bugs, botnets, and supply chain imagery
Threat Intelligence

The Week the Backlog Came Due: Linux Holes, Defender Zero-Days, and a Poisoned Dev Tool

A messy seven days for defenders, where forgotten servers and trusted tooling did most of the damage.

3 min read
© 2026 Threat Vectr