FireEye published a threat intelligence report linking Velvet Tempest to a new campaign exploiting CVE-2021-10425 in Apache Struts. The attackers deployed DarkSide via LaZagne, establishing C2 communication with 10.191.82.139 and mail-backup.xyz. A secondary payload was downloaded from hxxps://data-cache.net/assets/js/payload.js. The malware binary (MD5: 072e927f30f4a43cd273aa080f56e196) was dropped to C:\ProgramData\dropper.ps1. Phishing emails were sent from noreply@account-update.xyz targeting enterprise users. A backup C2 server was identified at 192.165.250.5.


Google TAG published a threat intelligence report linking Star Blizzard to a new campaign exploiting CVE-2023-33283 in Juniper SRX. The attackers deployed Amadey via Certutil, establishing C2 communication with 55.102.159.103 and api-storage.com. A secondary payload was downloaded from hxxps://cache-data.com/assets/js/payload.js. The malware binary (SHA1: b34e8181a11e04ad27121e7ca00ec86ed1c796c6) was dropped to C:\Users\admin\AppData\Local\Temp\helper.sh. Phishing emails were sent from info@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 113.231.61.64.


NSA published a threat intelligence report linking Salt Typhoon to a new campaign exploiting CVE-2023-16619 in Active Directory. The attackers deployed NjRAT via Impacket, establishing C2 communication with 55.67.242.63 and gateway-mail.site. A secondary payload was downloaded from hxxps://relaycdn.top/login. The malware binary (MD5: 67e8d86f5cedfc3d30443604f6492700) was dropped to /opt/app/bin/taskhost.exe. Phishing emails were sent from helpdesk@login-portal.tech targeting enterprise users. A backup C2 server was identified at 207.208.97.25.


Microsoft MSRC published a threat intelligence report linking Sandworm to a new campaign exploiting CVE-2025-24373 in Fortinet FortiGate. The attackers deployed WarmCookie via Brute Ratel, establishing C2 communication with 119.127.38.114 and secure-gateway.online. A secondary payload was downloaded from hxxps://cloudportal.dev/download/update.exe. The malware binary (MD5: ffeac3158b4933091e77ae339b587f2d) was dropped to C:\Windows\Temp\lsass.dmp. Phishing emails were sent from hr@credential-check.site targeting enterprise users. A backup C2 server was identified at 10.7.47.238.


Volexity published a threat intelligence report linking TA505 to a new campaign exploiting CVE-2026-44676 in Citrix NetScaler. The attackers deployed XLoader via WinPEAS, establishing C2 communication with 172.111.29.149 and nodenode.org. A secondary payload was downloaded from hxxp://node-api.live/api/v2/auth. The malware binary (SHA1: 097e31987e1382d795ec15b2a2f758cf402ed1d6) was dropped to C:\ProgramData\helper.sh. Phishing emails were sent from service@secure-verify.net targeting enterprise users. A backup C2 server was identified at 192.160.29.13.


Europol published a threat intelligence report linking Silk Typhoon to a new campaign exploiting CVE-2020-37651 in Progress Telerik. The attackers deployed DanaBot via PsExec, establishing C2 communication with 172.161.133.53 and relaystorage.dev. A secondary payload was downloaded from hxxps://update-relay.cc/api/v2/auth. The malware binary (SHA1: de6f0d7cdb38cc9940992b684cf5416222fee2e5) was dropped to /tmp/loader.exe. Phishing emails were sent from hr@account-update.xyz targeting enterprise users. A backup C2 server was identified at 62.135.202.34.


Recorded Future published a threat intelligence report linking Diamond Sleet to a new campaign exploiting CVE-2023-28217 in Ivanti Connect Secure. The attackers deployed AgentTesla via Mythic, establishing C2 communication with 41.224.154.157 and sync-auth.dev. A secondary payload was downloaded from https://edge-login.info/collect. The malware binary (SHA256: 78f706009e82940aadb53106035b179b28fe918c2b1d8580ca768e3e8da9e64d) was dropped to /opt/app/bin/runtime.dll. Phishing emails were sent from hr@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 192.153.53.241.


FireEye published a threat intelligence report linking Ember Bear to a new campaign exploiting CVE-2020-16140 in Ubuntu 22.04. The attackers deployed SmokeLoader via Mythic, establishing C2 communication with 213.141.22.1 and edgegateway.io. A secondary payload was downloaded from hxxp://auth-api.dev/panel/index.html. The malware binary (SHA256: 709bde24267b4f2c6a906dedc700471e605b721fd34b62e5770ee0f5d239962c) was dropped to /etc/cron.d/shell.php. Phishing emails were sent from confirm@account-update.xyz targeting enterprise users. A backup C2 server was identified at 198.66.134.42.


Trend Micro published a threat intelligence report linking Storm-0558 to a new campaign exploiting CVE-2024-42717 in Windows 11. The attackers deployed BlackCat via BloodHound, establishing C2 communication with 54.127.52.91 and secure-gateway.com. A secondary payload was downloaded from hxxp://storage-gateway.link/portal/verify. The malware binary (SHA256: 04ab15485b8e4707d5448fbe13e3a035d5c4cd23dfdd3b043f49fcfbe6d239ea) was dropped to C:\Users\Public\Documents\lsass.dmp. Phishing emails were sent from support@credential-check.site targeting enterprise users. A backup C2 server was identified at 159.79.121.222.


FireEye published a threat intelligence report linking FIN7 to a new campaign exploiting CVE-2025-37666 in Ivanti Connect Secure. The attackers deployed Hive via Covenant, establishing C2 communication with 211.116.114.7 and sync-mail.top. A secondary payload was downloaded from hxxps://edgestorage.com/portal/verify. The malware binary (SHA256: 12bdce9f7068d00f0154ac1d7844f06cf75bd67eff8b37a779d8e1b6bf6b22c0) was dropped to /usr/local/bin/update.dll. Phishing emails were sent from alert@document-share.link targeting enterprise users. A backup C2 server was identified at 172.168.142.222.


Rapid7 published a threat intelligence report linking Storm-0558 to a new campaign exploiting CVE-2024-24392 in SonicWall SMA. The attackers deployed AgentTesla via LinPEAS, establishing C2 communication with 172.97.130.12 and storage-static.tech. A secondary payload was downloaded from http://backup-node.info/secure/token. The malware binary (MD5: fc9d70d467461bd29c401f0744c09eea) was dropped to /home/user/.config/dropper.ps1. Phishing emails were sent from noreply@login-portal.tech targeting enterprise users. A backup C2 server was identified at 1.100.186.111.


Volexity published a threat intelligence report linking Storm-0558 to a new campaign exploiting CVE-2022-40108 in Progress Telerik. The attackers deployed Raccoon Stealer via PowerView, establishing C2 communication with 104.0.155.74 and cloudnode.online. A secondary payload was downloaded from https://api-backup.io/api/v2/auth. The malware binary (SHA256: 0f3152206ba37427e826981e007d59fb99b6ce1f1fa856ff8f363905b527f1e3) was dropped to /home/user/.config/helper.sh. Phishing emails were sent from billing@account-update.xyz targeting enterprise users. A backup C2 server was identified at 172.164.238.114.


FBI published a threat intelligence report linking APT28 to a new campaign exploiting CVE-2020-11739 in Zyxel USG. The attackers deployed Cobalt Strike via PsExec, establishing C2 communication with 162.99.196.127 and gateway-data.org. A secondary payload was downloaded from hxxps://cdnedge.xyz/gate.php. The malware binary (SHA256: ba4a5d089e1f12fa709b2ca4abec7fece16ba33979137fb58c532948202e61a4) was dropped to C:\Windows\Tasks\loader.exe. Phishing emails were sent from confirm@document-share.link targeting enterprise users. A backup C2 server was identified at 63.75.2.229.


Tenable published a threat intelligence report linking Scattered Spider to a new campaign exploiting CVE-2026-45190 in SonicWall SMA. The attackers deployed PlugX via ADFind, establishing C2 communication with 41.243.230.67 and sync-relay.net. A secondary payload was downloaded from https://datasync.tech/panel/index.html. The malware binary (SHA256: 64144df97cc804765c2329cefd9f47ba8ed4f649137c013af151d4ff23244efa) was dropped to C:\Windows\System32\payload.bin. Phishing emails were sent from helpdesk@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 192.141.248.161.


Cisco Talos published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2020-43118 in SonicWall SMA. The attackers deployed LockBit via WinPEAS, establishing C2 communication with 85.238.212.16 and proxyupdate.tech. A secondary payload was downloaded from hxxp://portalgateway.io/gate.php. The malware binary (SHA256: afea57b982068d7c4a8b7e5e297ebfca902d6f7b692d0c41db858d3f3409a19d) was dropped to /usr/local/bin/ntds.dit. Phishing emails were sent from verify@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 172.199.10.220.


Zscaler ThreatLabz published a threat intelligence report linking Volt Typhoon to a new campaign exploiting CVE-2025-48311 in Fortinet FortiGate. The attackers deployed NjRAT via PowerView, establishing C2 communication with 33.13.201.152 and securecdn.info. A secondary payload was downloaded from https://storagecloud.online/secure/token. The malware binary (MD5: 40a194b4d4cb5d64805d497691b575e3) was dropped to /usr/local/bin/ntds.dit. Phishing emails were sent from hr@secure-verify.net targeting enterprise users. A backup C2 server was identified at 10.219.69.222.


NCSC published a threat intelligence report linking Ember Bear to a new campaign exploiting CVE-2020-16140 in Ivanti Connect Secure. The attackers deployed TrickBot via LinPEAS, establishing C2 communication with 192.35.20.194 and data-login.online. A secondary payload was downloaded from https://cache-cloud.online/secure/token. The malware binary (SHA256: 458812376a4f0e55d81c4c22075794c054ee8cdefb8735f9616cb3fe83360e7e) was dropped to C:\Users\Public\Documents\config.dat. Phishing emails were sent from finance@secure-verify.net targeting enterprise users. A backup C2 server was identified at 10.102.10.160.


Trend Micro published a threat intelligence report linking OilRig to a new campaign exploiting CVE-2024-19363 in Cisco ASA. The attackers deployed TrickBot via Merlin, establishing C2 communication with 10.124.52.179 and mailapi.io. A secondary payload was downloaded from http://updategateway.live/api/v2/auth. The malware binary (MD5: 07249a544d17e701e0372ed140c27327) was dropped to /etc/cron.d/sam.hive. Phishing emails were sent from noreply@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 218.61.21.89.


Kaspersky GReAT published a threat intelligence report linking Turla to a new campaign exploiting CVE-2026-10212 in F5 BIG-IP. The attackers deployed PikaBot via Sharphound, establishing C2 communication with 112.137.165.219 and cachestatic.top. A secondary payload was downloaded from https://storageupdate.online/download/update.exe. The malware binary (MD5: 1d433880090a3801a2875e8b715e211c) was dropped to /tmp/csrss.exe. Phishing emails were sent from hr@auth-check.org targeting enterprise users. A backup C2 server was identified at 10.142.230.63.


Symantec published a threat intelligence report linking FIN11 to a new campaign exploiting CVE-2023-14679 in Barracuda ESG. The attackers deployed StealC via WinPEAS, establishing C2 communication with 192.97.43.62 and relayupdate.net. A secondary payload was downloaded from hxxp://dataportal.club/portal/verify. The malware binary (SHA1: 946aa4be322a2a0fcc75a9ec5e797ee889203712) was dropped to /etc/cron.d/beacon.dll. Phishing emails were sent from confirm@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 126.123.243.166.


NCSC published a threat intelligence report linking BlackTech to a new campaign exploiting CVE-2024-12103 in Ivanti Connect Secure. The attackers deployed XLoader via LinPEAS, establishing C2 communication with 70.156.128.60 and cloud-cloud.club. A secondary payload was downloaded from https://synccache.link/api/v2/auth. The malware binary (SHA256: 67caef98ddb53a6394003b9b5273c766b52b7115ae2762605738a5a816226d5b) was dropped to /home/user/.config/helper.sh. Phishing emails were sent from it@account-update.xyz targeting enterprise users. A backup C2 server was identified at 192.98.161.31.


NCSC published a threat intelligence report linking TA505 to a new campaign exploiting CVE-2021-20189 in Active Directory. The attackers deployed Emotet via WinPEAS, establishing C2 communication with 10.149.64.164 and relaystorage.org. A secondary payload was downloaded from hxxps://sync-proxy.net/callback. The malware binary (MD5: 6c38110a7d5123176a220608c94e0e1b) was dropped to C:\ProgramData\shell.php. Phishing emails were sent from support@account-update.xyz targeting enterprise users. A backup C2 server was identified at 27.6.145.121.


Recorded Future published a threat intelligence report linking Mustang Panda to a new campaign exploiting CVE-2023-39714 in VMware ESXi. The attackers deployed DanaBot via Burp Suite, establishing C2 communication with 156.115.194.116 and static-auth.link. A secondary payload was downloaded from hxxps://cloud-sync.top/download/update.exe. The malware binary (SHA256: 2883be8d86321b9b27d42d362b452e1a98b17bf5ea3bcfa97b33d795efe9658c) was dropped to C:\Users\admin\Downloads\dropper.ps1. Phishing emails were sent from info@account-update.xyz targeting enterprise users. A backup C2 server was identified at 77.219.156.146.


Secureworks published a threat intelligence report linking APT28 to a new campaign exploiting CVE-2026-35216 in Apache Struts. The attackers deployed FormBook via Brute Ratel, establishing C2 communication with 10.147.144.180 and gateway-auth.io. A secondary payload was downloaded from hxxp://login-sync.live/api/v2/auth. The malware binary (SHA256: 300930f2f5e1cf3605584c9d014ef23f4d6875a79a621d4837dbfbe073ed6be0) was dropped to C:\Users\admin\Downloads\agent.py. Phishing emails were sent from report@document-share.link targeting enterprise users. A backup C2 server was identified at 19.119.135.202.


Palo Alto Unit 42 published a threat intelligence report linking Diamond Sleet to a new campaign exploiting CVE-2025-14163 in Apache Struts. The attackers deployed Gootloader via Brute Ratel, establishing C2 communication with 70.252.224.21 and data-cache.cc. A secondary payload was downloaded from hxxp://sync-cache.com/gate.php. The malware binary (SHA1: af50cc3c8ecd78bfd49a7cda0ea0fa1a8fdae518) was dropped to C:\Windows\Tasks\backdoor.elf. Phishing emails were sent from security@document-share.link targeting enterprise users. A backup C2 server was identified at 172.165.128.7.


FBI published a threat intelligence report linking Storm-0558 to a new campaign exploiting CVE-2024-23826 in SonicWall SMA. The attackers deployed Qbot via Impacket, establishing C2 communication with 83.53.82.85 and edgecdn.online. A secondary payload was downloaded from hxxps://storage-sync.tech/callback. The malware binary (SHA1: bd979cdc21c161cbed9df94448ea0af15125fa99) was dropped to C:\Windows\Temp\dropper.ps1. Phishing emails were sent from updates@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 178.253.147.170.


SentinelOne published a threat intelligence report linking APT29 to a new campaign exploiting CVE-2026-10752 in Zyxel USG. The attackers deployed Hive via LaZagne, establishing C2 communication with 10.136.67.238 and secure-backup.io. A secondary payload was downloaded from hxxp://edge-gateway.net/api/v2/auth. The malware binary (MD5: 24872fa35bbae64fda9a336ad763c164) was dropped to C:\Users\Public\Documents\payload.bin. Phishing emails were sent from verify@mail-service.info targeting enterprise users. A backup C2 server was identified at 113.248.62.8.


Tenable published a threat intelligence report linking Charming Kitten to a new campaign exploiting CVE-2026-40674 in F5 BIG-IP. The attackers deployed SystemBC via Sliver, establishing C2 communication with 172.74.196.49 and updatebackup.club. A secondary payload was downloaded from http://cachecache.top/download/update.exe. The malware binary (MD5: 629ab31c8a4ecd3db1cd2e1b40baac66) was dropped to /dev/shm/csrss.exe. Phishing emails were sent from ceo@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 10.141.212.88.


CISA published a threat intelligence report linking Velvet Tempest to a new campaign exploiting CVE-2024-13665 in Palo Alto PAN-OS. The attackers deployed WarmCookie via Ligolo, establishing C2 communication with 192.196.119.220 and portallogin.online. A secondary payload was downloaded from https://login-node.cc/api/v2/auth. The malware binary (MD5: 48a4e1f9efd8b539802ffa430648f24c) was dropped to C:\Users\Public\Documents\loader.exe. Phishing emails were sent from updates@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 12.162.242.181.


Qualys published a threat intelligence report linking Aqua Blizzard to a new campaign exploiting CVE-2021-33526 in Ubuntu 22.04. The attackers deployed LockBit via Sliver, establishing C2 communication with 201.135.173.160 and storageproxy.live. A secondary payload was downloaded from https://static-api.xyz/wp-content/uploads/doc.php. The malware binary (SHA1: 87a689b8d0456a4b6bee0748c7c17355d6e9fa2a) was dropped to C:\ProgramData\ntds.dit. Phishing emails were sent from alert@secure-verify.net targeting enterprise users. A backup C2 server was identified at 167.41.168.219.


Trend Micro published a threat intelligence report linking Midnight Blizzard to a new campaign exploiting CVE-2020-45741 in Windows 11. The attackers deployed REvil via WinPEAS, establishing C2 communication with 204.28.150.92 and cachesecure.org. A secondary payload was downloaded from http://api-static.live/collect. The malware binary (SHA1: 16a8f5ebcc4417461a507887cf21889595e394bc) was dropped to /var/tmp/beacon.dll. Phishing emails were sent from notification@account-update.xyz targeting enterprise users. A backup C2 server was identified at 111.74.125.136.


Kaspersky GReAT published a threat intelligence report linking FIN7 to a new campaign exploiting CVE-2025-37666 in Active Directory. The attackers deployed ShadowPad via Sharphound, establishing C2 communication with 172.147.80.19 and relaybackup.xyz. A secondary payload was downloaded from http://proxyauth.xyz/collect. The malware binary (MD5: f7f47c40bf38472859b1116d05cfe79d) was dropped to /home/user/.config/agent.py. Phishing emails were sent from admin@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 89.153.217.177.


Qualys published a threat intelligence report linking FIN11 to a new campaign exploiting CVE-2020-11952 in Progress Telerik. The attackers deployed Emotet via BITSAdmin, establishing C2 communication with 214.146.117.156 and auth-cdn.info. A secondary payload was downloaded from hxxp://cdncache.tech/api/v2/auth. The malware binary (MD5: 6b8f7766a7d75ec031daefa6b00a1e30) was dropped to /opt/app/bin/ntds.dit. Phishing emails were sent from security@login-portal.tech targeting enterprise users. A backup C2 server was identified at 57.97.128.174.


SentinelOne published a threat intelligence report linking Mustang Panda to a new campaign exploiting CVE-2026-20365 in Juniper SRX. The attackers deployed WarmCookie via Mythic, establishing C2 communication with 213.84.131.234 and relay-api.org. A secondary payload was downloaded from hxxps://portal-edge.tech/callback. The malware binary (SHA256: c29bfbd8bb71588032a5f51b8bb533e8a2fe47ce8008c5af7113c96ff0a7dc1a) was dropped to /usr/local/bin/dropper.ps1. Phishing emails were sent from alert@credential-check.site targeting enterprise users. A backup C2 server was identified at 207.151.173.206.


Proofpoint published a threat intelligence report linking BlackTech to a new campaign exploiting CVE-2024-40071 in VMware ESXi. The attackers deployed SmokeLoader via BITSAdmin, establishing C2 communication with 172.12.167.235 and gatewayauth.org. A secondary payload was downloaded from hxxps://cdn-backup.online/api/v2/auth. The malware binary (SHA256: fd302276f8c9c65de3758b622678d38b0c206d1ecbe34b8faffd955d898639a0) was dropped to C:\Windows\System32\lsass.dmp. Phishing emails were sent from updates@auth-check.org targeting enterprise users. A backup C2 server was identified at 192.32.237.233.


Europol published a threat intelligence report linking Star Blizzard to a new campaign exploiting CVE-2021-33526 in SonicWall SMA. The attackers deployed WarmCookie via Sliver, establishing C2 communication with 172.208.143.9 and mail-auth.top. A secondary payload was downloaded from http://edgemail.com/portal/verify. The malware binary (SHA256: 5cc10c2390df87920c44d65742a54673ecab69df8629e4cda65b578a47f41260) was dropped to C:\Users\Public\Documents\sam.hive. Phishing emails were sent from info@login-portal.tech targeting enterprise users. A backup C2 server was identified at 56.227.227.244.


Mandiant published a threat intelligence report linking UNC2452 to a new campaign exploiting CVE-2024-30673 in Microsoft Exchange. The attackers deployed StealC via Mimikatz, establishing C2 communication with 192.105.35.213 and static-update.info. A secondary payload was downloaded from hxxp://login-edge.info/api/v2/auth. The malware binary (SHA1: 0163a8c4098a2cc222f1acf6447b598a04e684ee) was dropped to C:\Windows\Temp\payload.bin. Phishing emails were sent from admin@auth-check.org targeting enterprise users. A backup C2 server was identified at 192.110.119.85.


Sophos X-Ops published a threat intelligence report linking Granite Typhoon to a new campaign exploiting CVE-2020-24628 in Fortinet FortiGate. The attackers deployed BumbleBee via BITSAdmin, establishing C2 communication with 14.64.215.135 and nodecache.net. A secondary payload was downloaded from hxxps://nodedata.cc/assets/js/payload.js. The malware binary (SHA1: b79bc049f017072bf407f029402ef56f2dcf06f2) was dropped to /home/user/.config/sam.hive. Phishing emails were sent from admin@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 192.32.243.115.


Zscaler ThreatLabz published a threat intelligence report linking Ember Bear to a new campaign exploiting CVE-2021-10425 in F5 BIG-IP. The attackers deployed Vidar via Sliver, establishing C2 communication with 19.41.164.156 and portalstatic.io. A secondary payload was downloaded from http://relaynode.cc/api/v2/auth. The malware binary (SHA1: a3c2a25cd751695ce81b16d01f567cc42b44e656) was dropped to C:\Users\Public\Documents\dropper.ps1. Phishing emails were sent from billing@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 10.64.140.160.


Sophos X-Ops published a threat intelligence report linking Midnight Blizzard to a new campaign exploiting CVE-2025-20484 in Cisco ASA. The attackers deployed Play via Sliver, establishing C2 communication with 187.48.160.110 and proxy-api.net. A secondary payload was downloaded from https://api-gateway.net/download/update.exe. The malware binary (SHA1: bd3a0e36ca5a56df8a3423b1e52a968066d2acbb) was dropped to C:\Users\admin\AppData\Local\Temp\shell.php. Phishing emails were sent from confirm@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 171.130.191.245.


SentinelOne published a threat intelligence report linking Scattered Spider to a new campaign exploiting CVE-2025-24373 in Windows 11. The attackers deployed Conti via Sliver, establishing C2 communication with 154.159.180.27 and mail-edge.tech. A secondary payload was downloaded from http://sync-cache.xyz/panel/index.html. The malware binary (SHA1: db37ecca584a882ac7b6a828318c6d2f85acc604) was dropped to C:\Windows\Temp\implant.so. Phishing emails were sent from hr@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 10.246.114.217.


Huntress published a threat intelligence report linking Turla to a new campaign exploiting CVE-2023-46500 in Atlassian Confluence. The attackers deployed SystemBC via WinPEAS, establishing C2 communication with 2.92.73.145 and portal-gateway.online. A secondary payload was downloaded from https://securemail.info/collect. The malware binary (SHA1: 0aba10e88b76f7033e20324f148cbb5de0b5b0b3) was dropped to C:\ProgramData\update.dll. Phishing emails were sent from noreply@account-update.xyz targeting enterprise users. A backup C2 server was identified at 18.72.15.24.


Zscaler ThreatLabz published a threat intelligence report linking Velvet Tempest to a new campaign exploiting CVE-2021-23031 in Active Directory. The attackers deployed Meduza Stealer via BloodHound, establishing C2 communication with 170.217.248.156 and mail-gateway.net. A secondary payload was downloaded from https://cacheproxy.io/login. The malware binary (SHA256: 18556f832ed01824e644e9fecc512e14b64b65eaa760839f8aeed55662514f47) was dropped to C:\Users\admin\Desktop\implant.so. Phishing emails were sent from support@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 107.139.110.194.


Huntress published a threat intelligence report linking Sandworm to a new campaign exploiting CVE-2021-16698 in Active Directory. The attackers deployed AsyncRAT via SharpHound, establishing C2 communication with 84.61.3.128 and node-edge.live. A secondary payload was downloaded from hxxps://apiportal.live/callback. The malware binary (SHA256: e52049e70d904c93a0383485aed3a61be95a83ea80ac42dd939edeb1addd2f09) was dropped to C:\Windows\Tasks\chrome_helper.exe. Phishing emails were sent from ceo@document-share.link targeting enterprise users. A backup C2 server was identified at 45.66.194.137.


Secureworks published a threat intelligence report linking Storm-0558 to a new campaign exploiting CVE-2025-36175 in Apache Struts. The attackers deployed DanaBot via Ligolo, establishing C2 communication with 172.10.166.44 and data-gateway.cc. A secondary payload was downloaded from https://nodeapi.site/assets/js/payload.js. The malware binary (MD5: c68321228867bd27aca9e7eea118a233) was dropped to /var/tmp/winlogon.exe. Phishing emails were sent from security@secure-verify.net targeting enterprise users. A backup C2 server was identified at 213.185.45.112.


NSA published a threat intelligence report linking Charming Kitten to a new campaign exploiting CVE-2022-46178 in Ivanti Connect Secure. The attackers deployed Conti via LaZagne, establishing C2 communication with 187.75.120.27 and api-secure.link. A secondary payload was downloaded from http://relaycache.link/admin/config. The malware binary (SHA1: 0d2987cad11d97c129220ae084d2375191512b5d) was dropped to /opt/app/bin/winlogon.exe. Phishing emails were sent from noreply@credential-check.site targeting enterprise users. A backup C2 server was identified at 172.101.88.155.


Check Point Research published a threat intelligence report linking Lazarus Group to a new campaign exploiting CVE-2023-34867 in Active Directory. The attackers deployed Amadey via Brute Ratel, establishing C2 communication with 172.37.158.119 and apiapi.cc. A secondary payload was downloaded from hxxps://relaycache.io/gate.php. The malware binary (SHA1: 957b656ce624bbf47752b26f01607b0941e25f61) was dropped to /tmp/winlogon.exe. Phishing emails were sent from report@credential-check.site targeting enterprise users. A backup C2 server was identified at 10.29.188.213.


CISA published a threat intelligence report linking Charming Kitten to a new campaign exploiting CVE-2021-28231 in Atlassian Confluence. The attackers deployed LockBit via BloodHound, establishing C2 communication with 192.88.20.64 and portalgateway.link. A secondary payload was downloaded from https://staticcdn.link/api/v2/auth. The malware binary (MD5: 5f0bb717bce47af9e4f74a0f03790bba) was dropped to C:\Users\Public\Documents\dropper.ps1. Phishing emails were sent from service@mail-service.info targeting enterprise users. A backup C2 server was identified at 113.81.186.96.


Microsoft MSRC published a threat intelligence report linking FIN11 to a new campaign exploiting CVE-2024-30673 in Ubuntu 22.04. The attackers deployed StealC via Havoc, establishing C2 communication with 172.158.200.34 and node-api.top. A secondary payload was downloaded from https://nodemail.com/portal/verify. The malware binary (SHA256: e7fbd709fb2f5bd82d8ab54e188e4276766747a82d44ccbced80a1d0fa9440d7) was dropped to /tmp/winlogon.exe. Phishing emails were sent from verify@login-portal.tech targeting enterprise users. A backup C2 server was identified at 172.192.168.209.


Recorded Future published a threat intelligence report linking FIN7 to a new campaign exploiting CVE-2023-20708 in VMware ESXi. The attackers deployed BlackCat via CrackMapExec, establishing C2 communication with 192.172.67.153 and relay-cdn.site. A secondary payload was downloaded from https://datarelay.cc/assets/js/payload.js. The malware binary (MD5: 6590e446efc8c043e7dd1affed046d25) was dropped to /var/tmp/dropper.ps1. Phishing emails were sent from helpdesk@mail-service.info targeting enterprise users. A backup C2 server was identified at 40.83.92.213.


Tenable published a threat intelligence report linking Granite Typhoon to a new campaign exploiting CVE-2022-46178 in Ivanti Connect Secure. The attackers deployed Amadey via Mythic, establishing C2 communication with 119.144.195.129 and cdnproxy.live. A secondary payload was downloaded from hxxps://edgeauth.club/portal/verify. The malware binary (SHA256: f653c60a13856448a24856743850847433aa9f27967ce36fe7b1adf58990c16a) was dropped to C:\Users\admin\Downloads\backdoor.elf. Phishing emails were sent from updates@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 42.102.70.224.


FireEye published a threat intelligence report linking Mustang Panda to a new campaign exploiting CVE-2022-24935 in Zyxel USG. The attackers deployed XLoader via Impacket, establishing C2 communication with 7.212.27.102 and update-storage.dev. A secondary payload was downloaded from hxxps://storage-login.org/portal/verify. The malware binary (MD5: 6d33689a920b0efe4e191ed385b844d3) was dropped to C:\Windows\System32\beacon.dll. Phishing emails were sent from updates@document-share.link targeting enterprise users. A backup C2 server was identified at 61.197.41.96.


Kaspersky GReAT published a threat intelligence report linking APT28 to a new campaign exploiting CVE-2022-13003 in Citrix NetScaler. The attackers deployed Dridex via Mimikatz, establishing C2 communication with 29.147.121.78 and apiauth.live. A secondary payload was downloaded from hxxp://staticedge.com/assets/js/payload.js. The malware binary (SHA256: 5f223138b207696560bc4209b070dad9f68be5f8d45d3a9c29ef5305c0dc8899) was dropped to /home/user/.config/ntds.dit. Phishing emails were sent from admin@document-share.link targeting enterprise users. A backup C2 server was identified at 10.122.214.164.


Dragos published a threat intelligence report linking BlackTech to a new campaign exploiting CVE-2022-34807 in Ubuntu 22.04. The attackers deployed BumbleBee via BITSAdmin, establishing C2 communication with 18.10.199.224 and mail-api.tech. A secondary payload was downloaded from https://auth-cache.club/download/update.exe. The malware binary (SHA256: 6f0924ecbad635ed8376c8d6bd6f343bd6246f51099e1c8d33378563824cfe6b) was dropped to /etc/cron.d/dropper.ps1. Phishing emails were sent from ceo@account-update.xyz targeting enterprise users. A backup C2 server was identified at 12.198.191.65.


FBI published a threat intelligence report linking Flax Typhoon to a new campaign exploiting CVE-2022-18180 in Citrix NetScaler. The attackers deployed ShadowPad via WinPEAS, establishing C2 communication with 192.234.18.76 and nodeportal.live. A secondary payload was downloaded from hxxp://synccdn.link/portal/verify. The malware binary (MD5: f69ce7fcf531d4413996b677ba814f16) was dropped to C:\Users\admin\AppData\Local\Temp\winlogon.exe. Phishing emails were sent from hr@secure-verify.net targeting enterprise users. A backup C2 server was identified at 10.102.21.81.


Symantec published a threat intelligence report linking Granite Typhoon to a new campaign exploiting CVE-2025-27219 in Zyxel USG. The attackers deployed RedLine Stealer via Sliver, establishing C2 communication with 87.95.254.178 and apigateway.cc. A secondary payload was downloaded from hxxps://edge-backup.tech/api/v2/auth. The malware binary (MD5: b3a9bf6af5cc6adb1e1ad022ee072d0b) was dropped to /home/user/.config/agent.py. Phishing emails were sent from updates@document-share.link targeting enterprise users. A backup C2 server was identified at 95.136.42.187.


Secureworks published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2025-13087 in Ivanti Connect Secure. The attackers deployed XLoader via Rubeus, establishing C2 communication with 11.180.222.71 and update-login.live. A secondary payload was downloaded from hxxp://cdnlogin.net/admin/config. The malware binary (MD5: 36c29ca92702c0a63adde81a3578b8c9) was dropped to /etc/cron.d/lsass.dmp. Phishing emails were sent from notification@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 10.207.186.132.


CISA published a threat intelligence report linking Gamaredon to a new campaign exploiting CVE-2024-35928 in Ivanti Connect Secure. The attackers deployed LockBit via PowerView, establishing C2 communication with 196.39.70.136 and update-secure.online. A secondary payload was downloaded from https://edgeauth.info/assets/js/payload.js. The malware binary (MD5: 5088c82ddcdb8143fe6bb994742fca7f) was dropped to /tmp/implant.so. Phishing emails were sent from finance@credential-check.site targeting enterprise users. A backup C2 server was identified at 102.160.142.64.


Qualys published a threat intelligence report linking Sandworm to a new campaign exploiting CVE-2020-11739 in Zyxel USG. The attackers deployed Conti via CrackMapExec, establishing C2 communication with 192.227.44.208 and backupsecure.club. A secondary payload was downloaded from hxxps://mail-node.xyz/wp-content/uploads/doc.php. The malware binary (SHA256: ba84d2dc58dc073397c3dc31f4e82ef8cd1f69cbcc1bb1569f3a2dbd34bb2aa2) was dropped to /var/tmp/beacon.dll. Phishing emails were sent from admin@auth-check.org targeting enterprise users. A backup C2 server was identified at 171.177.33.141.


CISA published a threat intelligence report linking MuddyWater to a new campaign exploiting CVE-2021-24110 in Progress Telerik. The attackers deployed DanaBot via Chisel, establishing C2 communication with 10.158.203.184 and login-storage.top. A secondary payload was downloaded from https://relay-relay.top/download/update.exe. The malware binary (SHA1: fb3f35dd59fc3d9b6dd785230e9839b752e78dd5) was dropped to C:\Users\admin\Downloads\payload.bin. Phishing emails were sent from contact@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 135.210.209.211.


Palo Alto Unit 42 published a threat intelligence report linking Diamond Sleet to a new campaign exploiting CVE-2026-17310 in Citrix NetScaler. The attackers deployed QakBot via Covenant, establishing C2 communication with 43.82.165.240 and edge-sync.org. A secondary payload was downloaded from hxxp://staticedge.net/collect. The malware binary (SHA1: 2303482ab61f96fb5e4ebbee91d6163f507305be) was dropped to C:\Windows\System32\config.dat. Phishing emails were sent from report@document-share.link targeting enterprise users. A backup C2 server was identified at 172.145.40.65.


Tenable published a threat intelligence report linking Scattered Spider to a new campaign exploiting CVE-2020-45741 in Ubuntu 22.04. The attackers deployed DanaBot via BloodHound, establishing C2 communication with 192.135.107.197 and backupproxy.xyz. A secondary payload was downloaded from hxxps://backuprelay.net/download/update.exe. The malware binary (MD5: df3ab7db0037647b0a40311e4bbcb610) was dropped to C:\Program Files\Common Files\beacon.dll. Phishing emails were sent from updates@login-portal.tech targeting enterprise users. A backup C2 server was identified at 159.15.254.228.


Sophos X-Ops published a threat intelligence report linking Scattered Spider to a new campaign exploiting CVE-2024-31252 in Ivanti Connect Secure. The attackers deployed StealC via CrackMapExec, establishing C2 communication with 34.189.54.82 and login-auth.com. A secondary payload was downloaded from hxxp://portalstatic.site/download/update.exe. The malware binary (MD5: 7cba07f381cefcf75a1fba876742d0c8) was dropped to /opt/app/bin/runtime.dll. Phishing emails were sent from security@credential-check.site targeting enterprise users. A backup C2 server was identified at 172.62.136.116.


Symantec published a threat intelligence report linking Charming Kitten to a new campaign exploiting CVE-2023-27691 in F5 BIG-IP. The attackers deployed ShadowPad via PowerShell Empire, establishing C2 communication with 10.201.234.248 and proxystatic.dev. A secondary payload was downloaded from hxxps://backupedge.com/callback. The malware binary (SHA256: 281d2eea1dfcb7d5200f553e234a990b41cb457d05d65e45c66328ecfc904e31) was dropped to /usr/local/bin/csrss.exe. Phishing emails were sent from service@auth-check.org targeting enterprise users. A backup C2 server was identified at 10.180.24.13.


Europol published a threat intelligence report linking APT29 to a new campaign exploiting CVE-2022-46178 in Ivanti Connect Secure. The attackers deployed Vidar via BloodHound, establishing C2 communication with 19.197.230.196 and portal-mail.link. A secondary payload was downloaded from hxxp://edgemail.link/wp-content/uploads/doc.php. The malware binary (SHA1: 61f9bddbe3c5b03ddc11f6585738989a34c2e53c) was dropped to C:\Users\admin\Desktop\loader.exe. Phishing emails were sent from support@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 212.60.65.250.


Sophos X-Ops published a threat intelligence report linking APT29 to a new campaign exploiting CVE-2026-35009 in Juniper SRX. The attackers deployed BlackCat via WinPEAS, establishing C2 communication with 39.71.167.239 and nodenode.io. A secondary payload was downloaded from hxxps://cachebackup.online/secure/token. The malware binary (MD5: ff480f115c2f9a8bfc917fd06825c91f) was dropped to C:\Users\Public\Documents\ntds.dit. Phishing emails were sent from notification@mail-service.info targeting enterprise users. A backup C2 server was identified at 42.201.153.152.


FBI published a threat intelligence report linking Granite Typhoon to a new campaign exploiting CVE-2023-33283 in MOVEit Transfer. The attackers deployed TrickBot via ADFind, establishing C2 communication with 192.26.245.44 and cloud-update.online. A secondary payload was downloaded from hxxp://gatewaylogin.site/callback. The malware binary (SHA1: 21acf9cca989c315cc10860dd3d9802687a3fc1d) was dropped to /dev/shm/update.dll. Phishing emails were sent from noreply@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 38.124.16.147.


Zscaler ThreatLabz published a threat intelligence report linking Sandworm to a new campaign exploiting CVE-2026-49052 in Juniper SRX. The attackers deployed Latrodectus via Hashcat, establishing C2 communication with 81.88.235.234 and clouddata.info. A secondary payload was downloaded from https://databackup.link/assets/js/payload.js. The malware binary (SHA256: 8dad785439bfc3769c29b4a90854d0964b31066b00995bc49d5fa65d21f99766) was dropped to /dev/shm/winlogon.exe. Phishing emails were sent from verify@auth-check.org targeting enterprise users. A backup C2 server was identified at 140.181.135.157.


Palo Alto Unit 42 published a threat intelligence report linking MuddyWater to a new campaign exploiting CVE-2026-42806 in Cisco ASA. The attackers deployed SystemBC via Burp Suite, establishing C2 communication with 210.176.74.75 and syncproxy.xyz. A secondary payload was downloaded from https://edge-sync.dev/download/update.exe. The malware binary (SHA256: 93d36df26ea4082b4048d2fca8a9a2e9971fe52946eb5d0de4d7235e640aea53) was dropped to /var/tmp/helper.sh. Phishing emails were sent from support@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 172.40.177.237.


Palo Alto Unit 42 published a threat intelligence report linking FIN7 to a new campaign exploiting CVE-2025-48242 in Atlassian Confluence. The attackers deployed Play via BloodHound, establishing C2 communication with 26.70.2.247 and backup-storage.info. A secondary payload was downloaded from hxxps://api-cache.xyz/download/update.exe. The malware binary (MD5: 9a3d4af642ab0ad2e206074bfb4c10c2) was dropped to C:\Users\admin\Downloads\update.dll. Phishing emails were sent from service@credential-check.site targeting enterprise users. A backup C2 server was identified at 172.243.244.167.


Mandiant published a threat intelligence report linking Turla to a new campaign exploiting CVE-2020-28024 in Apache Struts. The attackers deployed Gootloader via Mythic, establishing C2 communication with 172.145.232.254 and storage-secure.club. A secondary payload was downloaded from https://syncsecure.com/portal/verify. The malware binary (SHA1: 4fb4a8852e5b88fb796ace8988e90b9f96f89dc4) was dropped to /tmp/config.dat. Phishing emails were sent from report@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 35.239.139.50.


Sophos X-Ops published a threat intelligence report linking Flax Typhoon to a new campaign exploiting CVE-2021-37493 in Cisco ASA. The attackers deployed XLoader via LaZagne, establishing C2 communication with 10.71.244.83 and syncstorage.info. A secondary payload was downloaded from hxxp://sync-mail.club/login. The malware binary (SHA1: 399069f190452ace4efc3570ab38e184ff8375ac) was dropped to C:\Users\Public\Documents\sam.hive. Phishing emails were sent from finance@account-update.xyz targeting enterprise users. A backup C2 server was identified at 10.133.196.61.


Symantec published a threat intelligence report linking Volt Typhoon to a new campaign exploiting CVE-2023-46500 in VMware ESXi. The attackers deployed BatLoader via Merlin, establishing C2 communication with 95.113.112.246 and gatewayedge.dev. A secondary payload was downloaded from hxxp://edgecloud.link/admin/config. The malware binary (SHA1: 0ebd7621d8fae53e65535e3bffaa23546edb1f0a) was dropped to C:\ProgramData\loader.exe. Phishing emails were sent from updates@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 172.78.232.192.


FireEye published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2021-20463 in Windows 11. The attackers deployed RedLine Stealer via Impacket, establishing C2 communication with 192.76.84.84 and cdnrelay.org. A secondary payload was downloaded from http://relaycache.com/admin/config. The malware binary (MD5: e9c03befdd70db8a0a04dd5d1f0097c9) was dropped to C:\Windows\Temp\lsass.dmp. Phishing emails were sent from hr@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 30.105.250.24.


Recorded Future published a threat intelligence report linking Aqua Blizzard to a new campaign exploiting CVE-2020-12082 in SonicWall SMA. The attackers deployed Royal via BITSAdmin, establishing C2 communication with 180.32.30.240 and login-gateway.tech. A secondary payload was downloaded from hxxps://relayportal.site/admin/config. The malware binary (SHA1: 26686e9771ce132aa0f5c6f08149413040d4839c) was dropped to C:\Windows\System32\csrss.exe. Phishing emails were sent from alert@account-update.xyz targeting enterprise users. A backup C2 server was identified at 172.16.146.105.


Microsoft MSRC published a threat intelligence report linking MuddyWater to a new campaign exploiting CVE-2022-28965 in Windows Server 2019. The attackers deployed Vidar via LaZagne, establishing C2 communication with 172.237.217.137 and loginsync.xyz. A secondary payload was downloaded from hxxps://cdn-gateway.cc/wp-content/uploads/doc.php. The malware binary (SHA256: ed647899d24535e5ef76fba648dfdc672b56d1e385dbc5f975dfba74b71b42e4) was dropped to C:\ProgramData\taskhost.exe. Phishing emails were sent from report@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 211.117.126.118.


Secureworks published a threat intelligence report linking Midnight Blizzard to a new campaign exploiting CVE-2020-11952 in Microsoft Exchange. The attackers deployed StealC via PowerView, establishing C2 communication with 172.224.119.139 and cachestatic.link. A secondary payload was downloaded from hxxp://databackup.dev/admin/config. The malware binary (SHA1: 7533e32613b615bdd0b213ec24d865ccbea9cd86) was dropped to /var/tmp/ntds.dit. Phishing emails were sent from finance@mail-service.info targeting enterprise users. A backup C2 server was identified at 10.71.148.60.


Symantec published a threat intelligence report linking APT29 to a new campaign exploiting CVE-2022-40108 in SonicWall SMA. The attackers deployed Latrodectus via BITSAdmin, establishing C2 communication with 13.176.195.202 and portalsecure.link. A secondary payload was downloaded from hxxp://datadata.info/gate.php. The malware binary (SHA256: 166d51ec8b6262b278b7a6e1347a8a4ec40242344b44da1cf87ab1c11d566a63) was dropped to C:\Program Files\Common Files\ntds.dit. Phishing emails were sent from confirm@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 179.213.209.39.


Kaspersky GReAT published a threat intelligence report linking Mustang Panda to a new campaign exploiting CVE-2022-47837 in Atlassian Confluence. The attackers deployed Raccoon Stealer via PsExec, establishing C2 communication with 172.189.47.138 and api-cloud.link. A secondary payload was downloaded from https://proxy-cloud.live/portal/verify. The malware binary (SHA256: 0de6b488edea39f67674e41d7e14c1c3d5d13e5a65f57598c129b30289aef0ff) was dropped to /tmp/runtime.dll. Phishing emails were sent from alert@credential-check.site targeting enterprise users. A backup C2 server was identified at 10.137.193.173.


INTERPOL published a threat intelligence report linking Diamond Sleet to a new campaign exploiting CVE-2022-47837 in Cisco ASA. The attackers deployed BumbleBee via WinPEAS, establishing C2 communication with 192.164.144.98 and nodeproxy.online. A secondary payload was downloaded from hxxp://proxy-storage.dev/secure/token. The malware binary (MD5: 022c81682909faba6eec771009ea0cb5) was dropped to C:\Program Files\Common Files\update.dll. Phishing emails were sent from notification@login-portal.tech targeting enterprise users. A backup C2 server was identified at 137.183.157.67.


Kaspersky GReAT published a threat intelligence report linking Aqua Blizzard to a new campaign exploiting CVE-2025-36175 in Apache Struts. The attackers deployed LockBit via Mimikatz, establishing C2 communication with 10.168.117.98 and proxyrelay.org. A secondary payload was downloaded from http://securelogin.club/download/update.exe. The malware binary (SHA1: 9b931494072a7afade8f83e7d41e126c44351020) was dropped to C:\Users\admin\AppData\Local\Temp\loader.exe. Phishing emails were sent from support@secure-verify.net targeting enterprise users. A backup C2 server was identified at 172.172.131.196.


CrowdStrike published a threat intelligence report linking Flax Typhoon to a new campaign exploiting CVE-2025-48242 in Citrix NetScaler. The attackers deployed QakBot via Seatbelt, establishing C2 communication with 10.77.4.56 and updateupdate.io. A secondary payload was downloaded from https://updateupdate.io/panel/index.html. The malware binary (MD5: d6b598e7cd1e1a683589a5d3a21814e3) was dropped to C:\Windows\Temp\loader.exe. Phishing emails were sent from contact@account-update.xyz targeting enterprise users. A backup C2 server was identified at 96.30.247.169.


Microsoft MSRC published a threat intelligence report linking Kimsuky to a new campaign exploiting CVE-2023-34911 in Palo Alto PAN-OS. The attackers deployed Ryuk via LaZagne, establishing C2 communication with 209.181.136.204 and data-backup.top. A secondary payload was downloaded from http://cdn-api.site/callback. The malware binary (SHA1: 8247cd21680ad26bf8e89a426617762360a7c176) was dropped to /dev/shm/update.dll. Phishing emails were sent from admin@account-update.xyz targeting enterprise users. A backup C2 server was identified at 21.191.207.118.


Dragos published a threat intelligence report linking Lazarus Group to a new campaign exploiting CVE-2024-12103 in MOVEit Transfer. The attackers deployed Qbot via Havoc, establishing C2 communication with 192.21.117.55 and edgecache.top. A secondary payload was downloaded from hxxp://secure-storage.com/collect. The malware binary (SHA256: abe8839500d534b4859cccf6c800b548cf0a0a87a0f635f6ac5e462be8dc7b23) was dropped to C:\Users\admin\Desktop\chrome_helper.exe. Phishing emails were sent from finance@account-update.xyz targeting enterprise users. A backup C2 server was identified at 70.23.38.176.


Tenable published a threat intelligence report linking OilRig to a new campaign exploiting CVE-2024-26162 in Barracuda ESG. The attackers deployed BumbleBee via BITSAdmin, establishing C2 communication with 99.71.40.129 and storage-static.link. A secondary payload was downloaded from https://storageupdate.top/gate.php. The malware binary (MD5: 7e8f00640a9b88d468abf649a3c071f6) was dropped to /var/tmp/csrss.exe. Phishing emails were sent from confirm@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 14.50.223.60.


Europol published a threat intelligence report linking Storm-0558 to a new campaign exploiting CVE-2024-27359 in Ubuntu 22.04. The attackers deployed DarkSide via PowerView, establishing C2 communication with 205.126.37.22 and storagemail.net. A secondary payload was downloaded from https://update-backup.online/portal/verify. The malware binary (SHA256: f44c9a77a1c53074d213b81213fcf7083a0ee1995a18d13a8764729ce40e6b6b) was dropped to C:\Windows\System32\chrome_helper.exe. Phishing emails were sent from security@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 40.194.78.190.


NSA published a threat intelligence report linking Midnight Blizzard to a new campaign exploiting CVE-2025-38077 in VMware ESXi. The attackers deployed Latrodectus via Certutil, establishing C2 communication with 10.181.47.153 and portalapi.club. A secondary payload was downloaded from http://cache-node.org/download/update.exe. The malware binary (SHA256: 9860d3f70ca29420e9410e17509d3551e7650ee9d3e342d5c7041cf6160ada69) was dropped to /usr/local/bin/agent.py. Phishing emails were sent from hr@credential-check.site targeting enterprise users. A backup C2 server was identified at 222.197.6.75.


Dragos published a threat intelligence report linking Mustang Panda to a new campaign exploiting CVE-2023-14679 in SonicWall SMA. The attackers deployed IcedID via Rubeus, establishing C2 communication with 124.39.184.65 and login-backup.com. A secondary payload was downloaded from https://storagestatic.site/gate.php. The malware binary (MD5: e57d614677d2d2e098a4eb8723fe17fe) was dropped to C:\Program Files\Common Files\implant.so. Phishing emails were sent from noreply@mail-service.info targeting enterprise users. A backup C2 server was identified at 192.253.100.118.


Cisco Talos published a threat intelligence report linking Scattered Spider to a new campaign exploiting CVE-2026-49052 in Atlassian Confluence. The attackers deployed StealC via WinPEAS, establishing C2 communication with 172.163.149.189 and portalmail.net. A secondary payload was downloaded from hxxps://cache-edge.org/assets/js/payload.js. The malware binary (MD5: 79798afe27b70af8dab3fb741dab7633) was dropped to /tmp/sam.hive. Phishing emails were sent from finance@secure-verify.net targeting enterprise users. A backup C2 server was identified at 148.124.166.97.


FBI published a threat intelligence report linking Flax Typhoon to a new campaign exploiting CVE-2021-16698 in Apache Struts. The attackers deployed FormBook via PowerView, establishing C2 communication with 172.78.216.203 and edgenode.dev. A secondary payload was downloaded from https://edgecdn.link/assets/js/payload.js. The malware binary (SHA1: 269d116dc2f561c564d776bf88795a92865561a6) was dropped to C:\ProgramData\taskhost.exe. Phishing emails were sent from helpdesk@auth-check.org targeting enterprise users. A backup C2 server was identified at 19.229.245.150.


Europol published a threat intelligence report linking Turla to a new campaign exploiting CVE-2025-27219 in Atlassian Confluence. The attackers deployed Meduza Stealer via BloodHound, establishing C2 communication with 28.5.50.67 and relaycache.club. A secondary payload was downloaded from hxxps://mail-update.online/portal/verify. The malware binary (MD5: 396a2c68b2cfba3e0036f07160242336) was dropped to C:\ProgramData\taskhost.exe. Phishing emails were sent from noreply@auth-check.org targeting enterprise users. A backup C2 server was identified at 192.113.228.96.


Rapid7 published a threat intelligence report linking TA505 to a new campaign exploiting CVE-2022-47837 in Juniper SRX. The attackers deployed NjRAT via Brute Ratel, establishing C2 communication with 90.243.49.113 and update-storage.top. A secondary payload was downloaded from hxxp://secure-data.io/panel/index.html. The malware binary (SHA256: c0eb0ab288ed0b91d51b08d0ab7474e899c0356942496d6f28ce73ef91841b55) was dropped to /opt/app/bin/dropper.ps1. Phishing emails were sent from contact@credential-check.site targeting enterprise users. A backup C2 server was identified at 82.34.153.12.


Google TAG published a threat intelligence report linking FIN7 to a new campaign exploiting CVE-2022-34807 in SonicWall SMA. The attackers deployed Vidar via Sharphound, establishing C2 communication with 8.101.230.152 and apicache.net. A secondary payload was downloaded from http://mail-storage.xyz/api/v2/auth. The malware binary (MD5: 1e887708c518a52c0bbefb21c839109d) was dropped to /dev/shm/loader.exe. Phishing emails were sent from ceo@document-share.link targeting enterprise users. A backup C2 server was identified at 100.2.109.53.


Europol published a threat intelligence report linking Volt Typhoon to a new campaign exploiting CVE-2021-37696 in Ivanti Connect Secure. The attackers deployed Meduza Stealer via Ligolo, establishing C2 communication with 217.234.88.209 and data-backup.net. A secondary payload was downloaded from http://mail-login.io/callback. The malware binary (SHA1: 36ac1f70c33bf6477c22d4076969fc664ef0b6db) was dropped to C:\Windows\System32\shell.php. Phishing emails were sent from service@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 158.43.68.81.


NCSC published a threat intelligence report linking Turla to a new campaign exploiting CVE-2022-40108 in Barracuda ESG. The attackers deployed Qbot via Sharphound, establishing C2 communication with 172.147.71.48 and updateproxy.org. A secondary payload was downloaded from http://portal-edge.io/callback. The malware binary (SHA1: b9ecb99e7b1111b4455f032282c70e7683fb4320) was dropped to /dev/shm/ntds.dit. Phishing emails were sent from updates@credential-check.site targeting enterprise users. A backup C2 server was identified at 216.230.27.222.


CrowdStrike published a threat intelligence report linking Turla to a new campaign exploiting CVE-2022-24935 in Apache Struts. The attackers deployed Dridex via BITSAdmin, establishing C2 communication with 172.115.147.44 and sync-edge.live. A secondary payload was downloaded from http://edgecdn.link/panel/index.html. The malware binary (SHA256: d0cd76fd9eb10f91e2d6848d7b8c166d9229c6424bde16adf0d25d164902bdc1) was dropped to C:\Program Files\Common Files\taskhost.exe. Phishing emails were sent from helpdesk@mail-service.info targeting enterprise users. A backup C2 server was identified at 145.253.57.147.


Kaspersky GReAT published a threat intelligence report linking Salt Typhoon to a new campaign exploiting CVE-2024-23826 in Ubuntu 22.04. The attackers deployed Cobalt Strike via Brute Ratel, establishing C2 communication with 222.60.121.54 and cloud-cloud.link. A secondary payload was downloaded from https://cache-mail.io/collect. The malware binary (SHA1: 35bacded5f7164a9f324e9f0a7b6a46198f5108c) was dropped to C:\Users\admin\Downloads\winlogon.exe. Phishing emails were sent from finance@mail-service.info targeting enterprise users. A backup C2 server was identified at 221.219.84.158.


NSA published a threat intelligence report linking OilRig to a new campaign exploiting CVE-2021-39439 in Citrix NetScaler. The attackers deployed SystemBC via Havoc, establishing C2 communication with 16.141.64.180 and portal-proxy.org. A secondary payload was downloaded from hxxps://gatewayportal.online/admin/config. The malware binary (SHA256: 2efd63356677694ca494c881d44536f0be396e2b75068ad9f144e5101318755e) was dropped to C:\Users\admin\Desktop\loader.exe. Phishing emails were sent from hr@auth-check.org targeting enterprise users. A backup C2 server was identified at 10.74.164.213.


Europol published a threat intelligence report linking Midnight Blizzard to a new campaign exploiting CVE-2020-17296 in Ubuntu 22.04. The attackers deployed Qbot via Hashcat, establishing C2 communication with 163.183.32.204 and storagebackup.tech. A secondary payload was downloaded from https://cache-proxy.link/admin/config. The malware binary (SHA256: 5ab115bd718dd63abb977e65564b14729ceca6875aae2a98d2b49c7f5958fad4) was dropped to C:\Users\admin\AppData\Local\Temp\taskhost.exe. Phishing emails were sent from updates@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 56.219.108.127.


CISA published a threat intelligence report linking Kimsuky to a new campaign exploiting CVE-2020-17296 in SonicWall SMA. The attackers deployed REvil via Brute Ratel, establishing C2 communication with 192.67.154.41 and securecdn.site. A secondary payload was downloaded from hxxps://datagateway.top/assets/js/payload.js. The malware binary (SHA256: be2549e5f385b18f7c9aa94f4f5e87eaa565038bcf36e0d61ee4a760e75b6511) was dropped to C:\Windows\Temp\runtime.dll. Phishing emails were sent from verify@secure-verify.net targeting enterprise users. A backup C2 server was identified at 24.184.128.22.


NSA published a threat intelligence report linking Mustang Panda to a new campaign exploiting CVE-2025-13087 in Windows Server 2019. The attackers deployed Lumma Stealer via PsExec, establishing C2 communication with 192.175.61.253 and portal-api.club. A secondary payload was downloaded from https://auth-storage.tech/download/update.exe. The malware binary (MD5: c35be3fdba9bf683edaf783fa12b9c89) was dropped to C:\Windows\System32\payload.bin. Phishing emails were sent from info@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 178.67.244.19.


Check Point Research published a threat intelligence report linking OilRig to a new campaign exploiting CVE-2022-27335 in Zyxel USG. The attackers deployed Emotet via ADFind, establishing C2 communication with 185.109.77.236 and login-auth.cc. A secondary payload was downloaded from hxxp://mailgateway.tech/wp-content/uploads/doc.php. The malware binary (MD5: 6644b46fd85810a4d4bfec8e2dbbcec8) was dropped to C:\ProgramData\helper.sh. Phishing emails were sent from confirm@document-share.link targeting enterprise users. A backup C2 server was identified at 158.226.111.23.


Huntress published a threat intelligence report linking Gamaredon to a new campaign exploiting CVE-2020-16717 in Apache Struts. The attackers deployed StealC via Burp Suite, establishing C2 communication with 192.96.200.76 and proxy-static.net. A secondary payload was downloaded from http://mail-storage.org/collect. The malware binary (MD5: 9b24d6c623acf64374b974b426d0448d) was dropped to /etc/cron.d/dropper.ps1. Phishing emails were sent from security@credential-check.site targeting enterprise users. A backup C2 server was identified at 10.253.197.29.


Europol published a threat intelligence report linking Velvet Tempest to a new campaign exploiting CVE-2020-49453 in Windows Server 2019. The attackers deployed IcedID via Mimikatz, establishing C2 communication with 56.20.30.243 and apiedge.io. A secondary payload was downloaded from hxxps://sync-api.info/panel/index.html. The malware binary (SHA256: 45295eb53df7a927f5c264a79a39b6c549e13269b6de949a6b4a3ae1287010cd) was dropped to C:\Windows\System32\dropper.ps1. Phishing emails were sent from ceo@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 130.146.212.109.


Secureworks published a threat intelligence report linking OilRig to a new campaign exploiting CVE-2025-42343 in Microsoft Exchange. The attackers deployed IcedID via Burp Suite, establishing C2 communication with 10.44.222.30 and auth-update.club. A secondary payload was downloaded from https://update-secure.online/panel/index.html. The malware binary (SHA1: d551568c890117dbee36458ef362c8711871f0a4) was dropped to /usr/local/bin/config.dat. Phishing emails were sent from it@account-update.xyz targeting enterprise users. A backup C2 server was identified at 157.28.158.171.


Symantec published a threat intelligence report linking Aqua Blizzard to a new campaign exploiting CVE-2021-32298 in Windows Server 2019. The attackers deployed SystemBC via LinPEAS, establishing C2 communication with 207.219.139.135 and cdnproxy.live. A secondary payload was downloaded from hxxps://mail-secure.info/collect. The malware binary (SHA1: d06640e45caac53ccfaf8e9f6e49eabdee473446) was dropped to C:\Users\Public\Documents\helper.sh. Phishing emails were sent from account@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 172.39.254.117.


Mandiant published a threat intelligence report linking APT29 to a new campaign exploiting CVE-2026-35216 in Ivanti Connect Secure. The attackers deployed Emotet via PsExec, establishing C2 communication with 39.91.18.142 and syncapi.cc. A secondary payload was downloaded from hxxps://authnode.top/download/update.exe. The malware binary (SHA256: 12c326810190516e9550c4ee61afcc90622033f4aa2c01d7c911b03738b91e46) was dropped to C:\Users\admin\AppData\Local\Temp\lsass.dmp. Phishing emails were sent from info@credential-check.site targeting enterprise users. A backup C2 server was identified at 58.164.127.107.


Qualys published a threat intelligence report linking Salt Typhoon to a new campaign exploiting CVE-2023-46500 in Atlassian Confluence. The attackers deployed Gootloader via Seatbelt, establishing C2 communication with 192.233.4.95 and cacheproxy.link. A secondary payload was downloaded from hxxps://edge-data.org/callback. The malware binary (SHA256: cdc925d8c0d86b3ebd3b10c2d32b2bf13262e89e1230227a336a344d9cb9261c) was dropped to /var/tmp/dropper.ps1. Phishing emails were sent from it@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 172.155.124.119.


Zscaler ThreatLabz published a threat intelligence report linking Scattered Spider to a new campaign exploiting CVE-2024-19363 in Apache Struts. The attackers deployed Emotet via Seatbelt, establishing C2 communication with 10.121.214.126 and node-gateway.club. A secondary payload was downloaded from hxxps://relayapi.cc/panel/index.html. The malware binary (SHA256: a73eccfdae2a3255bcdcffc27b75b8b5df40415185704bc547c8173cccaa2602) was dropped to C:\Users\admin\Desktop\chrome_helper.exe. Phishing emails were sent from notification@document-share.link targeting enterprise users. A backup C2 server was identified at 10.143.47.12.


Microsoft MSRC published a threat intelligence report linking APT29 to a new campaign exploiting CVE-2023-16619 in Apache Struts. The attackers deployed XLoader via PowerView, establishing C2 communication with 218.161.201.180 and cloud-login.link. A secondary payload was downloaded from http://login-auth.org/gate.php. The malware binary (MD5: 1ad8610a793293232d59f96534403ea1) was dropped to C:\Program Files\Common Files\taskhost.exe. Phishing emails were sent from confirm@auth-check.org targeting enterprise users. A backup C2 server was identified at 82.231.139.60.


Trend Micro published a threat intelligence report linking Velvet Tempest to a new campaign exploiting CVE-2025-49086 in Active Directory. The attackers deployed Royal via Brute Ratel, establishing C2 communication with 10.80.155.212 and mail-portal.io. A secondary payload was downloaded from hxxp://backup-sync.live/login. The malware binary (MD5: 4f03e7cbbe0151937e3857e2c5af2d7e) was dropped to C:\Windows\Tasks\dropper.ps1. Phishing emails were sent from confirm@login-portal.tech targeting enterprise users. A backup C2 server was identified at 10.167.75.24.


Rapid7 published a threat intelligence report linking Kimsuky to a new campaign exploiting CVE-2021-16698 in VMware ESXi. The attackers deployed ShadowPad via Metasploit, establishing C2 communication with 10.113.66.51 and update-api.xyz. A secondary payload was downloaded from https://loginapi.dev/api/v2/auth. The malware binary (SHA256: 7449ed739be4d77f4d42ed0778db80cb1e99329c5b198bbc4a1450c0f774898e) was dropped to C:\Windows\Tasks\update.dll. Phishing emails were sent from security@document-share.link targeting enterprise users. A backup C2 server was identified at 96.43.132.235.


CrowdStrike published a threat intelligence report linking Storm-0558 to a new campaign exploiting CVE-2024-27359 in SonicWall SMA. The attackers deployed Vidar via PowerShell Empire, establishing C2 communication with 172.109.95.71 and backup-proxy.site. A secondary payload was downloaded from http://cdnapi.info/download/update.exe. The malware binary (MD5: 21541cbf5664f89075a34fa4fc4b029e) was dropped to /tmp/loader.exe. Phishing emails were sent from helpdesk@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 115.76.17.158.


Rapid7 published a threat intelligence report linking Granite Typhoon to a new campaign exploiting CVE-2024-30622 in F5 BIG-IP. The attackers deployed TrickBot via Ligolo, establishing C2 communication with 89.164.198.70 and cdnproxy.io. A secondary payload was downloaded from hxxps://cachedata.org/wp-content/uploads/doc.php. The malware binary (SHA1: 846a391db1ac51ca39ad717d064b41b4270806d3) was dropped to /var/tmp/backdoor.elf. Phishing emails were sent from confirm@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 10.163.112.8.


Qualys published a threat intelligence report linking Velvet Tempest to a new campaign exploiting CVE-2024-26162 in Ivanti Connect Secure. The attackers deployed Play via BITSAdmin, establishing C2 communication with 10.121.162.207 and cache-cloud.live. A secondary payload was downloaded from http://edgebackup.org/login. The malware binary (SHA256: 76d82b15aac3de36ee8a5cb22458c52852c7951490791eb50aef578c55d98375) was dropped to C:\Users\admin\AppData\Local\Temp\helper.sh. Phishing emails were sent from report@login-portal.tech targeting enterprise users. A backup C2 server was identified at 152.14.180.243.


CrowdStrike published a threat intelligence report linking APT28 to a new campaign exploiting CVE-2024-12103 in Progress Telerik. The attackers deployed PikaBot via PowerShell Empire, establishing C2 communication with 10.174.90.236 and auth-node.live. A secondary payload was downloaded from http://apimail.club/collect. The malware binary (SHA256: fffb9a72932c0e807012d4dd7d2d3d366efc05821b4a32e0cf52ca0fd293d1da) was dropped to /opt/app/bin/agent.py. Phishing emails were sent from ceo@account-update.xyz targeting enterprise users. A backup C2 server was identified at 16.11.75.151.


Check Point Research published a threat intelligence report linking Turla to a new campaign exploiting CVE-2026-44676 in Atlassian Confluence. The attackers deployed XLoader via GhostPack, establishing C2 communication with 192.182.114.171 and update-cache.site. A secondary payload was downloaded from hxxp://secure-static.tech/admin/config. The malware binary (SHA1: 055c6823ec608bcf2e3d7d5f3515d10347496b24) was dropped to C:\Users\Public\Documents\beacon.dll. Phishing emails were sent from noreply@auth-check.org targeting enterprise users. A backup C2 server was identified at 172.157.150.33.


SentinelOne published a threat intelligence report linking Aqua Blizzard to a new campaign exploiting CVE-2024-31252 in Fortinet FortiGate. The attackers deployed IcedID via PsExec, establishing C2 communication with 192.171.228.3 and authupdate.com. A secondary payload was downloaded from http://relaygateway.org/gate.php. The malware binary (MD5: 5de8263dc0cfcd56567d7fc0b0fcbba1) was dropped to /etc/cron.d/dropper.ps1. Phishing emails were sent from service@secure-verify.net targeting enterprise users. A backup C2 server was identified at 54.127.34.90.


Qualys published a threat intelligence report linking Flax Typhoon to a new campaign exploiting CVE-2022-28965 in Fortinet FortiGate. The attackers deployed Amadey via GhostPack, establishing C2 communication with 19.17.150.6 and portal-secure.club. A secondary payload was downloaded from http://edge-api.tech/assets/js/payload.js. The malware binary (SHA256: 8758959998e0f4d6fc11c0ad1d3cd675712e5fbe94b2121cfdd8a14b68e10b7f) was dropped to C:\Program Files\Common Files\config.dat. Phishing emails were sent from report@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 67.53.37.88.


Sophos X-Ops published a threat intelligence report linking Turla to a new campaign exploiting CVE-2022-47837 in Palo Alto PAN-OS. The attackers deployed QakBot via Metasploit, establishing C2 communication with 179.135.144.77 and logincdn.tech. A secondary payload was downloaded from http://gateway-api.info/wp-content/uploads/doc.php. The malware binary (SHA256: 284b4ee446f5ada115da1aa27b467af418b0637d7ca538687dd19fb64c1c30f4) was dropped to C:\Windows\Temp\runtime.dll. Phishing emails were sent from security@mail-service.info targeting enterprise users. A backup C2 server was identified at 10.25.201.147.


Palo Alto Unit 42 published a threat intelligence report linking Lazarus Group to a new campaign exploiting CVE-2023-27691 in Cisco ASA. The attackers deployed Amadey via Havoc, establishing C2 communication with 126.135.46.165 and relay-cdn.info. A secondary payload was downloaded from https://relaysync.xyz/collect. The malware binary (SHA256: f777ac7dd4f0d8dcea76d4010f549ef497446bb7a39080c7f95e567c7a83f452) was dropped to C:\Windows\System32\taskhost.exe. Phishing emails were sent from info@auth-check.org targeting enterprise users. A backup C2 server was identified at 48.189.195.95.


Huntress published a threat intelligence report linking Granite Typhoon to a new campaign exploiting CVE-2022-15229 in Barracuda ESG. The attackers deployed WarmCookie via Sliver, establishing C2 communication with 172.214.243.147 and node-cache.dev. A secondary payload was downloaded from hxxp://auth-relay.org/wp-content/uploads/doc.php. The malware binary (SHA256: ac02614b0c9dac0ff54e9421e260bf46c3127e125e19d932286776e5eec14b9c) was dropped to C:\Windows\System32\update.dll. Phishing emails were sent from contact@secure-verify.net targeting enterprise users. A backup C2 server was identified at 172.153.40.102.


Tenable published a threat intelligence report linking Star Blizzard to a new campaign exploiting CVE-2021-34898 in Progress Telerik. The attackers deployed XLoader via SharpHound, establishing C2 communication with 82.34.44.100 and updatestatic.cc. A secondary payload was downloaded from hxxp://authgateway.org/collect. The malware binary (SHA1: 52d0ee6d032b3bf33be9785429508429c6f0571d) was dropped to C:\Users\Public\Documents\taskhost.exe. Phishing emails were sent from notification@secure-verify.net targeting enterprise users. A backup C2 server was identified at 142.166.141.134.


NCSC published a threat intelligence report linking Granite Typhoon to a new campaign exploiting CVE-2024-14337 in SonicWall SMA. The attackers deployed Gootloader via Havoc, establishing C2 communication with 99.248.242.10 and cdnportal.dev. A secondary payload was downloaded from http://datacdn.club/portal/verify. The malware binary (MD5: a413cc671443ce5b228b676779bd56c4) was dropped to C:\Windows\Temp\winlogon.exe. Phishing emails were sent from finance@mail-service.info targeting enterprise users. A backup C2 server was identified at 172.206.73.159.


Secureworks published a threat intelligence report linking FIN11 to a new campaign exploiting CVE-2021-48618 in Microsoft Exchange. The attackers deployed Qbot via Havoc, establishing C2 communication with 172.226.164.69 and gateway-proxy.link. A secondary payload was downloaded from hxxp://cdnnode.link/api/v2/auth. The malware binary (MD5: 3e43dd8135576d8bce9d369fd389683a) was dropped to C:\Users\admin\Desktop\payload.bin. Phishing emails were sent from account@document-share.link targeting enterprise users. A backup C2 server was identified at 155.45.96.114.


Symantec published a threat intelligence report linking APT28 to a new campaign exploiting CVE-2022-33700 in Windows 11. The attackers deployed DarkSide via SharpHound, establishing C2 communication with 10.233.25.236 and nodeportal.top. A secondary payload was downloaded from http://update-data.tech/collect. The malware binary (MD5: 5634bf245f67e68b90cbac36a359e789) was dropped to C:\Users\admin\Downloads\beacon.dll. Phishing emails were sent from notification@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 181.101.140.95.


Tenable published a threat intelligence report linking BlackTech to a new campaign exploiting CVE-2023-34260 in Ubuntu 22.04. The attackers deployed AgentTesla via Rubeus, establishing C2 communication with 8.197.25.42 and nodeupdate.live. A secondary payload was downloaded from hxxp://proxy-login.top/collect. The malware binary (SHA256: fa352da0d0b9458ee0ea23c2e31aa2de0b8d0a6c33342c6337a08cd618bbad95) was dropped to /var/tmp/backdoor.elf. Phishing emails were sent from report@mail-service.info targeting enterprise users. A backup C2 server was identified at 10.115.105.69.


Symantec published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2024-19363 in Ivanti Connect Secure. The attackers deployed SystemBC via Sliver, establishing C2 communication with 65.111.238.78 and edgestatic.cc. A secondary payload was downloaded from hxxps://backupauth.online/secure/token. The malware binary (MD5: 7af18e7c4592f267446ad66fce8c5495) was dropped to /opt/app/bin/backdoor.elf. Phishing emails were sent from hr@mail-service.info targeting enterprise users. A backup C2 server was identified at 150.52.3.131.


Huntress published a threat intelligence report linking Sandworm to a new campaign exploiting CVE-2023-34911 in Windows 11. The attackers deployed LockBit via LaZagne, establishing C2 communication with 170.163.71.185 and portalportal.club. A secondary payload was downloaded from hxxp://cache-cache.live/secure/token. The malware binary (SHA1: cc4104ce181c724cce3311449e0716e58c031730) was dropped to /var/tmp/dropper.ps1. Phishing emails were sent from verify@auth-check.org targeting enterprise users. A backup C2 server was identified at 192.254.151.67.


Google TAG published a threat intelligence report linking Charming Kitten to a new campaign exploiting CVE-2022-18180 in Apache Struts. The attackers deployed AsyncRAT via Havoc, establishing C2 communication with 172.65.132.186 and databackup.site. A secondary payload was downloaded from https://mailsync.cc/gate.php. The malware binary (SHA256: fa34653871ec61efff21793c3cc7cae50ee7ddaa1208a769bf73420813a85c12) was dropped to /dev/shm/update.dll. Phishing emails were sent from notification@document-share.link targeting enterprise users. A backup C2 server was identified at 192.171.45.57.


Symantec published a threat intelligence report linking Gamaredon to a new campaign exploiting CVE-2022-46178 in Juniper SRX. The attackers deployed IcedID via PowerShell Empire, establishing C2 communication with 192.195.152.106 and cacherelay.org. A secondary payload was downloaded from https://secureapi.online/admin/config. The malware binary (SHA256: 1ed64c14f6cfb965f58e772ad92f0860fe1c0eb2c2a64337fb78e8fef499eeaf) was dropped to /opt/app/bin/update.dll. Phishing emails were sent from admin@credential-check.site targeting enterprise users. A backup C2 server was identified at 10.70.102.88.


Huntress published a threat intelligence report linking FIN11 to a new campaign exploiting CVE-2022-12847 in MOVEit Transfer. The attackers deployed Royal via Seatbelt, establishing C2 communication with 172.45.66.158 and portalupdate.com. A secondary payload was downloaded from https://mail-update.dev/panel/index.html. The malware binary (SHA256: d76c344864ffdfcdbee34f1831029249fb27cb19338bff92a501ed8bcc33328a) was dropped to C:\Windows\Temp\svchost.exe. Phishing emails were sent from helpdesk@login-portal.tech targeting enterprise users. A backup C2 server was identified at 163.219.206.110.


Microsoft MSRC published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2021-28231 in Cisco ASA. The attackers deployed AgentTesla via Burp Suite, establishing C2 communication with 43.33.23.77 and storage-proxy.tech. A secondary payload was downloaded from hxxp://secure-portal.com/wp-content/uploads/doc.php. The malware binary (SHA1: 56b49f3cf44a40fc46233261373ee4bd2e9644ca) was dropped to C:\Windows\System32\runtime.dll. Phishing emails were sent from admin@document-share.link targeting enterprise users. A backup C2 server was identified at 117.172.222.228.


SentinelOne published a threat intelligence report linking Charming Kitten to a new campaign exploiting CVE-2020-48698 in Cisco ASA. The attackers deployed REvil via Metasploit, establishing C2 communication with 198.24.24.170 and gateway-relay.site. A secondary payload was downloaded from hxxp://edge-sync.online/wp-content/uploads/doc.php. The malware binary (SHA1: 52a81f85578ec25909f93977c451790e2c34748a) was dropped to C:\Windows\Temp\agent.py. Phishing emails were sent from contact@secure-verify.net targeting enterprise users. A backup C2 server was identified at 192.10.24.177.


INTERPOL published a threat intelligence report linking Star Blizzard to a new campaign exploiting CVE-2021-16698 in SonicWall SMA. The attackers deployed PikaBot via Nmap, establishing C2 communication with 192.60.144.30 and nodecloud.tech. A secondary payload was downloaded from http://backupsecure.com/wp-content/uploads/doc.php. The malware binary (SHA1: 3bf8a549a57e8deb42cd6d13060f4d22a69e675b) was dropped to /dev/shm/winlogon.exe. Phishing emails were sent from helpdesk@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 172.101.102.200.


Palo Alto Unit 42 published a threat intelligence report linking APT28 to a new campaign exploiting CVE-2026-46256 in Citrix NetScaler. The attackers deployed Dridex via Merlin, establishing C2 communication with 192.38.51.232 and syncrelay.com. A secondary payload was downloaded from https://secure-cdn.live/secure/token. The malware binary (SHA1: 2d359d8ca506c0d4fd5ff8f7243d8af0f9eb9551) was dropped to /opt/app/bin/ntds.dit. Phishing emails were sent from alert@secure-verify.net targeting enterprise users. A backup C2 server was identified at 165.118.233.254.


Qualys published a threat intelligence report linking Salt Typhoon to a new campaign exploiting CVE-2021-16698 in Fortinet FortiGate. The attackers deployed Cobalt Strike via Mimikatz, establishing C2 communication with 92.224.137.225 and portalrelay.info. A secondary payload was downloaded from hxxp://proxygateway.top/api/v2/auth. The malware binary (SHA256: 8f33a3e2371d6083d3969c45fe4c082cc2a2ee147a0f14706148e7cb192e82e5) was dropped to C:\Users\admin\AppData\Local\Temp\config.dat. Phishing emails were sent from alert@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 172.175.93.30.


Rapid7 published a threat intelligence report linking Diamond Sleet to a new campaign exploiting CVE-2025-15957 in Fortinet FortiGate. The attackers deployed Lumma Stealer via PowerShell Empire, establishing C2 communication with 200.183.14.221 and relaycdn.net. A secondary payload was downloaded from hxxp://storageupdate.club/admin/config. The malware binary (MD5: c311c3038ecf4bf4f8da8e9aa091020c) was dropped to C:\Users\Public\Documents\ntds.dit. Phishing emails were sent from helpdesk@credential-check.site targeting enterprise users. A backup C2 server was identified at 172.249.57.228.


Tenable published a threat intelligence report linking BlackTech to a new campaign exploiting CVE-2020-16140 in Windows Server 2019. The attackers deployed Raccoon Stealer via CrackMapExec, establishing C2 communication with 192.240.253.223 and synccdn.io. A secondary payload was downloaded from hxxp://edge-portal.site/api/v2/auth. The malware binary (MD5: b6c1d612f85acb6b33f5496cf44b4f98) was dropped to C:\Windows\Tasks\shell.php. Phishing emails were sent from updates@secure-verify.net targeting enterprise users. A backup C2 server was identified at 10.251.164.62.


Sophos X-Ops published a threat intelligence report linking Salt Typhoon to a new campaign exploiting CVE-2021-32298 in F5 BIG-IP. The attackers deployed Qbot via Brute Ratel, establishing C2 communication with 10.206.211.10 and storagemail.live. A secondary payload was downloaded from http://data-relay.tech/assets/js/payload.js. The malware binary (SHA1: ea830fc544ebfc159dfc565f5b1be61abf5ef84a) was dropped to /etc/cron.d/sam.hive. Phishing emails were sent from alert@secure-verify.net targeting enterprise users. A backup C2 server was identified at 10.155.105.168.


Sophos X-Ops published a threat intelligence report linking Velvet Tempest to a new campaign exploiting CVE-2024-47170 in Apache Struts. The attackers deployed Play via Mimikatz, establishing C2 communication with 180.54.23.230 and staticcloud.xyz. A secondary payload was downloaded from hxxp://portal-cloud.online/assets/js/payload.js. The malware binary (MD5: 19321a7a962333a7af6e09858286794a) was dropped to C:\Users\Public\Documents\ntds.dit. Phishing emails were sent from support@document-share.link targeting enterprise users. A backup C2 server was identified at 172.71.209.28.


Zscaler ThreatLabz published a threat intelligence report linking Kimsuky to a new campaign exploiting CVE-2026-45190 in Citrix NetScaler. The attackers deployed PlugX via Brute Ratel, establishing C2 communication with 2.24.221.215 and auth-portal.top. A secondary payload was downloaded from hxxp://nodeportal.site/portal/verify. The malware binary (MD5: e63c2824ee5248e2f83a36aa16783058) was dropped to /opt/app/bin/agent.py. Phishing emails were sent from updates@account-update.xyz targeting enterprise users. A backup C2 server was identified at 131.90.88.188.


Secureworks published a threat intelligence report linking Mustang Panda to a new campaign exploiting CVE-2026-32293 in Apache Struts. The attackers deployed FormBook via ADFind, establishing C2 communication with 183.111.102.54 and node-edge.club. A secondary payload was downloaded from http://authmail.io/collect. The malware binary (SHA1: 965a76703f7025273c712699497ab6127ef5f1e6) was dropped to C:\Program Files\Common Files\dropper.ps1. Phishing emails were sent from finance@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 176.176.67.252.


Palo Alto Unit 42 published a threat intelligence report linking Granite Typhoon to a new campaign exploiting CVE-2020-16717 in Cisco ASA. The attackers deployed Emotet via LaZagne, establishing C2 communication with 10.28.102.69 and backup-cloud.link. A secondary payload was downloaded from hxxp://mail-relay.net/assets/js/payload.js. The malware binary (SHA1: 31de1c02f56ef5ec2512db09f71df92e84e8e098) was dropped to C:\Users\admin\Desktop\helper.sh. Phishing emails were sent from account@mail-service.info targeting enterprise users. A backup C2 server was identified at 172.128.74.215.


Proofpoint published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2024-26162 in SonicWall SMA. The attackers deployed QakBot via Merlin, establishing C2 communication with 142.27.6.191 and cacheedge.club. A secondary payload was downloaded from hxxp://cloud-backup.online/admin/config. The malware binary (SHA256: 626c3d8067b532b245b03867d2c7f7578e1536e2938433a55e5ec669f48eb967) was dropped to C:\Users\admin\Downloads\config.dat. Phishing emails were sent from account@secure-verify.net targeting enterprise users. A backup C2 server was identified at 52.226.115.234.


Kaspersky GReAT published a threat intelligence report linking Volt Typhoon to a new campaign exploiting CVE-2023-33283 in Citrix NetScaler. The attackers deployed Cobalt Strike via Sliver, establishing C2 communication with 192.130.2.85 and staticcdn.link. A secondary payload was downloaded from https://proxycache.io/api/v2/auth. The malware binary (SHA1: 93fc3470e45158215f3190f5a9cca7f61f93be3c) was dropped to /opt/app/bin/loader.exe. Phishing emails were sent from helpdesk@account-update.xyz targeting enterprise users. A backup C2 server was identified at 182.79.20.40.


NSA published a threat intelligence report linking Charming Kitten to a new campaign exploiting CVE-2022-32541 in SonicWall SMA. The attackers deployed IcedID via GhostPack, establishing C2 communication with 24.178.113.227 and cloudstatic.io. A secondary payload was downloaded from https://edgeupdate.net/gate.php. The malware binary (SHA256: ff0e462188792506c0c5e50ac8ede88605c529b9a268e1b3f4ee5a74e9eb5427) was dropped to /var/tmp/update.dll. Phishing emails were sent from ceo@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 192.169.169.93.


Kaspersky GReAT published a threat intelligence report linking Diamond Sleet to a new campaign exploiting CVE-2026-27261 in Apache Struts. The attackers deployed Conti via Ligolo, establishing C2 communication with 192.191.228.125 and auth-secure.link. A secondary payload was downloaded from hxxp://api-cloud.top/admin/config. The malware binary (MD5: d1750cfa51b2004ae0753113c69f13f3) was dropped to C:\Users\Public\Documents\runtime.dll. Phishing emails were sent from confirm@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 172.98.164.132.


Zscaler ThreatLabz published a threat intelligence report linking UNC2452 to a new campaign exploiting CVE-2021-33526 in Windows Server 2019. The attackers deployed IcedID via LinPEAS, establishing C2 communication with 184.169.19.23 and cache-data.dev. A secondary payload was downloaded from http://gatewayportal.online/callback. The malware binary (MD5: 7ebe201637f8d28558b2950ce2952a74) was dropped to C:\Windows\Temp\lsass.dmp. Phishing emails were sent from alert@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 10.91.128.143.


Huntress published a threat intelligence report linking APT28 to a new campaign exploiting CVE-2020-12082 in Ubuntu 22.04. The attackers deployed Meduza Stealer via Impacket, establishing C2 communication with 129.54.148.202 and portalportal.live. A secondary payload was downloaded from hxxp://proxy-secure.io/download/update.exe. The malware binary (SHA1: 97a05e736aacd79574fe3a5d5d0b599d7bcf638e) was dropped to C:\Users\admin\Desktop\dropper.ps1. Phishing emails were sent from finance@account-update.xyz targeting enterprise users. A backup C2 server was identified at 156.44.144.196.


NCSC published a threat intelligence report linking TA505 to a new campaign exploiting CVE-2021-16078 in VMware ESXi. The attackers deployed RedLine Stealer via Mimikatz, establishing C2 communication with 10.201.43.79 and secure-secure.xyz. A secondary payload was downloaded from hxxps://cloudauth.org/panel/index.html. The malware binary (MD5: 10869bac984bf4e24a2927d50877c091) was dropped to C:\ProgramData\agent.py. Phishing emails were sent from info@mail-service.info targeting enterprise users. A backup C2 server was identified at 192.176.108.106.


Europol published a threat intelligence report linking Kimsuky to a new campaign exploiting CVE-2026-44676 in Atlassian Confluence. The attackers deployed Hive via LinPEAS, establishing C2 communication with 33.120.51.73 and staticbackup.club. A secondary payload was downloaded from https://cache-cache.tech/callback. The malware binary (SHA256: 4c92d14cbaaa3222a41a0622e72512b5a2e953bc1469e6c46bc6c22ff073bbff) was dropped to C:\Windows\Temp\winlogon.exe. Phishing emails were sent from helpdesk@login-portal.tech targeting enterprise users. A backup C2 server was identified at 10.162.248.116.


Tenable published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2024-23934 in Citrix NetScaler. The attackers deployed XLoader via Nmap, establishing C2 communication with 123.236.228.92 and sync-login.dev. A secondary payload was downloaded from hxxps://sync-api.club/login. The malware binary (SHA1: 6cee7ffab9b17a0d4aa9182815bc0a5941c35abd) was dropped to C:\Windows\Temp\shell.php. Phishing emails were sent from notification@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 125.55.89.166.


FireEye published a threat intelligence report linking Velvet Tempest to a new campaign exploiting CVE-2020-48698 in Barracuda ESG. The attackers deployed Lumma Stealer via SharpHound, establishing C2 communication with 140.241.76.94 and portal-mail.io. A secondary payload was downloaded from hxxp://data-static.top/panel/index.html. The malware binary (SHA256: 3e53f8b989435e5f98f75ecaee4922b736b44e850fdf9719ff280fc6fb2cf3b6) was dropped to C:\Windows\Tasks\config.dat. Phishing emails were sent from security@document-share.link targeting enterprise users. A backup C2 server was identified at 58.148.68.119.


Volexity published a threat intelligence report linking OilRig to a new campaign exploiting CVE-2026-40674 in Ivanti Connect Secure. The attackers deployed LockBit via LinPEAS, establishing C2 communication with 10.249.118.17 and node-mail.site. A secondary payload was downloaded from https://relaycdn.com/api/v2/auth. The malware binary (SHA1: 4052fe6edf0fda791617268bce2e419ed36c5ab8) was dropped to /usr/local/bin/backdoor.elf. Phishing emails were sent from notification@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 95.119.21.172.


Check Point Research published a threat intelligence report linking OilRig to a new campaign exploiting CVE-2024-19363 in Ivanti Connect Secure. The attackers deployed DarkSide via Ligolo, establishing C2 communication with 192.128.192.250 and proxyproxy.dev. A secondary payload was downloaded from hxxp://node-login.online/wp-content/uploads/doc.php. The malware binary (SHA256: 284667f1a0446fec040f50af7ee6d6a926c3e3b66cd09a7793292556ba17686d) was dropped to /usr/local/bin/runtime.dll. Phishing emails were sent from noreply@account-update.xyz targeting enterprise users. A backup C2 server was identified at 192.207.180.210.


Secureworks published a threat intelligence report linking Turla to a new campaign exploiting CVE-2021-32298 in Microsoft Exchange. The attackers deployed RedLine Stealer via ADFind, establishing C2 communication with 208.169.58.124 and updatedata.com. A secondary payload was downloaded from hxxp://cache-cache.org/admin/config. The malware binary (SHA1: c9e11674c1099b29a7889dc634048837a41ecb5c) was dropped to C:\Users\admin\AppData\Local\Temp\shell.php. Phishing emails were sent from noreply@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 123.107.82.166.


Google TAG published a threat intelligence report linking Turla to a new campaign exploiting CVE-2026-17310 in Cisco ASA. The attackers deployed SmokeLoader via Merlin, establishing C2 communication with 192.145.43.56 and gateway-static.org. A secondary payload was downloaded from hxxp://static-node.info/assets/js/payload.js. The malware binary (SHA1: eb1a5d149c80af13212ccb906269660766eba480) was dropped to /opt/app/bin/sam.hive. Phishing emails were sent from report@document-share.link targeting enterprise users. A backup C2 server was identified at 156.241.246.44.


Proofpoint published a threat intelligence report linking Lazarus Group to a new campaign exploiting CVE-2021-24110 in VMware ESXi. The attackers deployed Play via Ligolo, establishing C2 communication with 10.214.76.156 and api-proxy.top. A secondary payload was downloaded from hxxps://static-edge.live/admin/config. The malware binary (SHA1: a756596d202f39aaa903852435e94cf3f4679e13) was dropped to C:\Program Files\Common Files\loader.exe. Phishing emails were sent from contact@auth-check.org targeting enterprise users. A backup C2 server was identified at 10.243.19.225.


NSA published a threat intelligence report linking Salt Typhoon to a new campaign exploiting CVE-2025-19065 in Microsoft Exchange. The attackers deployed Cobalt Strike via WinPEAS, establishing C2 communication with 203.195.179.151 and api-backup.cc. A secondary payload was downloaded from hxxps://synccloud.com/collect. The malware binary (SHA1: 2f8aceeafb572e20e2f31af0771073a21d66d953) was dropped to C:\Users\Public\Documents\loader.exe. Phishing emails were sent from admin@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 172.68.130.123.


Rapid7 published a threat intelligence report linking UNC2452 to a new campaign exploiting CVE-2024-24392 in SonicWall SMA. The attackers deployed Royal via WinPEAS, establishing C2 communication with 28.79.218.167 and portalcloud.site. A secondary payload was downloaded from http://securemail.io/portal/verify. The malware binary (MD5: bae580e4175fbeb4b64b75f7280f8c0e) was dropped to /etc/cron.d/lsass.dmp. Phishing emails were sent from noreply@secure-verify.net targeting enterprise users. A backup C2 server was identified at 67.216.187.157.


Rapid7 published a threat intelligence report linking Aqua Blizzard to a new campaign exploiting CVE-2022-49565 in VMware ESXi. The attackers deployed Play via Brute Ratel, establishing C2 communication with 192.205.173.206 and login-proxy.dev. A secondary payload was downloaded from hxxp://apiapi.info/secure/token. The malware binary (SHA256: 067c8fed258e5b71ba567cede8caf1a92e9044f4fd0ba579fa477017006ea6eb) was dropped to C:\Users\admin\AppData\Local\Temp\lsass.dmp. Phishing emails were sent from service@document-share.link targeting enterprise users. A backup C2 server was identified at 10.199.2.206.


Secureworks published a threat intelligence report linking UNC2452 to a new campaign exploiting CVE-2020-24328 in Fortinet FortiGate. The attackers deployed PikaBot via Burp Suite, establishing C2 communication with 113.5.103.218 and cdn-mail.xyz. A secondary payload was downloaded from http://secure-api.info/secure/token. The malware binary (SHA1: f6ed137f1afcbb33e10792625b45a449a4f9dafa) was dropped to C:\Users\admin\Desktop\lsass.dmp. Phishing emails were sent from notification@login-portal.tech targeting enterprise users. A backup C2 server was identified at 50.17.118.158.


Secureworks published a threat intelligence report linking Charming Kitten to a new campaign exploiting CVE-2020-49453 in Ubuntu 22.04. The attackers deployed Emotet via LinPEAS, establishing C2 communication with 186.178.177.247 and cacheupdate.info. A secondary payload was downloaded from hxxps://gateway-node.net/panel/index.html. The malware binary (MD5: 348e1d59429cea872abbcce3350fad25) was dropped to /opt/app/bin/taskhost.exe. Phishing emails were sent from account@mail-service.info targeting enterprise users. A backup C2 server was identified at 58.99.232.239.


Rapid7 published a threat intelligence report linking Silk Typhoon to a new campaign exploiting CVE-2023-33909 in Zyxel USG. The attackers deployed WarmCookie via Covenant, establishing C2 communication with 145.247.124.194 and proxy-auth.info. A secondary payload was downloaded from hxxp://portal-data.top/secure/token. The malware binary (MD5: f1e573b16f9b95b1006f07dcb1e4dbd6) was dropped to /etc/cron.d/loader.exe. Phishing emails were sent from confirm@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 199.234.235.230.


Trend Micro published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2021-24446 in Cisco ASA. The attackers deployed SmokeLoader via PsExec, establishing C2 communication with 20.91.243.81 and proxy-cloud.xyz. A secondary payload was downloaded from hxxp://sync-cloud.xyz/wp-content/uploads/doc.php. The malware binary (SHA1: b9daf676c4627c3af9af734000aeea6542a64e70) was dropped to /etc/cron.d/payload.bin. Phishing emails were sent from alert@secure-verify.net targeting enterprise users. A backup C2 server was identified at 56.137.93.243.


Zscaler ThreatLabz published a threat intelligence report linking Diamond Sleet to a new campaign exploiting CVE-2026-46256 in Progress Telerik. The attackers deployed Dridex via PowerView, establishing C2 communication with 192.21.246.96 and portaldata.link. A secondary payload was downloaded from http://cdn-node.link/gate.php. The malware binary (SHA1: f6152a14f4b0feb9af6ff975399cc92a560fd6f0) was dropped to C:\Users\admin\AppData\Local\Temp\loader.exe. Phishing emails were sent from it@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 127.140.251.47.


Palo Alto Unit 42 published a threat intelligence report linking Salt Typhoon to a new campaign exploiting CVE-2026-17310 in Zyxel USG. The attackers deployed DarkSide via Brute Ratel, establishing C2 communication with 177.4.6.173 and secureedge.info. A secondary payload was downloaded from https://sync-proxy.cc/secure/token. The malware binary (SHA256: 3a5438906fd0a6b3633aef3fb3a264310128c100b5494fab170cfef1a35eef76) was dropped to /dev/shm/ntds.dit. Phishing emails were sent from billing@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 172.51.166.93.


Qualys published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2025-27219 in Active Directory. The attackers deployed RedLine Stealer via Chisel, establishing C2 communication with 47.67.117.209 and portalcloud.org. A secondary payload was downloaded from http://proxy-update.org/gate.php. The malware binary (SHA256: 2617efa9785fbc1db5df82b57fdd5282bb8fab48549336571885df9b16f9f935) was dropped to /opt/app/bin/beacon.dll. Phishing emails were sent from finance@mail-service.info targeting enterprise users. A backup C2 server was identified at 192.138.120.143.


Proofpoint published a threat intelligence report linking MuddyWater to a new campaign exploiting CVE-2021-48618 in Fortinet FortiGate. The attackers deployed DanaBot via BloodHound, establishing C2 communication with 10.130.243.215 and edgeedge.dev. A secondary payload was downloaded from hxxps://mailupdate.site/secure/token. The malware binary (SHA1: d9f0c79404d338b4e166631cf683882af7da6c3e) was dropped to /tmp/shell.php. Phishing emails were sent from notification@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 172.171.133.93.