CIRCLE WITH A DOT

THREAT INTEL | Samuel I. White, PC🟡 Actor "anubis" claims Undisclosed️ Unverified claimhttps://www.yazoul.net/intel/claim/2026-04-21-samuel-i-white-pc-ransomware-claim-by-anubis-april-2026#DarkWeb #DataBreach #ThreatIntel #CyberSecurity #InfoSec

(trmlabs.com) TRM Labs Congressional Testimony: Industrial-Scale Crypto Fraud, Transnational Criminal Networks, and the AI-Accelerated Threat to American FamiliesIndustrial-scale crypto fraud by transnational criminal organizations (TCOs) is accelerating, with $158B in illicit flows in 2025—$35B from fraud/scams alone. Pig butchering operations in Southeast Asia, powered by trafficked labor and AI, are devastating U.S. victims. North Korea’s $1.92B crypto thefts (incl. $1.46B Bybit hack) and Chinese underground banking networks processing $103B highlight a Russia-China-DPRK illicit finance nexus.In brief - TCOs leveraged AI, deepfakes, and blockchain obfuscation to steal $158B in crypto in 2025, with pig butchering scams and North Korean hackers driving record losses. Chinese underground banking and stablecoin-enabled sanctions evasion further enabled cartels and state actors.Technically - Pig butchering proceeds laundered via multi-hop wallets (75%+ exhibiting ML patterns), stablecoin swaps, and unhosted wallets with <48h holding periods. Bybit hack ETH bridged to BTC, fragmented via mixers/DEXs, and staged for OTC liquidation. A7A5 stablecoin facilitated $56B in sanctions evasion; AI-generated KYC docs ($15) bypassed compliance controls. TRM’s Beacon Network provides real-time LE alerts for ~85% of CEX volume.Source: https://www.trmlabs.com/resources/blog/trms-ari-redbord-testifies-before-house-committee-on-homeland-security#Cybersecurity #ThreatIntel

(praetorian.com) From 500,000 Findings to 14 Critical Endpoints: How Exploit Chain Analysis Exposes Hidden Browser-Based APT ThreatsZero-click Firefox exploit chains targeting Windows endpoints achieve full host compromise via drive-by attacks, with one chain actively weaponized by Russia-aligned APT RomCom (Storm-0978). Traditional CVSS scoring fails to surface these risks—exploit chain analysis cuts 500K findings to 14 critical endpoints.In brief - Two Firefox exploit chains enable zero-click RCE + sandbox escape, with RomCom actively deploying one in the wild. CVSS-based prioritization misses these attack paths; exploit chain analysis reduces noise 35K:1.Technically - Chain 1: CVE-2025-4918 (SpiderMonkey OOB R/W, Pwn2Own 2025) + CVE-2025-2857 (IPC handle leak, CVSS 10.0). Chain 2: CVE-2024-9680 (Animation Timeline UAF, CVSS 9.8, RomCom) + CVE-2025-2857 or CVE-2024-49039 (Task Scheduler PE via RPC, CVSS 8.8). Firefox’s lack of V8 heap sandbox reduces required stages. AI-assisted exploit dev compresses TTP timelines.Source: https://www.praetorian.com/blog/exploit-chain-analysis/#Cybersecurity #ThreatIntel

(iverify.io) How Leaked iOS Exploit Chains and AI-Assisted Development Are Democratizing Nation-State Grade Mobile AttacksLeaked iOS exploit chains (Coruna, DarkSword) and AI-assisted exploit development are democratizing nation-state-grade mobile attacks, enabling organized crime and APTs to deploy sophisticated spyware at scale.In brief - The barrier to advanced iOS exploitation is collapsing due to public exploit chain leaks and AI-driven vulnerability research. Enterprises must prioritize mobile endpoint security, treating iOS devices with the same rigor as traditional endpoints to counter mass watering hole campaigns and N-day attacks.Technically - Coruna and DarkSword exploit chains, previously proprietary to NSO Group/Intellexa, now serve as training data for AI models like GPT-5.4-Cyber and Anthropic Mythos, which autonomously identify vulnerabilities and construct exploit chains. This accelerates zero-day discovery and N-day exploitation, leveraging techniques such as PAC bypasses, sandbox escapes, and kernel exploitation. The absence of robust iOS EDR necessitates OS-level behavioral detection and sysdiagnose-based forensic telemetry as critical compensating controls.Source: https://iverify.io/blog/leaked-ios-exploit-chains-ai-attacks#Cybersecurity #ThreatIntel

Coinbase Cartel claims ransomware attack on France's Engie. Engie, a France-based energy & utilities company, revenue $84.4B. #Ransomware #Energy #France #ThreatIntel

(ptsecurity.com) CapFix Threat Group Deploys Evolved CapDoor Backdoor Against Russian Industrial and Aviation OrganizationsCapFix threat group targets Russian industrial/aviation sectors with evolved CapDoor backdoor, exploiting CVE-2025-49113 in Roundcube Webmail to compromise legitimate infrastructure. Secondary payloads include SectopRAT and AsyncRAT.In brief - Russian APT CapFix deploys updated CapDoor backdoor via Roundcube exploit (CVE-2025-49113) against industrial/aviation targets. Uses DLL sideloading, ChaCha20 C2 encryption, and delivers RAT payloads. Phishing lures shifted from crypto/hotel themes to government impersonation.Technically - CapDoor employs multi-stage DLL sideloading (orchestrator/watchdog/inject DLLs) via signed executables. Shellcode uses FNV-1 hashing for API resolution, MurmurHash3 (seed 0xE5BBB) for C2 tasks. ChaCha20 encrypts communications. Persistence via HKCU Run. Supports PowerShell, file execution (EXE/DLL/MSI), screenshots. Evolved from PE to shellcode delivery, removed GHOSTPULSE/HIJACKLOADER dependencies.Source: https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/an-alarm-you-can-t-ignore-how-capfix-attacks-russian-organizations#Cybersecurity #ThreatIntel

@orlysec scary how far they've evolved

Today we're talking about another (???) issue in the Cursor AI IDE. Well actually it's two issues, one of which is simple command injection; the other is takeover via Dev tunnels. Don't know what dev tunnels are? Come find out—then block them with extreme prejudice.https://discourse.ifin.network/t/cursors-remote-tunnel-capability-is-vulnerable-to-malicious-prompt-injection/295#IFIN #ThreatIntel #ThreatIntelligence

The Gentlemen claims ransomware attack on Denmark's Jumbo Transport. 100+ trucks. #Ransomware #Transportation #Denmark #ThreatIntel

️ El Curso de Ciberseguridad está permanente disponible en el aula virtual para acceso inmediato. WhatsApp: https://wa.me/51949304030 https://www.reydes.com/e/Curso_de_Ciberseguridad #datasecurity #zerotrust #vulnerability #cyberattack #threatintel #databreach #cybersecurity

🟠 New security advisory:CVE-2026-40352 affects multiple systems.• Impact: Significant security breach potential• Risk: Unauthorized access or data exposure• Mitigation: Apply patches within 24-48 hoursFull breakdown:https://www.yazoul.net/advisory/cve/cve-2026-40352-fastgpt-nosql-injection-enables-account-takeover#Cybersecurity #ZeroDay #ThreatIntel

ModernStealer claims data breach on Pakistan's Nuclear Regulatory Authority (PNRA). Exfiltrated over 60 databases. #DataBreach #Government #Pakistan #ThreatIntel

(microsoft.com) Cross-Tenant Microsoft Teams Helpdesk Impersonation Campaign Enabling Multi-Stage Enterprise CompromiseNew multi-stage intrusion campaign abuses Microsoft Teams cross-tenant messaging to impersonate IT helpdesk (T1566.003), tricking users into Quick Assist remote access. Attackers deploy DLL sideloading via vendor-signed binaries (AcroServicesUpdater2_x64.exe, ADNotificationManager.exe, DlpUserAgent.exe) and Havoc C2 framework with registry-based encrypted configs. Lateral movement via WinRM (TCP 5985) targets domain controllers; exfiltration uses Rclone to cloud storage.In brief - Threat actors exploit Teams external collaboration to impersonate helpdesk, gain remote access via Quick Assist, and execute a stealthy multi-stage compromise using legitimate tools and protocols to evade detection.Technically - Initial access via cross-tenant Teams phishing (T1566.003) leads to Quick Assist abuse. DLL sideloading (msi.dll, vcruntime140_1.dll, mpclient.dll) via signed binaries in ProgramData. Havoc C2 with encrypted registry configs (user-context). Lateral movement via WinRM (TCP 5985) using harvested creds. Persistence via RMM tools (msiexec.exe). Exfiltration via Rclone to external cloud. Defender XDR KQL queries available for hunting across MessageEvents, DeviceProcessEvents, and other tables.Source: https://www.microsoft.com/en-us/security/blog/2026/04/18/crosstenant-helpdesk-impersonation-data-exfiltration-human-operated-intrusion-playbook/#Cybersecurity #ThreatIntel

https://peer.adalta.social/w/hf8jwrR8Z4datTPpBNAC79 [](https://adalta.info/articles/prstn_security_116421234802670946_fr) [️](https://www.redpacketsecurity.com/safepay-ransomware-victim-abfall-kreis-kassel-de/")Analyse Préliminaire d'une Cyberattaque Ciblant une Entité Publique Allemande#security #war #ransomware #threatintel #osint

https://peer.adalta.social/w/wCt78zo1cNG8FmbGf4XiSJ [](https://adalta.info/articles/prstn_security_116421234802670946_en) [️](https://www.redpacketsecurity.com/safepay-ransomware-victim-abfall-kreis-kassel-de/")A Critical Municipal Infrastructure Vulnerability Exploited#security #war #ransomware #threatintel #osint

https://peer.adalta.social/w/eXRWkRHob85gVBZmZWeMtK [](https://adalta.info/articles/prstn_security_116421234802670946_de) [️](https://www.redpacketsecurity.com/safepay-ransomware-victim-abfall-kreis-kassel-de/")Strategische Analyse eines kritischen Infrastruktur-Zwischenfalls#security #war #ransomware #threatintel #osint

DragonForce claims ransomware attack on United States' Travel of America. #Ransomware #USA #ThreatIntel

We've been tracking #Iran cyber activity since the beginning of March, consolidating high-value intelligence into a single thread. One of the most comprehensive resources on the topic, if we do say so ourselves. https://discourse.ifin.network/t/iran-conflict-cyber-threat-activity/145/#ThreatIntel #ThreatIntelligence #IFIN

(fortinet.com) Nexcorium: Mirai-Based Botnet Exploiting TBK DVR Vulnerability CVE-2024-3721 for DDoS CampaignsActive Mirai-based botnet 'Nexcorium' exploits CVE-2024-3721 in TBK DVR devices for DDoS campaigns. Attributed to 'Nexus Team' via custom HTTP header in exploit traffic.In brief - FortiGuard Labs uncovered a Mirai variant targeting unpatched TBK DVR devices via OS command injection (CVE-2024-3721). Nexcorium establishes persistence, supports multi-architecture payloads, and enables DDoS attacks via C2 r3brqw3d[.]b0ats[.]top. Threat actor 'Nexus Team' also embeds CVE-2017-17215 exploit for Huawei HG532 routers.Technically - Nexcorium is deployed via CVE-2024-3721 (TBK DVR mdb/mdc argument manipulation). A downloader script fetches architecture-specific binaries (ARM/MIPS/x86-64) with XOR-encoded configs (keys 0x13/0xFD) containing C2, brute-force creds, and DDoS commands. Persistence mechanisms include /etc/inittab, rc.local, systemd service, and crontab. The malware conducts Telnet brute-forcing and supports 10 DDoS methods (UDP/TCP/SMTP floods, VSE query flood). Self-integrity checks via FNV-1a hashing ensure resilience.Source: https://www.fortinet.com/blog/threat-research/tracking-mirai-variant-nexcorium-a-vulnerability-driven-iot-botnet-campaign#Cybersecurity #ThreatIntel

️ Heads up #infosec communityFound a malicious GitHub repo posing as a curated list of cybersecurity Telegram channels.Every link in the README points to the same ZIP payload containing luad.exe (malware family: Alevaul). Detected by Microsoft Defender before execution.VT 0/91 on URL but MDE flagged it as True Positive. Classic evasion. https://github.com/simplefastfunnels254/tg-cybersecReported to GitHub under Active Malware / DSA Article 16.#CyberSecurity #ThreatIntel #MDE #Malware #GitHub #OSINT