Security Signals (1/27/26-2/10/26)

Cybersecurity News

Welcome to your biweekly digest of curated cybersecurity intelligence.

Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activity, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.

For more articles, check out our #onpatrol4malware blog.

January 2026 Edition

Key stats from real-world telemetry and live attack observations over the past month – a concise look at what we’re seeing across malware, phishing, ransomware, C2s, and domain abuse.

READ

This Edition’s Articles

Early February 2026 Cyber Threat Reports capture the momentum behind real-world attacks: APT28 exploiting CVE-2026-21509, DynoWiper destructive activity, and ransomware tradecraft tied to LockBit/Black Basta, alongside infostealer- and phishing-driven abuse of platforms like Google Cloud, WordPress, and macOS/Android.

New Year, New Sector: Transparent Tribe Targets India’s Startup Ecosystem

Source: Acronis Threat Research Unit
(Published: 27 January 2026)
Transparent Tribe, a well-known APT group, has expanded its targeting to India’s rapidly growing startup ecosystem. Read more.

The Pyrat Code: Python-Based RAT and Its Internals

Source: K7 Labs
(Published: 28 January 2026)
Pyrat is a Python-based Remote Access Trojan that has been observed in multiple attack campaigns targeting Windows systems. Read more.

Interlock Ransomware: New Techniques, Same Old Tricks

Source: Fortinet Threat Research
(Published: 27 January 2026)
Interlock ransomware operators continue to refine their tooling while relying on well-established intrusion techniques. Read more.

No Place Like Home Network: Disrupting the World’s Largest Residential Proxy Network

Source: Google Cloud Blog
(Published: 28 January 2026)
This week Google and partners took action to disrupt what we believe is one of the largest residential proxy networks in the world, the IPIDEA proxy network. Read more.

Shadow Campaigns: Uncovering Global Espionage

Source: Palo Alto Networks Unit 42
(Published: 28 January 2026)
Unit 42 researchers have uncovered a set of previously undocumented campaigns conducting cyber espionage across multiple regions. Read more.

PureRAT: Attacker Now Using AI to Build Toolset

Source: SECURITY.COM
(Published: 28 January 2026)
A Vietnamese threat actor is likely using AI to author code powering an ongoing phishing campaign delivering the PureRAT malware and other payloads. Read more.

TAMECAT – Analysis of an Iranian PowerShell-Based Backdoor

Source: Pulsedive Threat Research
(Published: 29 January 2026)
Artifacts from our analysis are available on our GitHub. Read more.

Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic

Source: Sekoia.io
(Published: 29 January 2026)
In November 2025, during our threat hunting routine for unveiling emerging adversary clusters, TDR analysts identified a widespread malware distribution campaign leveraging the ClickFix social engineering tactic through a Traffic Distribution System (TDS). Read more.

Dissecting UAT-8099: New persistence mechanisms and regional focus

Source: Cisco Talos Intelligence Blog
(Published: 29 January 2026)
Cisco Talos has identified a new campaign by UAT-8099, active from late 2025 to early 2026, that is targeting vulnerable Internet Information Services (IIS) servers across Asia with a specific focus on victims in Thailand and Vietnam. Read more.

RedKitten: AI-accelerated campaign targeting Iranian protests

Source: HarfangLab
(Published: 29 January 2026)
RedKitten is a newly identified campaign targeting Iranian interests, likely including non-governmental organizations and individuals involved in documenting recent human rights abuses, first observed in early January 2026. Read more.

Honeymyte Updates: CoolClient Uses Browser Stealers and Scripts

Source: Securelist (Kaspersky)
(Published: 29 January 2026)
We continue to track the Honeymyte activity cluster and recently observed new updates to the CoolClient malware family. Read more.

New ShadowSyndicate Infrastructure Identified

Source: Group-IB
(Published: 29 January 2026)
Group-IB researchers have identified new infrastructure linked to the ShadowSyndicate cybercriminal group. Read more.

Silent Brothers | Ollama Hosts Form Anonymous AI Network Beyond Platform Guardrails

Source: SentinelOne
(Published: 29 January 2026)
A joint research project between SentinelLABS and Censys reveals that open-source AI deployment has created an unmanaged, publicly accessible layer of AI compute infrastructure spanning 175,000 hosts worldwide, operating outside the guardrails and monitoring systems that platform providers implement by default. Read more.

The Rise of Arsink Rat

Source: Zimperium
(Published: 29 January 2026)
Arsink is a cloud-native Android Remote Access Trojan (RAT) that aggressively harvests private data and gives remote operators intrusive control over infected devices. Read more.

PRC Targets NATO Frontline States

Source: Jamestown Foundation
(Published: 30 January 2026)
The People’s Republic of China (PRC) is expanding its presence along the North Atlantic Treaty Organization’s (NATO) frontline through technology access, influence networks, and dual-use infrastructure, creating openings that could weaken alliance cohesion and expose vulnerabilities in Europe’s defense posture. Read more.

Guidance from the Frontlines: Proactive Defense Against ShinyHunters-Branded Data Theft Targeting SaaS

Source: Google Cloud Blog
(Published: 30 January 2026)
Mandiant is tracking a significant expansion and escalation in the operations of threat clusters associated with ShinyHunters-branded extortion. Read more.

Stan Ghouls in Uzbekistan

Source: Securelist (Kaspersky)
(Published: 30 January 2026)
We uncovered a series of attacks in Uzbekistan that appear to be linked to the long-running “Stalkerware” ecosystem. Read more.

DynoWiper update: Technical analysis and attribution

Source: WeLiveSecurity (ESET Research)
(Published: 30 January 2026)
In this blog post, we provide more technical details related to our previous DynoWiper publication. Read more.

Iconics Suite Vulnerability Exploited in the Wild (CVE-2025-0921)

Source: Palo Alto Networks Unit 42
(Published: 31 January 2026)
Unit 42 researchers have observed active exploitation of a vulnerability in the Iconics Suite software platform. Read more.

DynoWiper: Destructive Malware Targeting Hybrid Environments

Source: Elastic Security Labs
(Published: 1 February 2026)
Elastic Security Labs identified DynoWiper, a destructive malware strain designed to disrupt hybrid cloud environments. Read more.

The Autonomous Adversary: From Chatbot to Criminal Enterprise

Source: InfoStealers
(Published: 1 February 2026)
Advances in large language models are beginning to reshape how cybercriminals automate operations and decision-making. Read more.

Android Trojan Campaign Uses Hugging Face to Host RAT Payload

Source: Bitdefender Labs
(Published: 2 February 2026)
Bitdefender researchers have identified an Android malware campaign abusing the Hugging Face platform to host malicious payloads. Read more.

Dark Web Marketplaces: An Overview

Source: DEXpose
(Published: 2 February 2026)
Dark web marketplaces continue to play a central role in the cybercrime ecosystem by facilitating the sale of illicit goods and services. Read more.

Citrix Recon Using Residential Proxies

Source: GreyNoise
(Published: 2 February 2026)
GreyNoise researchers observed widespread reconnaissance activity targeting Citrix environments using residential proxy infrastructure. Read more.

Infostealers Without Borders: macOS Python Stealers and Platform Abuse

Source: Microsoft Security Blog
(Published: 2 February 2026)
Microsoft researchers are tracking a rise in macOS-focused Python-based infostealers abusing legitimate platforms for distribution. Read more.

APT28 Leverages CVE-2026-21509 in Operation Neusploit

Source: Zscaler ThreatLabz
(Published: 2 February 2026)
In January 2026, Zscaler ThreatLabz identified a new campaign in-the-wild, tracked as Operation Neusploit, targeting countries in the Central and Eastern European region. Read more.

APT28: Geofencing as a Targeting Signal (CVE-2026-21509 Campaign)

Source: Synaptic Security Blog
(Published: 3 February 2026)
Since the beginning of this year, we have again observed an increased number of attacks by APT28 targeting various European countries. Read more.

APT28’s Campaign Leveraging CVE-2026-21509 and Cloud C2 Infrastructure

Source: StrikeReady
(Published: 3 February 2026)
APT28 has launched a new campaign exploiting CVE-2026-21509 and leveraging cloud-hosted command-and-control infrastructure. Read more.

Likely Fake Ransomware Operator 0apt Causes Panic: Our Analysis

Source: Intel 471
(Published: 3 February 2026)
Intel 471 analysts assess that the ransomware operator known as 0apt is likely engaging in deception rather than conducting real attacks. Read more.

SnappyBee Malware Analysis

Source: Darktrace
(Published: 3 February 2026)
Darktrace analysts investigated a new malware family dubbed SnappyBee observed in recent intrusions. Read more.

19 Shades of LockBit 5.0: Inside the Latest Cross-Platform Ransomware (Part 1)

Source: LevelBlue SpiderLabs
(Published: 3 February 2026)
Researchers analyzed LockBit 5.0 to understand how the ransomware has evolved into a cross-platform threat. Read more.

Analysis of Suspected Malware Linked to APT-Q-27 Targeting Financial Institutions

Source: CyStack
(Published: 4 February 2026)
In mid-January 2026, CyStack’s security team observed anomalous activity on a corporate customer’s environment. Read more.

Russian Cyber Threat Activity Ahead of the 2026 Winter Olympics

Source: Palo Alto Networks Unit 42
(Published: 4 February 2026)
Russian cyber threat actors are likely to increase activity in the lead-up to the 2026 Winter Olympics, according to Unit 42 analysis. Read more.

When Malware Talks Back

Source: PointWild
(Published: 4 February 2026)
Modern malware increasingly incorporates interactive capabilities that allow operators to adapt campaigns in real time. Read more.

Operation Bizarre Bazaar

Source: Pillar Security
(Published: 4 February 2026)
Operation Bizarre Bazaar documents a coordinated campaign abusing trusted platforms to distribute malicious payloads. Read more.

Inside a Multi-Stage Android Malware Campaign Leveraging RTO-Themed Social Engineering

Source: Seqrite
(Published: 4 February 2026)
In recent years, Android malware campaigns in India have increasingly abused the trust associated with government services and official digital platforms. Read more.

CISA tells agencies to stop using unsupported edge devices

Source: CyberScoop
(Published: 5 February 2026)
A binding operational directive issued Thursday looks to combat an attack pathway that has been behind some of the biggest attacks and most common exploits in recent years. Read more.

Substack Breach: 662,752 User Records Leaked on Cybercrime Forum

Source: Hackread
(Published: 5 February 2026)
Three days before Substack told users about a security incident, a very different version of the story was already circulating in underground cyber crime forums. Read more.

Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework

Source: Cisco Talos Intelligence Blog
(Published: 5 February 2026)
Cisco Talos uncovered “DKnife,” a fully featured gateway-monitoring and adversary-in-the-middle (AitM) framework comprising seven Linux-based implants that perform deep-packet inspection, manipulate traffic, and deliver malware via routers and edge devices. Read more.

Please Don’t Feed the Scattered Lapsus-Shiny Hunters

Source: Krebs on Security
(Published: 5 February 2026)
Researchers are warning that attention-seeking cybercrime groups thrive on publicity and notoriety. Read more.

ClickFix Variant CrashFix Deploying Python RAT Trojan

Source: Microsoft Security Blog
(Published: 5 February 2026)
Microsoft has identified a new ClickFix variant dubbed CrashFix that deploys a Python-based RAT. Read more.

Reynolds: Defense Evasion Capability Embedded in Ransomware Payload

Source: SECURITY.COM
(Published: 5 February 2026)
A recent Reynolds ransomware campaign was notable because the ransomware contained a bring-your-own-vulnerable-driver (BYOVD) defense evasion component embedded within the ransomware payload itself. Read more.

AppleScript Abuse: Unpacking a macOS Phishing Campaign

Source: Darktrace
(Published: 5 February 2026)
Darktrace researchers uncovered a phishing campaign abusing AppleScript to target macOS users. Read more.

China’s Salt Typhoon Hackers Broke Into Norwegian Companies

Source: TechCrunch
(Published: 6 February 2026)
Hackers linked to the Chinese state-sponsored group known as Salt Typhoon have breached multiple Norwegian companies. Read more.

Incognito Market Operator Sentenced to Thirty Years

Source: The Record
(Published: 6 February 2026)
The operator of the darknet drug marketplace Incognito Market has been sentenced to thirty years in prison. Read more.

Git Metadata Leak Exposes Sensitive Information

Source: Mysterium VPN
(Published: 6 February 2026)
Researchers uncovered widespread exposure of sensitive information due to leaked Git metadata in public repositories. Read more.

Nginx Traffic Hijacking in React2Shell Campaign

Source: The Cybersecurity Guru
(Published: 7 February 2026)
Researchers have uncovered a campaign abusing exposed Nginx configurations to hijack web traffic and deploy malicious payloads. Read more.

Malicious Bing Ads Lead to Widespread Azure Tech Support Scams

Source: Netskope
(Published: 7 February 2026)
Netskope researchers uncovered a large-scale campaign abusing Bing ads to deliver Azure-themed tech support scams. Read more.

Aisuru Botnet Sets New Record With 3.14 Tbps DDoS Attack

Source: BleepingComputer
(Published: 8 February 2026)
The Aisuru botnet has set a new distributed denial-of-service record with a massive 3.14 Tbps attack. Read more.

Labyrinth Chollima Evolves Into Three Adversaries

Source: CrowdStrike
(Published: 8 February 2026)
CrowdStrike researchers have observed the threat group Labyrinth Chollima splintering into three distinct adversaries. Read more.

The GRU Illegals

Source: Lab52
(Published: 8 February 2026)
Russian intelligence services have historically relied on so-called “illegals” – deep-cover operatives who live for years in foreign countries under false identities. Read more.

Prince of Persia, Part II

Source: SafeBreach Labs
(Published: 8 February 2026)
SafeBreach researchers continue their analysis of the Prince of Persia campaign, revealing additional tradecraft and tooling. Read more.

LTX Stealer: Analysis of a Node.js-Based Credential Stealer

Source: Cyfirma
(Published: 9 February 2026)
Cyfirma researchers analyzed a new credential-stealing malware written in Node.js dubbed LTX Stealer. Read more.

Re-Emerging Telegram Phishing Campaign Targeting User Authorization Prompts

Source: Cyfirma
(Published: 9 February 2026)
A phishing campaign abusing Telegram authorization prompts has resurfaced with updated infrastructure and lures. Read more.

S’pore’s major telcos came under attack by UNC3886 in 2025

Source: The Straits Times
(Published: 9 February 2026)
SINGAPORE – All four major telcos in Singapore came under attack by state-sponsored cyberespionage group UNC3886, whose activities to disrupt critical services here were first made public in July 2025. Read more.

Want more articles? Check out the previous edition of Security Signals here. 

?

How big are your threat data gaps?

See for yourself.

Free Data Evaluation
?

Security Signals (1/13/26-1/27/26)

Cybersecurity News

Welcome to your biweekly digest of curated cybersecurity intelligence.

Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activity, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.

For more articles, check out our #onpatrol4malware blog.

Turn Insights Into Action with Free Threat Intel

Security Signals gives you the insights and our Risk Indicators OSINT feeds help you apply them.

SUBSCRIBE FOR FREE

This Edition’s Articles

Late January 2026 Cyber Threat Reports spotlight real-world abuse of trusted platforms and exposed infrastructure – from LockBit 5.0 and KONNI to BRICKSTORM, Gootloader-style delivery tricks, and attacks leveraging tools like Visual Studio Code, PAN-OS GlobalProtect, and Google Gemini. Expect recurring themes of phishing/credential theft, malware staging, and operational tooling that turns everyday enterprise workflows into attack paths.

Planned failure: Gootloader’s malformed ZIP actually works perfectly

Source: Expel
(Published: 15 January 2026)
Gootloader malware is delivered to victims in a ZIP archive and the ZIP itself is designed to bypass detection. Read more.

Keylogger targets 200,000+ employees at major US bank

Source: Sansec
(Published: 15 January 2026)
Sansec discovered an active keylogger on the employee merchandise store of a top 3 US bank. Read more.

Inside LockBit 5.0: Analyzing the Ransomware Group’s Latest Affiliate Panel and Encryption Variants

Source: Flare
(Published: 16 January 2026)
The leaked materials provide unprecedented visibility into LockBit’s affiliate management system, showing the interface used by ransomware operators to coordinate attacks and manage victim negotiations. Read more.

Remcos RAT Being Distributed to Korean Users

Source: ASEC (AhnLab)
(Published: 16 January 2026)
AhnLab SEcurity intelligence Center (ASEC) has confirmed the distribution of the Remcos RAT targeting users in South Korea. Read more.

Mandiant releases rainbow table that cracks weak admin password in 12 hours

Source: Ars Technica
(Published: 16 January 2026)
Windows laggards still using the vulnerable hashing function: Your days are numbered. Read more.

Poland Under Intensified DDoS Siege: Weekly DDoS Threat Intelligence Analysis

Source: SOCRadar
(Published: 18 January 2026)
Between 12 and 18 January 2026, SOCRadar identified an intensive coordinated DDoS campaign conducted by the pro-Russian threat actor NoName057(16) and their DDoSia attack tool. Read more.

CVE-2026-0227 PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal

Source: Palo Alto Networks
(Published: 19 January 2026)
A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall. Read more.

NCSC issues warning over hacktivist groups disrupting UK organisations and online services

Source: UK National Cyber Security Centre (NCSC)
(Published: 19 January 2026)
New alert warns of state-aligned hacktivists targeting UK organisations, looking to cripple services and disable websites. Read more.

Hacker admits to leaking stolen Supreme Court data on Instagram

Source: BleepingComputer
(Published: 19 January 2026)
A Tennessee man has pleaded guilty to hacking the U.S. Supreme Court’s electronic filing system and breaching accounts at the AmeriCorps U.S. federal agency and the Department of Veterans Affairs. Read more.

Broker who sold malware to the FBI set for sentencing

Source: The Register
(Published: 19 January 2026)
Feras Khalil Ahmad Albashiti, 40, admitted to facilitating cyberattacks on at least 50 companies stateside. Read more.

Operation Covert Access: Weaponized LNK-Based Spear-Phishing Targeting Argentina’s Judicial Sector to Deploy a Covert RAT

Source: Seqrite
(Published: 19 January 2026)
Seqrite Labs has identified and uncovered a globally active spear-phishing campaign targeting Argentina’s judicial sector. Read more.

Weaponizing Calendar Invites: A Semantic Attack on Google Gemini

Source: Miggo
(Published: 19 January 2026)
A standard calendar invite became an attack vector, exposing how prompt injection in Google Gemini bypassed privacy controls through language alone. Read more.

Kimwolf Botnet Lurking in Corporate, Govt. Networks

Source: Krebs on Security
(Published: 20 January 2026)
A new Internet-of-Things (IoT) botnet called Kimwolf has spread to more than 2 million devices, forcing infected systems to participate in massive distributed denial-of-service (DDoS) attacks and to relay other malicious and abusive Internet traffic. Read more.

BRICKSTORM Malware Report Highlights the Criticality of Network-Derived Telemetry

Source: Gigamon
(Published: 20 January 2026)
Although GTIG laments the lack of security telemetry in its analysis of the BRICKSTORM malware, network-derived telemetry from the analysis of network traffic is a rich source that can and should be leveraged by threat hunters and IR teams. Read more.

Inside a Multi-Stage Windows Malware Campaign

Source: Fortinet (FortiGuard Labs)
(Published: 20 January 2026)
FortiGuard Labs recently identified a multi-stage malware campaign primarily targeting users in Russia. Read more.

IntelBroker Unmasked – The Story of Hacker Kai Logan West

Source: Picus Security
(Published: 20 January 2026)
If you’ve been following cybersecurity news lately, you’ve almost certainly heard the name “IntelBroker.”. Read more.

Threat Actors Expand Abuse of Microsoft Visual Studio Code

Source: Jamf
(Published: 20 January 2026)
Jamf Threat Labs identifies additional abuse of Visual Studio Code. Read more.

Predator bots are exploiting APIs at scale. Here’s how defenders must respond.

Source: CyberScoop
(Published: 20 January 2026)
With malicious bots now accounting for roughly 37% of all web traffic, security teams are left feeling like they’re playing a giant game of bot whack-a-mole. Read more.

PyPI Package Impersonates SymPy to Deliver Cryptomining Malware

Source: Socket
(Published: 21 January 2026)
Socket’s Threat Research Team identified a malicious PyPI package, sympy-dev, that impersonates SymPy, a widely used symbolic mathematics library with roughly 85 million downloads per month. Read more.

Peruvian Peaks: The digital loan illusion

Source: Group-IB
(Published: 21 January 2026)
A deep dive into loan phishing scams in Peru and Latin America. Read more.

Detailed Analysis of LockBit 5.0

Source: S2W (Medium)
(Published: 21 January 2026)
The LockBit ransomware group was affiliated with the Maze ransomware cartel, but after Maze announced its retirement, it began operating independently under the name ABCD ransomware starting in September 2019. Read more.

Phishing kits adapt to the script of callers

Source: Okta
(Published: 22 January 2026)
The threat actor convinces the targeted user to navigate in their browser to the phishing site under the pretext of an IT support or security requirement. Read more.

KONNI Adopts AI to Generate PowerShell Backdoors

Source: Check Point Research
(Published: 22 January 2026)
The PowerShell backdoor strongly indicates AI-assisted development rather than traditional operator-authored malware. Read more.

Weaponized in China, Deployed in India: The SyncFuture Espionage Targeted Campaign

Source: eSentire
(Published: 22 January 2026)
eSentire’s Threat Response Unit tracks this activity as “SyncFuture Espionage campaign” based on the abuse of SyncFuture/Yangtu enterprise software and a sophisticated multi-stage infection chain targeting Indian entities. Read more.

Microsoft Gave FBI Keys To Unlock Encrypted Data, Exposing Major Privacy Flaw

Source: Forbes
(Published: 22 January 2026)
Microsoft confirmed it does provide BitLocker recovery keys if it receives a valid legal order. Read more.

ErrTraffic: Inside a GlitchFix Attack Panel

Source: Censys
(Published: 20 January 2026)
ErrTraffic is a Traffic Distribution System (TDS) designed specifically for ClickFix-like campaigns. Read more.

Microsoft shared BitLocker keys with FBI, raising privacy fears

Source: TechRepublic
(Published: 26 January 2026)
Microsoft confirmed it can hand over BitLocker recovery keys stored in the cloud under warrant, reviving debate over who controls encrypted data. Read more.

Want more articles? Check out the previous edition of Security Signals here. 

?

Take advantage of our free data evaluation.

REQUEST NOW
?

Security Signals (12/30/25-01/13/26)

Cybersecurity News

Welcome to your biweekly digest of curated cybersecurity intelligence.

Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activity, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.

For more articles, check out our #onpatrol4malware blog.

Turn Insights Into Action with Free Threat Intel

Security Signals gives you the insights and our Risk Indicators OSINT feeds help you apply them.

SUBSCRIBE FOR FREE

This Edition’s Articles

These early January 2026 cyber threat reports showcase how attackers are actively abusing trusted software, exposed infrastructure, and popular platforms to reach victims at scale. This roundup highlights GoBruteforcer server attacks, UAT-7290 telecom targeting, fake WinRAR installers delivering malware, malicious Chrome extensions abusing AI tools, and ongoing MacSync stealer campaigns impacting macOS users.

APT36 : Multi-Stage LNK Malware Campaign Targeting Indian Government Entities

Source: CYFIRMA
(Published: 30 December 2025)
CYFIRMA has identified a targeted malware campaign attributed to APT36 (Transparent Tribe), a Pakistan aligned threat actor actively engaged in cyber espionage operations against Indian governmental, academic, and strategic entities. Read more.

From Victim to Vector: How Infostealers Turn Legitimate Businesses into Malware Hosts

Source: InfoStealers
(Published: 30 December 2025)
This entry in the Hudson Rock database means that a computer – likely belonging to a developer or admin at jrqsistemas.com – was infected by an Infostealer. Read more.

2 Security Experts Plead Guilty In BlackCat Ransomware Case

Source: The Cyber Express
(Published: 30 December 2025)
Ryan Goldberg, 40, of Georgia, and Kevin Martin, 36, of Texas, were indicted in the BlackCat ransomware case in October. Read more.

Knownsec Data Breach: A Trove of Espionage Tradecraft with an Insider Narrative

Source: Resecurity
(Published: 31 December 2025)
The Knownsec leak is a pivotal incident of 2025 because it exposed the inner workings of a major state-linked Chinese cybersecurity firm, revealed espionage tools and global targets, internal documentation, and evidence of ongoing cyber operations targeting other countries. Read more.

VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion

Source: Unit 42 (Palo Alto Networks)
(Published: 2 January 2026)
This article details our technical analysis of VVS stealer, also styled VVS $tealer, including its distributors’ use of obfuscation and detection evasion. Read more.

Resurgence of Scattered Lapsus$ hunters

Source: CYFIRMA
(Published: 3 January 2026)
Recent monitoring of underground forums and Telegram communities has identified the resurgence of the Scattered Lapsus$ collective. Read more.

D-Link DSL/DIR/DNS Command Injection via DNS Configuration Endpoint

Source: VulnCheck
(Published: 5 January 2026)
severity critical. Read more.

NordVPN Denies Breach After Hacker Leaks Data

Source: SecurityWeek
(Published: 6 January 2026)
The VPN company has conducted an investigation after a threat actor claimed to have hacked its systems. Read more.

Phishing actors exploit complex routing and misconfigurations to spoof domains

Source: Microsoft Security Blog
(Published: 6 January 2026)
Any third-party connectors – such as a spam filtering service, security solution, or archiving service – must be configured properly or spoof detections cannot be calculated correctly, allowing phishing emails such as the examples below to be delivered. Read more.

The Great VM Escape: ESXi Exploitation in the Wild

Source: Huntress
(Published: 7 January 2026)
In December 2025, Huntress observed an intrusion leading to the deployment of VMware ESXi exploits. Read more.

Malicious NPM Packages Deliver NodeCordRAT

Source: Zscaler ThreatLabz
(Published: 7 January 2026)
Zscaler ThreatLabz regularly monitors the `npm` database for suspicious packages. Read more.

Researchers rush to warn defenders of max-severity defect in n8n

Source: CyberScoop
(Published: 7 January 2026)
Roughly 100,000 servers running the automated workflow platform for AI and other enterprise tools are potentially exposed to exploitation. Read more.

Chrome Extensions Impersonate AI Tools to Steal ChatGPT & DeepSeek Chats

Source: SOCRadar
(Published: 7 January 2026)
A recently uncovered malware campaign involving Chrome extensions demonstrates how seemingly legitimate AI-focused add-ons can be abused to quietly collect sensitive user data at scale. Read more.

Inside GoBruteforcer: AI-Generated Server Defaults, Weak Passwords, and Crypto-Focused Campaigns

Source: Check Point Research
(Published: 7 January 2026)
GoBruteforcer is a botnet that turns compromised Linux servers into scanning and password brute-force nodes. Read more.

UAT-7290 targets high value telecommunications infrastructure in South Asia

Source: Cisco Talos
(Published: 8 January 2026)
Cisco Talos is disclosing a sophisticated threat actor we track as UAT-7290, who has been active since at least 2022. Read more.

Fake WinRAR downloads hide malware behind a real installer

Source: Malwarebytes
(Published: 8 January 2026)
A member of our web research team pointed me to a fake WinRAR installer that was linked from various Chinese websites. Read more.

Maduro Arrest Used as a Lure to Deliver Backdoor

Source: Darktrace
(Published: 9 January 2026)
Darktrace researchers observed threat actors exploiting reports of Venezuelan President Maduro’s arrest to deliver backdoor malware. Read more.

MacSync stealer is using a notarized app to bypass Mac defenses

Source: Moonlock
(Published: 9 January 2026)
MacSync, the new macOS stealer in town, is back with new tricks. Read more.

Boto-Cor-de-Rosa campaign reveals Astaroth WhatsApp-based worm activity in Brazil

Source: Acronis Threat Research Unit
(Published: 8 January 2026)
In a newly identified campaign, internally referred to as Boto Cor-de-Rosa, our researchers discovered that Astaroth now exploits WhatsApp Web as part of its propagation strategy. Read more.

Under Medusa’s Gaze: How Darktrace Uncovers RMM Abuse in Ransomware Campaigns

Source: Darktrace
(Published: 8 January 2026)
Medusa ransomware increasingly exploits remote monitoring and management (RMM) tools for persistence, lateral movement, and data exfiltration. Read more.

Reborn in Rust: Muddy Water Evolves Tooling with RustyWater Implant

Source: CloudSEK
(Published: 8 January 2026)
CloudSEK’s TRIAD recently identified a spear-phishing campaign attributed to the Muddy Water APT group targeting multiple sectors across the Middle East, including diplomatic, maritime, financial, and telecom entities. Read more.

North Korean Kimsuky Actors Leverage Malicious QR Codes in Spearphishing Campaigns Targeting U.S. Entities

Source: FBI IC3 (FLASH)
(Published: 8 January 2026)
The Federal Bureau of Investigation (FBI) is releasing this FLASH to alert NGOs, think tanks, academia, and other foreign policy experts with a nexus to North Korea of evolving tactics employed by the North Korean state-sponsored cyber threat group Kimsuky and to provide mitigation recommendations. Read more.

Iran Implements Nationwide Military Jamming to Cripple Starlink and Enforce Digital Blackout

Source: Reclaim The Net
(Published: 12 January 2026)
Iran’s government has expanded its control over digital communication, deploying military jamming systems that have largely disabled Starlink satellite access. Read more.

Stealthy malware masking its activity, deploying infostealer

Source: Kaspersky
(Published: 12 January 2026)
Our experts have detected a new wave of malicious emails targeting Russian private-sector organizations. Read more.

Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure

Source: Red Asgard
(Published: 12 January 2026)
We found North Korean malware in a client’s Upwork project. Read more.

Unmasking the DPRK Remote Worker Problem

Source: Silent Push
(Published: 12 January 2026)
For decades, the “insider threat” was synonymous with the disgruntled staffer or the negligent contractor. Read more.

Want more articles? Check out the previous edition of Security Signals here. 

?

Take advantage of our free data evaluation.

REQUEST NOW
?

Security Signals (12/02/25-12/16/25)

Cybersecurity News

Welcome to your biweekly digest of curated cybersecurity intelligence.

Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activity, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.

For more articles, check out our #onpatrol4malware blog.

Turn Insights Into Action with Free Threat Intel

Security Signals gives you the insights and our Risk Indicators OSINT feeds help you apply them.

SUBSCRIBE FOR FREE

This Edition’s Articles

Mid December 2025 Cyber Threat Reports highlight how rapidly evolving threats are colliding with geopolitics, cloud infrastructure, and everyday consumer tech. This roundup spans everything from React2Shell mass exploitation to new Android banking malware, Mirai botnets at sea, and fresh ransomware tooling targeting ESXi and EDR.

Investigating an AiTM Phishing Campaign Targeting M365 and Okta

Source: Datadog Security Labs
(Published: 10 December 2025)
Datadog researchers detail an adversary-in-the-middle phishing campaign designed to bypass MFA protections for Microsoft 365 and Okta users. Read more.

Share ChatGPT Chat ClickFix: macOS AMOS Infostealer

Source: Kaspersky
(Published: 9 December 2025)
Kaspersky researchers describe a macOS infostealer campaign abusing fake ChatGPT sharing prompts to trick users into executing malicious commands. Read more.

Detecting Mythic C2 in Network Traffic

Source: Kaspersky Securelist
(Published: 11 December 2025)
This research outlines techniques for identifying Mythic command-and-control traffic using network-level indicators and behavioral patterns. Read more.

IT, Geopolitics, and Cyber Risk: How Global Tensions Shape the Attack Surface

Source: Rapid7
(Published: 11 December 2025)
Rapid7 examines how geopolitical instability influences cyber operations, threat actor targeting, and organizational risk exposure. Read more.

CyberVolk Returns: Flawed VolkLocker Brings New Features With Growing Pains

Source: SentinelOne
(Published: 10 December 2025)
SentinelOne analyzes the reemergence of CyberVolk ransomware, highlighting technical flaws alongside newly added capabilities. Read more.

Cato CTRL: Deep Dive Into New JSCeal Infostealer Campaign

Source: Cato Networks
(Published: 11 December 2025)
Cato Networks investigates a new JSCeal infostealer campaign leveraging obfuscated JavaScript to harvest credentials at scale. Read more.

What Happens to Stolen Data After Phishing Attacks?

Source: Kaspersky Securelist
(Published: 12 December 2025)
This article examines how stolen credentials and personal data are monetized, resold, and reused following phishing attacks. Read more.

The Infostealer to APT Pipeline: How Lazarus Hijacked a Yemen Disinformation Network

Source: Infostealers.com
(Published: 12 December 2025)
Researchers describe how the Lazarus Group leveraged infostealer infrastructure to compromise and repurpose a Yemen-based disinformation network. Read more.

Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite

Source: Unit 42 (Palo Alto Networks)
(Published: 11 December 2025)
Unit 42 researchers detail how Hamas-affiliated threat actor Ashen Lepus is using a new AshTag malware suite to target Middle Eastern diplomatic entities. Read more.

Apple fixes two zero-day flaws exploited in ‘sophisticated’ attacks

Source: BleepingComputer
(Published: 12 December 2025)
Apple has released emergency updates to patch two zero-day vulnerabilities that were exploited in an extremely sophisticated attack targeting specific individuals. Read more.

Operation MoneyMount-ISO – Deploying Phantom Stealer via ISO-Mounted Executables

Source: Seqrite
(Published: 12 December 2025)
At Seqrite Labs, we continuously monitor global cyber threat activity. Read more.

Threats Behind the Mask of Gentlemen Ransomware

Source: ASEC
(Published: 11 December 2025)
ASEC researchers analyze threats hidden behind the so-called Gentlemen ransomware, including its infection vector, encryption behavior, and tactics for evading detection. Read more.

Evolution of Composite Cyber Threats: 2025 Analysis and 2026 Key Response Strategies

Source: Medium (@nshcthreatrecon)
(Published: 15 December 2025)
This long-form analysis explores how composite cyber threats evolved in 2025 and outlines key response strategies defenders should prioritize in 2026. Read more.

Free Micropatches for Windows Remote Access Connection Manager DoS

Source: 0patch
(Published: 11 December 2025)
0patch ships free micropatches for a Windows Remote Access Connection Manager zero day that attackers can abuse to gain Local System privileges on vulnerable hosts. Read more.

Microsoft Teams to Introduce External Domains Anomalies Report for Enhanced Security

Source: Cybersecurity News
(Published: 11 December 2025)
Microsoft is adding an External Domains Anomalies report to Teams so administrators can spot unusual communication patterns with outside tenants and clamp down on risky connections. Read more.

New DroidLock Malware Locks Android Devices and Demands a Ransom

Source: Cybersecurity News
(Published: 11 December 2025)
Researchers warn that the DroidLock Android malware is being pushed via phishing sites, locking victims’ phones for ransom while also enabling attackers to take remote control. Read more.

Notepad++ Vulnerability Let Attackers Hijack Network Traffic to Install Malware via Updates

Source: Cybersecurity News
(Published: 11 December 2025)
A vulnerability in Notepad++ update traffic could allow threat actors to intercept requests on the network and deliver malicious payloads disguised as legitimate software updates. Read more.

Threat actors exploit React2Shell CVE-2025-55182

Source: Google Cloud Threat Intelligence
(Published: 12 December 2025)
Google Threat Intelligence details how multiple actors quickly weaponized the React2Shell (CVE-2025-55182) remote code execution flaw in React Server Components to gain initial access to internet facing services. Read more.

How NoName05716 Uses DDoSia to Attack NATO Targets

Source: Picus Security
(Published: 14 December 2025)
Picus analyzes how pro Russian hacktivist group NoName05716 leverages its DDoSia platform to coordinate politically motivated DDoS attacks against NATO aligned governments and organizations. Read more.

Frogblight threatens you with a court case: a new Android banker targets Turkish users

Source: Securelist
(Published: 15 December 2025)
Kaspersky describes Frogblight, an Android banking trojan distributed via smishing and fake government court case portals that steals banking credentials and can remotely control infected devices. Read more.

DDoS Threat Intelligence: Belgium, 15 Dec 2025

Source: SOCRadar
(Published: 15 December 2025)
SOCRadar details a DDoSia campaign by pro Russian group NoName05716 that generated thousands of DDoS attacks focusing on Belgium as well as Ukraine and other European targets between 8 and 14 December 2025. Read more.

Cyberattack on the Sun

Source: Cato Networks
(Published: 15 December 2025)
Cato Networks examines how insecure legacy protocols in solar power infrastructure could let attackers manipulate inverters at scale and cause widespread power disruption. Read more.

TR SantaStealer Is Coming to Town: A New, Ambitious Infostealer Advertised on Underground Forums

Source: Rapid7
(Published: 15 December 2025)
Rapid7 profiles SantaStealer, a new information stealing malware as a service offering on underground forums that targets browser, cryptocurrency wallet, and application credentials. Read more.

Phishing Kits: An Interactive Deep Dive

Source: Flare
(Published: 15 December 2025)
Flare takes an interactive look at modern phishing kits, showing how they bundle cloned login pages, evasion features, and automation to let low skill actors harvest credentials at scale. Read more.

GhostPairing Attacks: from phone number to full access in WhatsApp

Source: Gen Digital
(Published: 15 December 2025)
Gen researchers describe GhostPairing, a WhatsApp account takeover technique where attackers trick victims into pairing an attacker controlled device without ever stealing their password. Read more.

16TB of MongoDB Database Exposes 4.3 Billion Lead Gen Records

Source: Hackread
(Published: 15 December 2025)
Hackread reports on an unsecured 16TB MongoDB instance left open online that exposed over 4.3 billion professional lead generation records containing extensive personal and business data. Read more.

BreachForums Reemerges, Admin Apologizes for Honeypot Confusion, Claims the Attack the French Govt Announced Impacting Over 16M Individuals

Source: TechNadu
(Published: 15 December 2025)
TechNadu covers BreachForums administrators resurfacing to deny being a law enforcement honeypot while claiming responsibility for a French government data breach affecting more than 16 million people. Read more.

Kimsuky Distributing Malicious Mobile App via QR Code

Source: Enki White Hat
(Published: 16 December 2025)
Enki’s White Hat team analyzes new DOCSWAP APK variants delivered via QR code phishing sites and attributes the campaign to DPRK aligned threat actor Kimsuky. Read more.

Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation

Source: Check Point Research
(Published: 16 December 2025)
Check Point Research exposes Chinese espionage actor Ink Dragon, showing how it turns compromised IIS servers into a ShadowPad based relay mesh spanning government and telecom victims worldwide. Read more.

CastleRAT malware detection with Splunk and MITRE ATT&CK

Source: Splunk
(Published: 5 December 2025)
Splunk Threat Research shows how defenders can detect CastleRAT infections by mapping the malware’s behaviors to MITRE ATT&CK techniques and translating them into Splunk detections. Read more.

Hypervisor defenses against ransomware targeting ESXi

Source: Huntress
(Published: 8 December 2025)
Hypervisors are the backbone of modern virtualized environments, but when ransomware targets ESXi hosts the blast radius can quickly extend across an entire organization. Read more.

White Lynx uses CAPTCHA macros

Source: Unit 42 (Palo Alto Networks)
(Published: 8 December 2025)
This Unit 42 timely threat intel note documents a White Lynx phishing campaign that uses a CAPTCHA themed Word macro to deliver malware and harvest victim credentials. Read more.

React2Shell exploitation escalates into mass attacks

Source: The Hacker News
(Published: 10 December 2025)
The Hacker News reports that a critical ReactPHP vulnerability dubbed React2Shell, tracked as CVE 2025 55182, is now being widely exploited to deploy web shells on vulnerable servers. Read more.

Windows PowerShell 0 day vulnerability allows attackers to execute malicious code

Source: Cybersecurity News
(Published: 10 December 2025)
Security researchers warn that a newly disclosed Windows PowerShell 0 day vulnerability could allow attackers to execute arbitrary code on Windows systems if it is abused by threat actors. Read more.

Fortinet FortiGate under active attack

Source: The Hacker News
(Published: 11 December 2025)
A critical flaw in Fortinet FortiOS and FortiProxy is being actively exploited, allowing attackers to bypass authentication on FortiGate devices and gain full control of vulnerable appliances. Read more.

NANOREMOTE, cousin of FINALDRAFT

Source: Elastic Security Labs
(Published: 11 December 2025)
In October 2025, Elastic Security Labs discovered a newly observed Windows backdoor in telemetry that they call NanoRemote, which closely resembles the FINALDRAFT implant. Read more.

Shanya emerges as top EDR killing tool for ransomware gangs

Source: Techworm
(Published: 11 December 2025)
Techworm profiles Shanya, a new EDR killing utility aggressively marketed to ransomware gangs for disabling security tools before encryption begins. Read more.

Intellexa leaks: Predator spyware operations exposed

Source: Amnesty International Security Lab
(Published: 11 December 2025)
Amnesty International’s Security Lab analyzes a large leak of Intellexa documents that exposes how the Predator spyware platform has been sold and deployed around the world. Read more.

Cracking ValleyRAT: from builder secrets to kernel rootkits

Source: Check Point Research
(Published: 12 December 2025)
Throughout 2025, Check Point Research tracked the evolution of ValleyRAT, following the malware from leaked builder tools to sophisticated kernel level rootkits used in the wild. Read more.

Technical analysis of the BlackForce phishing kit

Source: Zscaler
(Published: 12 December 2025)
Zscaler ThreatLabz provides a technical deep dive into the BlackForce phishing as a service kit, which automates Microsoft 365 credential theft using reverse proxy techniques and extensive anti analysis features. Read more.

China-Nexus Cyber Threat Groups Rapidly Exploit React2Shell Vulnerability (CVE-2025-55182)

Source: AWS Security Blog
(Published: 4 December 2025)
Within hours of the React2Shell CVE-2025-55182 disclosure, Amazon threat intelligence teams observed multiple China-nexus actors attempting to exploit vulnerable Next.js applications at scale. Read more.

Advent of Configuration Extraction – Part 2: Unwrapping QuasarRAT’s Configuration

Source: Sekoia.io
(Published: 8 December 2025)
This second installment of the Advent of Configuration Extraction series shows how analysts can unpack QuasarRAT samples and extract their encrypted configuration from the .NET binary. Read more.

BYOVD Loader Deploys DeadLock Ransomware

Source: Talos Intelligence
(Published: 9 December 2025)
Cisco Talos details a new bring-your-own-vulnerable-driver (BYOVD) loader used to disable security products and deploy DeadLock ransomware in targeted attacks. Read more.

Cydome Identifies Broadside, a New Mirai Botnet Variant Targeting Maritime IoT

Source: Cydome
(Published: 3 December 2025)
Cydome researchers uncover Broadside, a Mirai-based botnet variant that abuses weakly secured maritime IoT devices to build a DDoS-capable fleet. Read more.

Malicious VSCode Extension Launches Multi-Stage Attack Chain with Anivia Loader and OctoRAT

Source: Hunt.io
(Published: 3 December 2025)
Hunt.io describes a malicious Visual Studio Code extension that delivers a multi-stage attack chain, ultimately deploying the Anivia loader and OctoRAT for persistent remote control. Read more.

SMS Phishers Pivot to Points, Taxes, Fake Retailers

Source: Krebs on Security
(Published: 4 December 2025)
Brian Krebs reports that China-based SMS phishing crews now sell phishing kits for mass-creating fake e-commerce sites that funnel victims’ card data into mobile wallets, alongside lures about tax refunds and rewards points. Read more.

OSINT Kitten: The Headquarters for Hacktivist Operations Against Israel

Source: Medium
(Published: 5 December 2025)
This investigation profiles OSINT Kitten as a coordination hub for hacktivist campaigns targeting Israel, outlining how propaganda, leaks, and operational chatter intersect on the platform. Read more.

Inside Shanya: A Packer-as-a-Service Fueling Modern Attacks

Source: Sophos News
(Published: 6 December 2025)
Sophos examines Shanya, a packer-as-a-service offering that ransomware groups increasingly use to obfuscate payloads, evade analysis, and extend the lifespan of their campaigns. Read more.

Nothing to Steal? Let’s Wipe. We Are Analyzing the Shai Hulud 2.0 npm Worm

Source: Securelist (Kaspersky)
(Published: 9 December 2025)
Kaspersky researchers dissect Shai Hulud 2.0, a destructive npm worm that abuses developer tooling and supply chain trust to spread and wipe systems instead of stealing data. Read more.

Cato CTRL: Weaponizing Claude Skills with MedusaLocker

Source: Cato Networks
(Published: 10 December 2025)
Cato Networks describes how red-teamers simulated an attack in which MedusaLocker operators combine LLM-powered automation with C2 infrastructure to accelerate discovery, lateral movement, and impact. Read more.

New eBPF Filters for Symbiote and BPFdoor Malware

Source: Fortinet
(Published: 9 December 2025)
Fortinet introduces new eBPF-based detection filters that help defenders identify and hunt for stealthy Linux threats such as Symbiote and BPFdoor in production environments. Read more.

UDPGangster Campaigns Target Multiple Countries

Source: Fortinet
(Published: 4 December 2025)
FortiGuard Labs reveals UDPGangster, a UDP-based backdoor linked to MuddyWater that is being used in campaigns against organizations across several Middle Eastern and neighboring states. Read more.

Investigating Indonesia’s Gambling Ecosystem: Indicators of National-Level Cyber Operations

Source: Malanta
(Published: 3 December 2025)
Malanta’s research team maps Indonesia’s online gambling infrastructure and highlights technical and behavioral indicators that could signal involvement by state-linked operators. Read more.

Deceptive Layoff-Themed HR Email Distributes Remcos RAT Malware

Source: Seqrite
(Published: 9 December 2025)
Seqrite analyzes phishing emails masquerading as layoff notifications that deliver a weaponized attachment used to install the Remcos remote access trojan. Read more.

Operation DupeHike: UNG0902 Targets Russian Employees with DupeRunner and AdaptixC2

Source: Seqrite
(Published: 3 December 2025)
This report documents Operation DupeHike, where the UNG0902 group uses phishing lures and custom malware families DupeRunner and AdaptixC2 to target employees in Russia. Read more.

Africa in the Crosshairs: Covert Influence, Cyber Operations, and the New Geopolitics

Source: Silobreaker
(Published: 9 December 2025)
Silobreaker explores how non-Western powers use information operations, cyber activity, and local partnerships to shape narratives and political outcomes across Africa. Read more.

AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows

Source: Trend Micro
(Published: 8 December 2025)
Trend Micro introduces GhostPenguin, a previously undocumented Linux backdoor discovered through AI-assisted threat hunting and low-detection telemetry analysis. Read more.

Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks

Source: Volexity
(Published: 4 December 2025)
Volexity details a campaign in which a Russian threat actor sends spoofed invitations to high-profile European security conferences to deliver malware to selected targets. Read more.

Attackers Actively Exploiting Critical Vulnerability in King Addons for Elementor Plugin

Source: Wordfence
(Published: 2 December 2025)
Wordfence warns that a critical privilege escalation flaw in the King Addons for Elementor plugin is under active exploitation, enabling unauthenticated attackers to gain admin access. Read more.

Technical Analysis of Matanbuchus 3.0

Source: Zscaler
(Published: 2 December 2025)
Zscaler ThreatLabz provides a deep technical dive into Matanbuchus 3.0, a C++ downloader malware-as-a-service that now plays a growing role in ransomware operations. Read more.

Want more articles? Check out the previous edition of Security Signals here. 

?

Take advantage of our free data evaluation.

REQUEST NOW
?

Security Signals (11/18/25-12/02/25)

Cybersecurity News

Welcome to your biweekly digest of curated cybersecurity intelligence.

Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activity, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.

For more articles, check out our #onpatrol4malware blog.

Turn Insights Into Action with Free Threat Intel

Security Signals gives you the insights and our Risk Indicators OSINT feeds help you apply them.

SUBSCRIBE FOR FREE

This Edition’s Articles

November to December 2025 Cyber Threat Reports brings together a fast-moving mix of supply chain compromises, ransomware evolutions, APT operations, and cloud-targeted attacks. This roundup highlights how actors are abusing npm ecosystems, targeting SSO and identity platforms, and weaponizing IoT and banking malware, giving your team timely context to tune detections and prioritize defenses.

 

Autumn Dragon: China-nexus APT Group Targets South East Asia

Source: CyberArmor
(Published: 18 November 2025)
Since early 2025, China’s involvement in the Indo-Pacific has been more prolific, from escalating maritime tensions, to being peacebroker in Myanmar’s military junta and more recently, espionage activities on joint exercises the Philippines naval forces have been conducting together with the US, Australia, Canada and New Zealand. Read more.

Cloudflare outage on November 18, 2025

Source: Cloudflare
(Published: 18 November 2025)
On November 18, 2025, Cloudflare experienced an outage that affected a portion of traffic on its network. Read more.

Fortinet warns of new FortiWeb zero-day exploited in attacks

Source: BleepingComputer
(Published: 18 November 2025)
Today, Fortinet released security updates to patch a new FortiWeb zero-day vulnerability that threat actors are actively exploiting in attacks. Read more.

Breaking Down S3 Ransomware: Variants, Attack Paths and Trend Vision One™ Defenses

Source: Trend Research
(Published: 18 November 2025)
Ransomware is shifting from traditional systems to cloud environments, redefining its impact on cloud-native data. Read more.

Masked in Memory: A Hidden .PYC Fragment Utilises cvtres.exe to Communicate With C&C

Source: K7 Labs
(Published: 19 November 2025)
During a routine analysis at K7 Labs, we encountered a Python-based malware sample that uses multi-stage obfuscation. Read more.

The Cloudflare Outage May Be a Security Roadmap

Source: Krebs on Security
(Published: 19 November 2025)
An intermittent outage at Cloudflare on Tuesday briefly knocked many of the Internet’s top destinations offline. Read more.

Cooking up trouble: How TamperedChef uses signed apps to deliver stealthy payloads

Source: Acronis Threat Research Unit
(Published: 19 November 2025)
Acronis Threat Research Unit (TRU) observed a global malvertising / SEO campaign, tracked as “TamperedChef.” Read more.

Meet ShinySp1d3r: New Ransomware-as-a-Service created by ShinyHunters

Source: BleepingComputer
(Published: 19 November 2025)
An in-development build of the upcoming ShinySp1d3r ransomware-as-a-service platform has surfaced, offering a preview of the upcoming extortion operation. Read more.

PlushDaemon compromises network devices for adversary-in-the-middle attacks

Source: ESET WeLiveSecurity
(Published: 19 November 2025)
ESET researchers provide insights into how PlushDaemon performs adversary-in-the-middle attacks using a previously undocumented network implant called EdgeStepper. Read more.

Beyond the Watering Hole: APT24’s Pivot to Multi-Vector Attacks

Source: Google Cloud
(Published: 20 November 2025)
Google Threat Intelligence Group (GTIG) is tracking a long-running and adaptive cyber espionage campaign by APT24, a People’s Republic of China (PRC)-nexus threat actor. Read more.

ToddyCat: your hidden email assistant. Part 1

Source: Securelist (Kaspersky)
(Published: 21 November 2025)
Email remains the main means of business correspondence at organizations. Read more.

China’s APT31 linked to hacks on Russian tech firms

Source: The Record
(Published: 21 November 2025)
The China-linked hacking group known as APT31 infiltrated Russia’s technology sector for years and quietly exfiltrated data from companies involved in government contracting and systems integration, according to a new report. Read more.

Brazilian Campaign: Spreading the Malware via WhatsApp

Source: K7 Labs
(Published: 21 November 2025)
K7 Labs found out from a tweet about a massive phishing campaign going on against Brazil, spreading the malware via WhatsApp Web from the victim’s machine to their contacts by using the open source WhatsApp automation script from GitHub and also loading a banking trojan into memory. Read more.

The Korean Leaks – Analyzing the Hybrid Geopolitical Campaign Targeting South Korean Financial Services With Qilin RaaS

Source: Bitdefender
(Published: 24 November 2025)
TL;DR The “Korean Leaks” campaign showcases a sophisticated supply chain attack against South Korea’s financial sector. Read more.

Weekly DDoSIA Threat Intelligence: Sweden

Source: SOCRadar
(Published: 24 November 2025)
NoName057(16), a pro-Russian hacktivist group, conducted coordinated DDoS attacks on Swedish organizations between November 10 and 16, 2025, as part of its ongoing campaign against countries supporting Ukraine. Read more.

South-east Asia increasingly targeted as cybercrime groups launch global attacks: report

Source: The Business Times
(Published: 25 November 2025)
South-east Asia is increasingly being targeted by cybercriminals leveraging the region’s rapid digitalization and expanding attack surface to launch global campaigns. Read more.

Defending Against Sha1-Hulud: The Second Coming

Source: SentinelOne
(Published: 25 November 2025)
A new wave of compromised NPM packages is leading to wide-scale supply chain attacks. Read more.

Inside the GitHub Infrastructure Powering North Korea’s Contagious Interview npm Attacks

Source: Socket
(Published: 26 November 2025)
The Socket Threat Research Team continues to track North Korea’s Contagious Interview operation as it systematically infiltrates the npm ecosystem. Read more.

Is Zendesk Scattered Lapsus$ Hunters’ Latest Campaign Target?

Source: ReliaQuest
(Published: 26 November 2025)
ReliaQuest has uncovered indications of a potential new campaign from the notorious threat collective “Scattered Lapsus$ Hunters,” this time targeting users of the customer support software Zendesk. Read more.

Xillen Stealer Updates to Version 5 to Evade AI Detection

Source: Darktrace
(Published: 26 November 2025)
Darktrace has observed a new version of the Xillen Stealer malware, designed to exfiltrate sensitive data including credentials, financial information, and cryptowallet keys. Read more.

Deepseek May Intentionally Produce Malicious Code Due to Chinese Political Bias, Research Shows

Source: Foundation for Defense of Democracies (FDD)
(Published: 26 November 2025)
A Chinese AI model may be intentionally generating harmful code due to political biases embedded in its training data, according to new research. Read more.

Albiriox RAT: Mobile Malware Targeting Global Finance and Crypto Wallets

Source: Cleafy Labs
(Published: 26 November 2025)
Cleafy Labs identified a new Android Remote Access Trojan (RAT) dubbed Albiriox, which targets global banking and crypto wallet applications. Read more.

Inside Valkyrie Stealer: Capabilities, Evasion Techniques, and Operator Profile

Source: DExpose
(Published: 26 November 2025)
The DExpose research team analyzed a new info-stealing malware known as Valkyrie, uncovering its core capabilities and operator tradecraft. Read more.

Shai-Hulud 2.0 Exposes Over 33,000 Unique Secrets [Updated Nov, 27]

Source: GitGuardian
(Published: 27 November 2025)
In this report, we detail how the Shai-Hulud 2.0 supply chain attack exposed tens of thousands of unique secrets across hundreds of affected projects. Read more.

TangleCrypt: a sophisticated but buggy malware packer

Source: WithSecure Labs
(Published: 27 November 2025)
Just like most malware packers, TangleCrypt’s main objective is to hide the actual payload and make it look like a benign file. Read more.

Inside Morte Loader: How Loader as a Service Builds Modern Botnets

Source: SOCRadar
(Published: 27 November 2025)
Morte is a Loader as a Service (LaaS) that turns vulnerable SOHO routers, IoT devices and web applications into a flexible botnet platform. Read more.

APT36’s Python-based ELF Malware Targeting Indian Government Entities

Source: Cyfirma
(Published: 27 November 2025)
CYFIRMA researchers observed APT36 deploying a new Python-based ELF malware variant against Indian government agencies. Read more.

Palo Alto Scanning Surges to a 90-Day High

Source: GreyNoise
(Published: 27 November 2025)
GreyNoise observed a dramatic spike in scanning activity targeting Palo Alto Networks devices, reaching the highest level in 90 days. Read more.

FlexibleFerret Malware Continues to Adapt

Source: Jamf
(Published: 27 November 2025)
Jamf Threat Labs is tracking FlexibleFerret, a multi-stage malware family targeting macOS users with evolving techniques. Read more.

Morphisec Thwarts Russian-linked Stealc v2 Campaign Targeting Blender Users via Malicious .blend Files

Source: Morphisec
(Published: 27 November 2025)
Morphisec detected and blocked an attack campaign leveraging weaponized Blender .blend files to distribute Stealc v2, a Russian-linked infostealer. Read more.

The Pain in the Mist: Navigating Operation DreamJob’s Arsenal

Source: Orange Cyberdefense
(Published: 27 November 2025)
Orange Cyberdefense researchers shed light on new tooling, infrastructure and phishing techniques attributed to the North Korea-nexus Operation DreamJob. Read more.

Scattered Lapsus$ Hunters Intensifican la Venta de Accesos FortiOS en DarkForums, con Foco en Latinoamérica

Source: Devel Group
(Published: 28 November 2025)
En DarkForums, un vendedor identificado como “miyako”, señalado por la comunidad como parte del ecosistema cercano a Scattered Lapsus$ Hunters, ha publicado de manera constante accesos comprometidos a organizaciones vulneradas mediante fallas en FortiOS. Read more.

Tomiris wreaks Havoc: New tools and techniques of the APT group

Source: Securelist (Kaspersky)
(Published: 28 November 2025)
While tracking the activities of the Tomiris threat actor, we identified new malicious operations that began in early 2025. Read more.

Thousands of sensitive secrets published on JSONFormatter and CodeBeautify

Source: Security Affairs
(Published: 28 November 2025)
Users of JSONFormatter and CodeBeautify leaked thousands of sensitive secrets, including credentials and private keys, WatchTowr warns. Read more.

Critical Flaw in Oracle Identity Manager Under Exploitation

Source: Dark Reading
(Published: 28 November 2025)
Attackers are exploiting a critical privilege escalation vulnerability in Oracle Identity Manager, prompting urgent patching recommendations. Read more.

Inside ShadyPanda: A 7-Year Malware Campaign That Infected 4 Million Browsers

Source: Koi Labs
(Published: 28 November 2025)
Koi Labs uncovered a massive multi-year surveillance and credential harvesting operation known as ShadyPanda, affecting more than 4 million browser installations worldwide. Read more.

THOR vs. Silver Fox: Uncovering and Defeating a Sophisticated ValleyRAT Campaign

Source: Nextron Systems
(Published: 28 November 2025)
Nextron Systems researchers analyzed a new ValleyRAT campaign named “Silver Fox,” uncovering and mitigating the threat using THOR YARA and behavioral analytics. Read more.

Candiru/DevilsTongue Spyware: Tracking the Global Operations

Source: Recorded Future
(Published: 29 November 2025)
Recorded Future’s Insikt Group analyzed ongoing DevilsTongue spyware activity attributed to the Israeli vendor Candiru. Read more.

DNS Uncovers Infrastructure Used in SSO Attacks

Source: Infoblox
(Published: 1 December 2025)
We recently received a tip from a customer that their institution was under recurring attacks that targeted their student single sign-on (SSO) portal. Read more.

EDR-Freeze: The User-Mode Attack That Puts Security Into a Coma

Source: Picus Security
(Published: 1 December 2025)
EDR-Freeze is a user-mode attack technique that abuses the dependency of endpoint detection and response solutions on user-mode telemetry to blind security monitoring. Read more.

Google Addresses 107 Android Vulnerabilities, Including Two Zero-Days

Source: CyberScoop
(Published: 1 December 2025)
Google disclosed two actively exploited zero-day vulnerabilities Monday, which it addressed among a total of 107 defects in the company’s monthly security update for Android devices. Read more.

Shai-Hulud 2.0 Aftermath: Ongoing Supply Chain Attack

Source: Wiz
(Published: 1 December 2025)
Wiz researchers are tracking an ongoing supply chain attack involving Shai-Hulud 2.0 that continues to impact organizations through compromised npm packages and cloud workloads. Read more.

Microsoft Chat With Anyone: Understanding the Phishing Risk

Source: Ontinue
(Published: 1 December 2025)
Attackers are abusing Microsoft’s Chat With Anyone features to socially engineer victims into credential theft and phishing attacks. Read more.

Water Saci: Stealthy Banking Malware Leveraging AI and Obfuscation

Source: Trend Micro
(Published: 2 December 2025)
Through AI-driven code analysis and large-scale telemetry, Trend Micro researchers uncovered Water Saci, a stealthy banking malware family that targets financial institutions with sophisticated evasion techniques. Read more.

Insider Threat Detection: Key Warning Signs Your Organization Cannot Ignore

Source: Nisos
(Published: 2 December 2025)
Insider activity rarely appears malicious in the beginning. Read more.

ShadowV2 casts a shadow over IoT devices

Source: Fortinet
(Published: 2 December 2025)
Fortinet researchers are tracking ShadowV2, an IoT-focused malware that expands on the capabilities of its predecessor with stealthier persistence mechanisms. Read more.

Want more articles? Check out the previous edition of Security Signals here. 

?

Take advantage of our free data evaluation.

REQUEST NOW
?