Formbook malware has resurfaced using localized business-order themed lures targeting European users and manufacturing organizations. The attack chain involves JavaScript, hidden PowerShell scripts, an AES-encrypted .NET payload, and process hollowing of aspnet_compiler.exe to execute Formbook. Persistence is maintained via SystemUpdate_* shortcuts and related artifacts. Network detection includes Formbook command-and-control check-ins flagged by Suricata. Indicators of compromise (IOCs) include specific domain names and file hashes. No direct patch or remediation is indicated in the source information.
Cylist is a newly developed free platform designed to unify multiple threat intelligence sources and streamline SOC analysts' workflows by enabling investigation, enrichment, documentation, and discussion of indicators of compromise (IOCs) in one place. It integrates data from VirusTotal, ThreatFox, AbuseIPDB, and IP Info, providing a consolidated threat score and AI-assisted case generation. Currently in beta, Cylist aims to reduce the need for multiple tools and subscriptions in security operations. There is no indication that Cylist itself presents a security vulnerability or threat.
Mir0Auth is a phishing toolkit targeting Microsoft 365 authentication tokens. It uses a multi-step phishing flow starting with a business email lure and a PDF attachment leading to a DocuSign-themed page. Victims are redirected to a legitimate Microsoft Device Code authentication page, allowing attackers to obtain M365 tokens. The toolkit employs obfuscated network communication using XOR encoding for command-and-control URLs and payloads. Primary activity has been observed against US organizations.
This content is feedback and promotional information about a personal threat intelligence platform called JakeSec. The platform offers independent, community-driven threat intelligence collection and advanced features such as honeypot commissioning behind a login. The site aggregates security news and analysis but does not itself describe a specific vulnerability or exploit. There is mention of recent security news including critical Citrix NetScaler zero-day exploits, but these are external reports, not part of the platform itself.
This content is a curated list of publicly accessible, keyless (zero-authentication) cyber threat intelligence (CTI) and infostealer API endpoints useful for rapid triage and investigation. It includes various free APIs for credential exposure, infrastructure reconnaissance, vulnerability scoring, and botnet command-and-control feeds. Additionally, an open-source Python script is provided to query these endpoints concurrently, facilitating efficient threat analysis workflows.
CyberCodex v3.2 is an open-source Python CLI tool designed to aggregate cyber threat intelligence (CTI) from 22 public sources without requiring API keys. It provides live enrichment of indicators of compromise (IOCs) and hashes, vulnerability prioritization using MITRE CVE data combined with exploitation probability scores, and telemetry on infostealers and breaches. The tool also includes offline encyclopedic data on advanced persistent threat (APT) operations and actor profiles, supporting multiple languages and exporting data in Markdown or JSON formats.
This content provides guidance on how Open-Source Intelligence (OSINT) can enhance incident response capabilities. Using the September 2026 Revolut incident as a case study, it illustrates how OSINT can support detection, analysis, containment, eradication, recovery, and lessons learned phases of incident response. The Revolut incident involved criminals impersonating officials via a compromised government email system to request customer information, resulting in data exposure but no direct intrusion into Revolut's core systems. The guidance emphasizes that OSINT is a disciplined intelligence capability that can reduce financial, reputational, and operational harm when integrated into incident response workflows.
This content describes an open-source self-hosted threat intelligence aggregator tool designed to collect, deduplicate, and correlate threat intelligence feeds from over 60 sources. It includes features such as IOC extraction, ATT&CK mapping, integration with asset inventories, and detection engineering capabilities. The tool can run locally or integrate with Azure environments and supports optional AI triage. It is not a vulnerability or exploit but rather a security tool release.
An open directory exposed on a server in Thailand revealed an active intrusion operation targeting two major broadband providers, primarily 3BB (Triple T Broadband). The attacker exploited CVE-2024-21762 to gain remote code execution on a FortiGate 60F SSL-VPN device. The exposed files included exploitation scripts, privilege escalation tools, brute-force utilities, and a MeshCentral agent configured as a persistent backdoor. The attacker aimed to extract subscriber authentication data from RADIUS databases and had valid OpenVPN certificates and active session cookies, indicating deep network access. The attacker also prepared cleanup scripts to remove traces while maintaining persistence. Hunt.io notified affected parties and CERT prior to public disclosure.
A threat actor exploited CVE-2026-15409, a critical unauthenticated server-side request forgery vulnerability in SonicWall SMA1000 appliances, to gain command execution and steal credentials. The attacker used a modified public proof-of-concept exploit to access internal Erlang services on the appliance, enabling remote code execution. This allowed extraction of LDAP configurations, Active Directory credentials, and deployment of tools to dump secrets from internal Windows systems. The campaign targeted at least 250 SonicWall SMA1000 devices across multiple countries and sectors, with confirmed credential theft in France, India, Italy, and the US. The attack leveraged compromised appliances as pivots into internal networks, exposing sensitive Active Directory data and enabling DCSync attacks against domain controllers. The targeting was opportunistic and technology-driven rather than sector-specific. The campaign was uncovered through an open directory left exposed by the attacker, providing a comprehensive view of the operation.
Tripwire is an open source sandboxed security scanner designed to analyze MCP servers and AI skills before they execute code locally. It runs untrusted code in an isolated sandbox environment and scans it with multiple security tools to detect potential risks, aiming to prevent unvetted code from running directly on user machines. The tool is under active development and was created during a cybersecurity hackathon. There is no indication of any inherent vulnerability or exploit in Tripwire itself.
An extortion group is mass-BCC'ing journalists and other contacts to pressure victims by leveraging the recipients as indirect channels of coercion. The tactic involves sending breach claim emails to multiple journalists simultaneously, urging them to publish stories or contact the alleged victim before any proof is provided. This approach weaponizes journalists as pressure points in extortion campaigns without verified evidence of a breach.
This is a free mobile application called VulniPulse that provides alerts for CVEs and end-of-life information across 30+ vendors and 160+ platforms. It offers phone and email notifications for tracked vulnerabilities and includes features such as filtering by severity and vendor, as well as lifecycle product checks. The app aggregates official vendor security advisories and lifecycle data to help IT and security professionals monitor vulnerabilities. There is no indication that the app itself introduces a security vulnerability or threat.
The "Global" ransomware group is a ransomware-as-a-service (RaaS) operation first publicly identified in June 2025. It appears to be a rebrand or continuation of the BlackLock ransomware group, sharing infrastructure and malware characteristics. The group operates a mature affiliate program with advanced features such as AI-assisted victim communications and offers up to 85% revenue share to affiliates. Their malware targets multiple platforms including Windows, Linux, ESXi, and NAS devices, using ChaCha20-Poly1305 encryption. They also deploy a custom stealer called WorldThief to facilitate double extortion. The group relies on purchased access through compromised credentials and exploited edge devices from vendors like Fortinet, Palo Alto, and Cisco. Their operations have been observed in over 18 countries. An operational security lapse exposed a backend IP linked to a Russian VPS provider, also associated with BlackLock. This case illustrates how ransomware groups recycle infrastructure and tooling across rebrands.
This report references multiple SharePoint vulnerabilities identified by CVE-2026-58644, CVE-2026-45659, and CVE-2026-50522. A proof-of-concept (PoC) exploit script is publicly available, demonstrating a potential security issue involving SharePoint's security token handling. The details suggest a security context token manipulation leading to remote code execution attempts. No patch or official remediation information is provided in the source data.
Thailand's Ministry of Finance was targeted by an attacker using Hermes, an open-source AI agent running unattended. The agent executed reconnaissance activities such as running LinPEAS to identify privilege escalation vectors and enumerating web directories containing personnel records. Additionally, a previously unreported implant named "Hades" was found on the compromised server, consisting of 62 Go binaries with features including kill dates, working-hours sleep, and AES-256-GCM encrypted communications. This activity was observed on a Hong Kong server hosting open directories from July 9 to 13. The incident was uncovered through joint research and includes indicators of compromise and MITRE ATT&CK mappings in the referenced blog post.
SIEM Query Builder -- Retro Search Specialist is an offline, browser-based tool designed to help threat hunters and threat intelligence analysts generate native SIEM queries from Indicators of Compromise (IOCs) across multiple SIEM platforms. It supports various IOC types and multiple SIEM syntaxes without sending data over the network. The tool is open source and intended to streamline IOC searching by eliminating the need to rewrite queries for different SIEMs.
A threat campaign was observed staging exploits on a Singapore VPS targeting curated government, university, healthcare, and financial sector entities across 11 countries. The attack server hosted multiple exploits ranging from a 2017 WebLogic vulnerability to recent ones including NGINX Rift (CVE-2026-42945) and Ghost CMS (CVE-2026-26980). The campaign used organized target lists by country and sector and included an AdaptixC2 server for command and control. The campaign is notable for its targeted approach and use of recent vulnerabilities.
Intrusion Inc. announced the acquisition of VigilAigent, a cybersecurity managed security service provider, to create an AI-native cybersecurity platform. The combined platform integrates VigilAigent's Agentic AI engine, The Oracle, with Intrusion's TraceCop intelligence database, enhancing threat detection and protection capabilities. This acquisition is a business growth and technology integration event rather than a security vulnerability or threat. No specific security vulnerability, exploit, or attack vector is described in the announcement.
This content discusses a perceived bottleneck in cyber threat intelligence (CTI) shifting from data collection to the structuring of that data. It highlights an open research project, TI Mindmap Hub, which aims to transform unstructured OSINT threat reports into structured intelligence formats such as STIX 2.1 bundles, ATT&CK mappings, and knowledge graphs to improve machine reasoning and analysis. The project also supports AI agent queries via an MCP server. This is a discussion and research initiative rather than a direct security vulnerability or threat.
