Threat Intelligence

Flat white line-art of a Mac display showing a fake full-screen update above a crypto wallet on a dark background — DPRK macOS malvertising campaign.

North Korean Threat Actors

DPRK's "Contagious Interview" Campaign Moves Into macOS Malvertising to Drain Crypto Wallets

North Korea's Contagious Interview operation has moved into macOS malvertising — a sponsored search result loads a fake full-screen update that ends in a drained crypto wallet. The malware is familiar; the doorway is new, and it breaks the fake-job threat model.

Flat white line-art of three key-shaped drivers feeding one control panel, on a deep teal background — SilverFox's three-driver BYOVD chain and ValleyRAT.

Nation-State Cyber Threats

SilverFox Deploys 3-Driver BYOVD Chain and ValleyRAT Against Japanese Manufacturer

Three vulnerable drivers, one payload — SilverFox on the wire this week.

Flat white line-art of an open back door linked by one line to a distant relay node, on a teal background — the NightLedger backdoor.

Nation-State Cyber Threats

Iran-Linked Nimbus Manticore Deploys NightLedger Backdoor Across Middle East, Africa, South Asia

New backdoor, familiar actor — the Iran-linked group tracked as Nimbus Manticore has a fresh toolset, and Kaspersky's write-up of NightLedger lands this week.

Flat white line-art of a browser window building a jigsaw file from separate pieces, on a teal background — the SourTrade browser-assembly malvertising research.

Threat Intelligence

Confiant Documents "SourTrade" Malvertising Campaign Assembling Executables in the Victim's Browser

A novel malvertising delivery technique lands from Confiant — defender review for ad-tech and retail-trader-adjacent environments this weekend.

Flat white line-art of one control panel routing several tiles into a central hub, on a deep teal background — a centralized RaaS operator portal.

Ransomware

PRODAFT Documents "DevMan" Ransomware-as-a-Service Portal Operated by "Funky Mantis"

Another named RaaS operator profile from PRODAFT — defender-team pattern-tracking this weekend.

Editorial illustration of a gavel over a policy scroll beside a transit farecard — UK police chiefs cite the TfL case to push for Cybercrime Risk Orders.

Policy & Government

UK Police Chiefs Cite TfL Prosecution to Push for New Cybercrime Risk Orders

UK police chiefs are citing the Transport for London prosecution and the Scattered Spider sentencing to press for Cybercrime Risk Orders — a proposed civil tool to restrain suspected cyber offenders. Post-TfL policy analysis this week.

Editorial illustration of a defaced presidential webpage showing a wallet address, marking Kenya's probe into the hack of President Ruto's website with a Bitcoin ransom.

Policy & Government

Kenya Probes Hack of President William Ruto's Website Following Bitcoin Ransom Demand

A Kenyan presidential-website hack draws a Bitcoin-ransom demand — government-website defender awareness this week.

Ransomware

Sysdig Reports JadePuffer Deploys ENCFORGE Ransomware Purpose-Built to Wipe AI Model Files

The first purpose-built AI-model ransomware lands from JadePuffer — a defender review for organizations hosting AI infrastructure this week.

Editorial illustration of an IP security camera turned toward supply trucks, marking the AIVD/MIVD warning on Russian camera-hijacking across NATO and Ukraine.

Nation-State Cyber Threats

AIVD and MIVD Warn Russian Intelligence Hijacks IP Cameras Across NATO States and Ukraine to Track Military Logistics

A Dutch intelligence advisory raises the stakes on Russian camera-hijacking activity — critical-infrastructure defender teams review IP-camera posture this week.

Editorial illustration of a calendar page dated far in the future holding a hidden note, marking HollowGraph malware abusing Microsoft 365 calendars for C2.

Threat Intelligence

Group-IB Documents “HollowGraph” Malware Abusing Microsoft 365 Calendars for C2

A novel Microsoft 365 calendar-abuse malware framework — defender detection-engineering review this week.

Editorial illustration of a gem-shaped package hiding a dormant timer over a developer's keyboard, marking the SleeperGem RubyGems supply-chain attack.

Supply Chain Attack

Researchers Document "SleeperGem" RubyGems Supply-Chain Attack Targeting Developer Machines

Ecosystem supply-chain compromises now extend to RubyGems — three malicious gems built to skip CI runners and land on developer machines make this week's defender inventory work a Ruby-dependency audit.

Line-art of two magnifiers over a breached gateway appliance revealing a fingerprint, marking Volexity's UTA0533 attribution of the SonicWall SMA zero-days.

Threat Intelligence

Volexity Attributes SonicWall SMA Zero-Day Exploitation to Previously Undocumented UTA0533 Actor Since June 22

A second SonicWall SMA attribution lands — Volexity names UTA0533 alongside the Dark Reading INC Ransomware framing this weekend.

See all