Threat Intelligence

Ransomware

Sysdig Reports JadePuffer Deploys ENCFORGE Ransomware Purpose-Built to Wipe AI Model Files

The first purpose-built AI-model ransomware lands from JadePuffer — a defender review for organizations hosting AI infrastructure this week.

Editorial illustration of an IP security camera turned toward supply trucks, marking the AIVD/MIVD warning on Russian camera-hijacking across NATO and Ukraine.

Nation-State Cyber Threats

AIVD and MIVD Warn Russian Intelligence Hijacks IP Cameras Across NATO States and Ukraine to Track Military Logistics

A Dutch intelligence advisory raises the stakes on Russian camera-hijacking activity — critical-infrastructure defender teams review IP-camera posture this week.

Editorial illustration of a calendar page dated far in the future holding a hidden note, marking HollowGraph malware abusing Microsoft 365 calendars for C2.

Threat Intelligence

Group-IB Documents “HollowGraph” Malware Abusing Microsoft 365 Calendars for C2

A novel Microsoft 365 calendar-abuse malware framework — defender detection-engineering review this week.

Editorial illustration of a gem-shaped package hiding a dormant timer over a developer's keyboard, marking the SleeperGem RubyGems supply-chain attack.

Supply Chain Attack

Researchers Document "SleeperGem" RubyGems Supply-Chain Attack Targeting Developer Machines

Ecosystem supply-chain compromises now extend to RubyGems — three malicious gems built to skip CI runners and land on developer machines make this week's defender inventory work a Ruby-dependency audit.

Line-art of two magnifiers over a breached gateway appliance revealing a fingerprint, marking Volexity's UTA0533 attribution of the SonicWall SMA zero-days.

Threat Intelligence

Volexity Attributes SonicWall SMA Zero-Day Exploitation to Previously Undocumented UTA0533 Actor Since June 22

A second SonicWall SMA attribution lands — Volexity names UTA0533 alongside the Dark Reading INC Ransomware framing this weekend.

Editorial illustration of a fake CAPTCHA checkbox tagged with a state emblem over a map of Ukraine, marking CERT-UA naming Sandworm subgroup UAC-0145.

Nation-State Cyber Threats

CERT-UA Names Sandworm Subgroup UAC-0145 Behind ClickFix CAPTCHA Campaign Against Ukrainian Devices

CERT-UA names UAC-0145 as the Sandworm sub-cluster behind the ClickFix CAPTCHA activity against Ukrainian devices - a GRU-affiliated crew, and defender awareness for Ukraine-adjacent teams this weekend.

Editorial illustration of a game controller tipping coins from a crypto wallet beside handcuffs, marking the FBI arrest over a Steam-game malware campaign.

Policy & Government

FBI Arrests 21-Year-Old Zyaire Wilkins Over Steam-Game Malware Campaign Draining Crypto Wallets

A cryptocurrency-user targeting arrest via a novel Steam-games vector — law-enforcement coverage this weekend.

Editorial illustration of a mesh net trawling exposed AI service panels for key tags, marking the NadMesh Go botnet hunting cloud keys and Kubernetes tokens.

Threat Intelligence

Researchers Document “NadMesh” Go Botnet Hunting Exposed AI Services for Cloud Keys and Kubernetes Tokens

A botnet targeting self-hosted AI tooling for cloud keys — defender review for organizations exposing AI services this weekend.

Editorial illustration of a signing seal lifted from a certificate vault, marking Expel's attribution of the DigiCert breach to the CylindricalCanine subgroup.

Supply Chain Attack

Expel Attributes April 2026 DigiCert Breach to “CylindricalCanine” GoldenEyeDog Subgroup

A code-signing-integrity attribution against a Chinese cybercrime subgroup — and a prompt for supply-chain defenders to review how much trust their pipelines place in a valid signature.

Editorial illustration of a banner planted on a breached gateway appliance, marking attribution of SonicWall SMA zero-day exploitation to INC Ransomware.

Ransomware

Dark Reading Attributes SonicWall SMA Zero-Day Exploitation to INC Ransomware Operation

INC Ransomware named as the SonicWall SMA zero-day exploiter — defender teams stay in accelerated verification posture this weekend.

Editorial illustration of seven npm package boxes wired to a blockchain-link control node, marking the ViteVenom campaign against Vite frontend tooling.

Supply Chain Attack

Checkmarx Documents “ViteVenom” Campaign Compromising Seven Vite npm Packages With Blockchain C2

Another JavaScript-ecosystem compromise with a novel blockchain-C2 angle — seven scoped npm packages impersonating the Vite tooling namespace, and defender inventory work this weekend.

Editorial illustration of a magnifying glass over a cracked shared-document portal, marking Rapid7's deep-dive on the exploited SharePoint flaw CVE-2026-58644.

Vulnerabilities

Rapid7 Publishes Deep-Dive on Exploited SharePoint CVE-2026-58644

Rapid7 goes deep on the SharePoint CVSS-9.8 RCE — defender-team detection-engineering review this weekend.

See all