Threat Intelligence

Editorial science-poster illustration of the six major threat actor categories, shown as silhouette portraits each marked with a small identifying icon.

Cybersecurity 101

Types of Threat Actors: From Cybercriminals to Nation-States

The major categories of cyber threat actors explained — nation-states, cybercriminals, hacktivists, insiders, and script kiddies — with motivations and defense implications.

Editorial illustration of a coiled serpent slipping into a government building's document tray, marking Kaspersky's GoSerpent espionage malware in Southeast Asia.

Nation-State Cyber Threats

Kaspersky Documents "GoSerpent" Malware Targeting Southeast Asian Governments and Diplomats

Another Southeast-Asia-focused espionage cluster documented by Kaspersky — a defender research review this week for government and diplomatic entities in the region.

Editorial illustration of a fake fix-it prompt piping browser tokens and documents into a stealer, marking Microsoft's ACR Stealer ClickFix analysis.

Threat Intelligence

Microsoft Defender Experts Documents ACR Stealer Delivered via ClickFix Lures Targeting Browsers and Microsoft 365

Another named stealer joins the ClickFix pattern — a defender posture review across Microsoft 365 environments after Microsoft's published analysis this week.

Editorial illustration of a state-emblem shield adopting a fake fix-it prompt, marking Ars Technica's report of Russia's Sandworm cluster using ClickFix.

Nation-State Cyber Threats

Ars Technica Reports Russia's Sandworm Cluster Now Using ClickFix Technique

ClickFix migrates from financially motivated crime to nation-state activity, according to Ars Technica's report on Russia's Sandworm cluster - a defender-awareness read for this week.

Ransomware

Symantec Documents "Spirals" Ransomware Reportedly Locking Systems in Under 24 Hours

A fast-moving Rust-based ransomware family — defender detection-engineering review this week.

Editorial illustration of a case folder fanning into many attack markers, marking US authorities attributing 120-plus attacks to Scattered Spider's Thalha Jubair.

Policy & Government

CyberScoop Reports US Authorities Attribute 120+ Attacks to Scattered Spider Defendant Thalha Jubair

More detail on Scattered Spider's TfL leaders: US authorities have Jubair on the record for 120 attacks, and defender pattern-tracking continues this week.

Ransomware

ReliaQuest: “The Gentlemen” Overtakes Qilin as Most Prolific Ransomware Operation

The ransomware leaderboard shifts — The Gentlemen tops the chart in ReliaQuest’s latest tracking, and defender-team pattern-watching continues this week from the analyst’s chair, not the attacker’s.

Editorial illustration of an SVG flag image concealing a hidden payload behind a coding-test window — North Korea Contagious Interview OtterCookie campaign.

Nation-State Cyber Threats

Researchers Document North Korea-Linked "Contagious Interview" Campaign Using SVG Steganography to Deliver OtterCookie-Aligned Malware

Another Contagious Interview variant with a novel SVG delivery angle — a defender-oriented research review of how North Korea-linked actors hid an OtterCookie-aligned payload inside flag images sent through fake coding challenges.

Editorial science-poster illustration of indicator-of-compromise symbols — a hash string, an IP tag, a domain tag, a file icon, a registry key, a sealed envelope, and a magnifying lens.

Cybersecurity 101

Indicators of Compromise (IOCs): What They Are and How to Use Them

A complete guide to indicators of compromise (IOCs) — the major types, the IOC vs IOA distinction, the Pyramid of Pain, and how IOCs are shared via STIX/TAXII.

Editorial illustration of a Windows driver box wearing a graphics-card mask, marking the Rust-based LabubaRAT posing as NVIDIA software.

Malware

Researchers Document “LabubaRAT” Rust-Based Windows RAT Posing as NVIDIA Software

A Rust-based Windows remote-access tool with an NVIDIA-impersonation posture — defender research this week from Blackpoint Cyber, published with indicators of compromise for detection teams.

Editorial illustration of a magnifying glass over an npm package revealing an import-time fuse, marking Microsoft's deep-dive on the AsyncAPI npm compromise.

Supply Chain Attack

Microsoft Publishes Deep-Dive Analysis of AsyncAPI npm Supply-Chain Compromise

Microsoft goes deep on the AsyncAPI npm compromise — a defender review for CI/CD workflows and @asyncapi dependencies this week.

Editorial illustration of a dormant kernel gear reawakening beside a small hidden door, marking Daxin's resurfacing in Taiwan with the new Stupig backdoor.

Nation-State Cyber Threats

Symantec: Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New "Stupig" Backdoor

A dormant China-linked kernel rootkit surfaces again in Taiwan with a new backdoor companion — defender research review this week.

See all