Threat Intelligence

Ransomware

ReliaQuest: “The Gentlemen” Overtakes Qilin as Most Prolific Ransomware Operation

The ransomware leaderboard shifts — The Gentlemen tops the chart in ReliaQuest’s latest tracking, and defender-team pattern-watching continues this week from the analyst’s chair, not the attacker’s.

Editorial illustration of an SVG flag image concealing a hidden payload behind a coding-test window — North Korea Contagious Interview OtterCookie campaign.

Nation-State Cyber Threats

Researchers Document North Korea-Linked "Contagious Interview" Campaign Using SVG Steganography to Deliver OtterCookie-Aligned Malware

Another Contagious Interview variant with a novel SVG delivery angle — a defender-oriented research review of how North Korea-linked actors hid an OtterCookie-aligned payload inside flag images sent through fake coding challenges.

Editorial science-poster illustration of indicator-of-compromise symbols — a hash string, an IP tag, a domain tag, a file icon, a registry key, a sealed envelope, and a magnifying lens.

Cybersecurity 101

Indicators of Compromise (IOCs): What They Are and How to Use Them

A complete guide to indicators of compromise (IOCs) — the major types, the IOC vs IOA distinction, the Pyramid of Pain, and how IOCs are shared via STIX/TAXII.

Editorial illustration of a Windows driver box wearing a graphics-card mask, marking the Rust-based LabubaRAT posing as NVIDIA software.

Malware

Researchers Document “LabubaRAT” Rust-Based Windows RAT Posing as NVIDIA Software

A Rust-based Windows remote-access tool with an NVIDIA-impersonation posture — defender research this week from Blackpoint Cyber, published with indicators of compromise for detection teams.

Editorial illustration of a magnifying glass over an npm package revealing an import-time fuse, marking Microsoft's deep-dive on the AsyncAPI npm compromise.

Supply Chain Attack

Microsoft Publishes Deep-Dive Analysis of AsyncAPI npm Supply-Chain Compromise

Microsoft goes deep on the AsyncAPI npm compromise — a defender review for CI/CD workflows and @asyncapi dependencies this week.

Editorial illustration of a dormant kernel gear reawakening beside a small hidden door, marking Daxin's resurfacing in Taiwan with the new Stupig backdoor.

Nation-State Cyber Threats

Symantec: Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New "Stupig" Backdoor

A dormant China-linked kernel rootkit surfaces again in Taiwan with a new backdoor companion — defender research review this week.

Editorial illustration of a fake CAPTCHA checkbox wired to a command prompt, marking CERT-UA's Sandworm PowerShell-paste technique aimed at Ukrainian users.

Nation-State Cyber Threats

Ukraine and CERT-UA Document Sandworm CAPTCHA-PowerShell Trick Targeting Ukrainian Users

Another Sandworm-attributed technique lands from CERT-UA — end-user awareness and defender posture review this week for Ukraine-adjacent organizations.

Editorial illustration of stacked app windows on a laptop collapsing toward a password box, marking the ClickLock macOS stealer that forces password entry.

Malware

Researchers Document “ClickLock” macOS Stealer That Reportedly Kills Apps Until Victim Enters Password

A novel macOS stealer technique with credential-and-crypto targeting — defender posture review for Mac-issuing organizations this week.

Editorial illustration of a judge's gavel resting on a transit farecard, marking two Scattered Spider members jailed for the £29M Transport for London attack.

Policy & Government

Two Scattered Spider Members Sentenced to Five-and-a-Half Years for £29 Million TfL Attack

The biggest cybercrime conviction in UK history — Scattered Spider's TfL attackers face five-and-a-half years, and the £29M cost lands as a defender-team reminder this week.

Editorial illustration of a server rack behind a bulletproof shield with a gavel and a broken seal, marking the US indictment of Russian hosting operators.

Policy & Government

US Unseals Indictment Charging Russian “Bulletproof” Web Hosts Over Cyberattacks That Netted $62 Million

A US indictment against Russian bulletproof hosting operators — law-enforcement continuation coverage this week.

Editorial illustration of a timeline with a wide gap between an early marker and a patch marker, marking SonicWall SMA zero-days exploited weeks before disclosure.

Vulnerabilities

CyberScoop Reports SonicWall SMA 1000 Zero-Days Were Reportedly Exploited Three Weeks Before Vendor Disclosure

A three-week pre-disclosure exposure window for the SonicWall SMA zero-days — defender teams review the timeline this week.

Editorial illustration of an npm package emitting nested loader boxes toward a node cluster, marking compromised @asyncapi packages delivering a botnet loader.

Supply Chain Attack

Compromised @asyncapi npm Packages Deliver Multi-Stage Botnet Loader

Another JavaScript-ecosystem supply-chain compromise, confirmed by four vendors: four @asyncapi npm packages were observed distributing a multi-stage botnet loader, and all five malicious versions have since been pulled from npm — defender inventory work this week.

See all