Indicators

Reports whose articles were checked and found to contain indicators. Counts are measured, not guessed: open a report, read it, take the addresses. Verify every one before it goes anywhere near a block list — a count is evidence a report is worth your time, not that an address is hostile.

37 items from 13 sources

headlines only — every link goes to the original

BleepingComputer
New StormEncryptor ransomware used by former Medusa affiliate
2026-08-10 17:42 UTCindicators1 ip · 2 hashesthreat actorA financially motivated threat actor previously associated with the Medusa ransomware operation is now deploying a new ransomware strain called StormEncryptor. [...]
Microsoft Security
DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
2026-08-10 15:00 UTCindicators1 ip · 7 hashesransomwareMicrosoft Threat Intelligence examines DeadLock ransomware, an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications, negotiations, and data…
BleepingComputer
CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs
2026-08-10 14:34 UTCindicators1 ip · 2 hashesransomwareCISA has confirmed that ransomware gangs have begun exploiting two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery (SSRF) flaw. [...]
CISA
#StopRansomware: Gunra Ransomware
2026-08-10 12:00 UTCindicators17 ip · 8 hashesransomwareAdvisory at a Glance Title #StopRansomware: Gunra Ransomware Original Publication August 10, 2026 Executive Summary Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical…
BleepingComputer
Critical Progress LoadMaster flaw now actively exploited in attacks
2026-08-10 09:49 UTCindicators4 ip · 2 hashesactively exploitedThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are exploiting a critical-severity Progress Kemp LoadMaster command injection vulnerability. [...]
The Hacker News
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
2026-08-08 06:58 UTCindicatorsexploited inMetabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score: 10.0),…
BleepingComputer
Metabase SQLi zero-day exploited in customer data-theft attacks
2026-08-07 20:14 UTCindicators1 ip · 2 hashesexploited inA critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framework and Tally. [...]
Microsoft Security
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide
2026-08-05 15:48 UTCindicators1 ip · 6 hashescampaignA macOS ClickFix campaign shifted tactics from openly serving infostealer lures to hiding them behind a browser-fingerprinting gate. The change makes malicious infrastructure harder to detect while giving defenders new…
Microsoft Security
128 Seconds to disruption: Microsoft Defender stops ransomware at QNET
2026-08-04 17:54 UTCindicators1 ip · 6 hashescompromisedMicrosoft Defender automatically isolated a compromised QNET endpoint in 128 seconds, stopping a multi-stage attack before the payload could persist or spread. The post 128 Seconds to disruption: Microsoft Defender…
Fortinet
QuickFox Supply Chain Attack Used to Deploy FDMTP Implant
2026-08-04 13:00 UTCindicators58 ip · 36 hashesincident responseThe FortiGuard Labs Incident Response team analyzes a QuickFox supply chain attack that used trojanized Windows installers, selective targeting, and an evolving FDMTP implant
Malware Traffic Analysis
2026-07-31: SmartApeSG ClickFix campaign pushes unidentified RAT
2026-07-31 20:54 UTCindicators1 ip · 2 hashescampaign
Securelist
OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia
2026-07-30 11:00 UTCindicators11 ip · 58 hashescampaignOur experts discovered OctLurk and SilkLurk, backdoors operating primarily in memory, targeting Central Asia. They inject plugins to launch shells, scan networks, dump credentials, and keylogging.
Unit 42
Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
2026-07-30 10:00 UTCindicatorsthreat actorUnit 42 details a Chinese speaking threat actor combining autonomous AI scanning across seven vulnerabilities with manual exploitation. Read more. The post Chinese-Speaking Threat Actor Harnesses AI Models for…
Securelist
Toy Ghouls’ new toy: the GenieLocker ransomware
2026-07-30 08:00 UTCindicators1 ip · 50 hashesextortionKaspersky experts dissect GenieLocker: new custom ransomware variants for Windows, Linux, and ESXi systems. We found this family in attacks by Toy Ghouls, a financially motivated extortion group.
Zscaler ThreatLabz
Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor
2026-07-27 14:51 UTCindicators8 ip · 12 hashesthreat actorIntroductionZscaler ThreatLabz has been tracking attacks from a threat actor that is likely an initial access broker for ransomware attacks since January 2026. The threat actor targets organizations by leveraging…
Elastic Security Labs
New North Korean campaign uses fake coding interviews to steal developer credentials
2026-07-18 00:00 UTCindicators2 ip · 11 hashescampaignDPRK-aligned hackers hid malware inside SVG flag images to backdoor developer job interview coding tests. Not one antivirus vendor caught it.
Fortinet
The TTF Trap: A Global Campaign of a Low-Detection Lua Loader
2026-07-16 13:00 UTCindicators5 ip · 34 hashescampaignFortiGuard Labs analyzes a global phishing campaign using obfuscated JScript, disguised .ttf files, and Lua loaders to deliver RATs and infostealers.
Cisco Talos
UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
2026-07-16 10:00 UTCindicators2 ipcampaignCisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025.
Elastic Security Labs
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
2026-07-16 00:00 UTCindicators2 ip · 18 hashesmalwareTELEPUZ is a modular malware that emerged through CLICKFIX-VIDAR attacks in April. We reverse-engineered it to show you the infrastructure and evasion techniques that matter.
Zscaler ThreatLabz
ClaudeFix: Shared Claude Chats Meet ClickFix
2026-07-15 14:39 UTCindicators1 ip · 10 hashesClickFixIntroductionClickFix is a widely employed attack technique, first seen in 2024, where a victim is instructed to paste-and-run instructions on their system to “fix” a problem or install software. The seemingly benign…
Huntress
Threat Actors Achieve Persistence After SQL Injection
2026-07-13 13:00 UTCindicators15 hashesthreat actorSee how a threat actor used SQL injection and BadIIS to gain persistence, disable Windows Defender, and quietly install a cryptominer.
Elastic Security Labs
ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit
2026-07-08 00:00 UTCindicators3 ip · 31 hashesClickFixElastic Security Labs tracks REF6045, an active operator-assisted banking fraud operation targeting customers of Mexican banks, fintech, payment processors, and cryptocurrency exchanges.
Unit 42
Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation
2026-07-07 22:00 UTCindicators4 ip · 107 hashescampaignA cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combination. The post Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders…
The DFIR Report
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
2026-06-29 13:07 UTCindicators11 ip · 9 hashesintrusionKey Takeaways This case was first reported to customers in a threat brief released in July 2025 and in a public flash alert in August 2025 in partnership with Swisscom B2B CSIRT, which observed another intrusion tied to…
Huntress
Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress
2026-06-22 12:00 UTCindicators14 hashesphishingMove past basic credential harvesting. Discover how modern attackers use ClickFix, BitB, and OAuth consent phishing—and how to train your users with Huntress SAT.
Zscaler ThreatLabz
SmartApeSG Launches Okendo Reviews Supply Chain Attack
2026-06-18 14:04 UTCindicators1 ip · 1 hashesthreat actorIntroductionOn May 14, 2026, the Zscaler ThreatLabz team identified unusually high activity associated with the threat actor SmartApeSG to deploy malware. During our examination, we discovered malicious JavaScript code…
Zscaler ThreatLabz
ClickFix Campaign Generated Via AI Delivers SmartRAT
2026-06-17 17:58 UTCindicators3 ip · 5 hashescampaignIntroductionIn March 2026, Zscaler ThreatLabz observed multiple instances of typosquatting domains hosting malicious content generated with AI-powered website creation tools. Threat actors are leveraging website…
Huntress
Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack
2026-06-16 14:00 UTCindicators4 ip · 21 hashesloaderA ClickFix infection drops Potemkin loader and RMMProject RAT, leading to browser theft, hidden remote desktop, and lateral movement across over 11 hosts.
Zscaler ThreatLabz
Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion
2026-06-12 21:14 UTCindicators1 ip · 4 hashescampaignIntroductionSince Zscaler ThreatLabz published its analysis of Shai-Hulud V2 in November 2025, the campaign has continued to evolve in ways that distinguish it from more typical software supply chain attacks. Over the…
Huntress
Inside Kali365, a Device Code Phishing Ecosystem | Huntress
2026-06-11 18:00 UTCindicators1 ip · 14 hashesphishingHuntress traced device code phishing from Tencent Cloud to Kali365, a Microsoft 365 kit that steals tokens and keeps access even after MFA or password resets.
Zscaler ThreatLabz
Technical Analysis of MLTBackdoor
2026-06-09 16:26 UTCindicators1 ip · 28 hashesthreat actorIntroductionIn May 2026, Zscaler ThreatLabz identified a new malware family that we track as MLTBackdoor that is likely leveraged by a ransomware-related threat actor. MLTBackdoor has been observed by ThreatLabz being…
Fortinet
Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data
2026-05-26 13:00 UTCindicators3 ip · 6 hashescampaignFortiGuard Labs analyzed a new phishing campaign that uses obfuscated JavaScript, PowerShell, process hollowing, and PureLogs to steal sensitive data
Huntress
The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress
2026-05-21 07:00 UTCindicators2 ip · 15 hashesransomwareTwo recent incidents involving The Gentlemen ransomware show the use of defense evasion tactics, including logs being cleared and attempts to add antivirus exclusions.
Huntress
Threat Actor Defense Evasion: How Attackers Disable AV & EDR
2026-05-18 14:00 UTCindicators14 hashesthreat actorThreat actors are actively targeting your security tools. Learn how threat actors disable antivirus and EDR through vulnerable drivers, tampering attacks, and malicious firewall rules, and how Huntress detects.
The DFIR Report
Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware
2026-05-11 14:05 UTCindicators1 ip · 18 hashesransomwareThe EtherRAT malware family was first reported by Sysdig back in December 2025. At that time, the initial access vector was exploitation of CVE-2025-55182 (React2Shell) targeting Linux servers. In March 2026, a Windows…
The DFIR Report
Apache ActiveMQ Exploit Leads to LockBit Ransomware
2026-02-23 14:09 UTCindicators2 ip · 5 hashesthreat actorKey Takeaways An audio version of this report can be found on Spotify, Apple, YouTube, Audible, & Amazon. This intrusion began in mid-February 2024 after a threat actor exploited a vulnerability (CVE-2023-46604) on an…
The DFIR Report
Cat’s Got Your Files: Lynx Ransomware
2025-12-17 19:07 UTCindicators2 ip · 10 hashesintrusionKey Takeaways The DFIR Report Services Contact us today for pricing or a demo! The intrusion began in early March 2025 with a single successful Remote Desktop Protocol (RDP) logon to an internet-exposed system. Notably,…

|New StormEncryptor ransomware used by former Medusa affiliate

|DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

|CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

|#StopRansomware: Gunra Ransomware

|Critical Progress LoadMaster flaw now actively exploited in attacks

|Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

|Metabase SQLi zero-day exploited in customer data-theft attacks

|From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide

|128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

|QuickFox Supply Chain Attack Used to Deploy FDMTP Implant

|2026-07-31: SmartApeSG ClickFix campaign pushes unidentified RAT

|OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

|Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks

|Toy Ghouls’ new toy: the GenieLocker ransomware

|Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor

|New North Korean campaign uses fake coding interviews to steal developer credentials

|The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

|UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign

|TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

|ClaudeFix: Shared Claude Chats Meet ClickFix

|Threat Actors Achieve Persistence After SQL Injection

|ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

|Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

|From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

|Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress

|SmartApeSG Launches Okendo Reviews Supply Chain Attack

|ClickFix Campaign Generated Via AI Delivers SmartRAT

|Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack

|Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion

|Inside Kali365, a Device Code Phishing Ecosystem | Huntress

|Technical Analysis of MLTBackdoor

|Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data

|The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress

|Threat Actor Defense Evasion: How Attackers Disable AV & EDR

|Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware

|Apache ActiveMQ Exploit Leads to LockBit Ransomware

|Cat’s Got Your Files: Lynx Ransomware

New StormEncryptor ransomware used by former Medusa affiliate

DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

#StopRansomware: Gunra Ransomware

Critical Progress LoadMaster flaw now actively exploited in attacks

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase SQLi zero-day exploited in customer data-theft attacks

From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide

128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

QuickFox Supply Chain Attack Used to Deploy FDMTP Implant

2026-07-31: SmartApeSG ClickFix campaign pushes unidentified RAT

OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks

Toy Ghouls’ new toy: the GenieLocker ransomware

Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor

New North Korean campaign uses fake coding interviews to steal developer credentials

The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign

TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

ClaudeFix: Shared Claude Chats Meet ClickFix

Threat Actors Achieve Persistence After SQL Injection

ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress

SmartApeSG Launches Okendo Reviews Supply Chain Attack

ClickFix Campaign Generated Via AI Delivers SmartRAT

Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack

Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion

Inside Kali365, a Device Code Phishing Ecosystem | Huntress

Technical Analysis of MLTBackdoor

Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data

The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress

Threat Actor Defense Evasion: How Attackers Disable AV & EDR

Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware

Apache ActiveMQ Exploit Leads to LockBit Ransomware

Cat’s Got Your Files: Lynx Ransomware