Roundup: Tor exit hijacks, Heartbreaker ransomware, and platform breaches
A researcher says 333 Tor exits, about a tenth of them, captured SSH passwords and tried to plant Ebury.
58
- Mentions · 7d0
- Mentions · 30d10
- All mentions21
- First seenAug 18, 2026
- Last mentioned7d ago
Timeline
21 articles · newest firstAPT28 used Hookedge to tunnel into NATO shipbuilder
The unnamed intrusion began July 24, 2026, via a Word macro and lasted at least two months.
76
APT28 uses Hookedge and an SSH tunnel against NATO defense firms
A naval shipbuilder intrusion starting July 24, 2026 lasted at least two months and included stolen credentials.
76
APT28 targeted NATO shipbuilder, engine maker and police agency
Symantec says the operators used Hookedge and an undocumented loader, ld.exe, whose decrypted payload was not recovered.
76
Incomplete security patches rose about eightfold in 2026
KEV fixes were later reported broken about four times as often as other fixes from the same vendors.
64
APT28 breaches NATO naval shipbuilder, deploys reflective loader
Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.
78
APT28 targeted European defense firms in two NATO countries, Symantec says
A July Word attachment led to Hookedge and an in-memory tool; activity ran from July 24 to September 24.
76
Malware evasion made easier with AI — but behavior still gives it away
ReversingLabs says Midnight Blizzard’s AI-rebuilt backdoor kept the same detectable behavior across five variants.
56
October Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged, including three zero days
Microsoft's October Patch Tuesday fixes 1,407 CVEs, including an exploited Windows Shell Mark-of-the-Web bypass.
84
VirusTotal Adds Scanning for Public IPv4 Space to Expose C2 Servers and Malware Infrastructure
VirusTotal now scans public IPv4 daily, recording ports, banners, and fingerprints to surface C2 infrastructure.
54
Hackers now exploit critical Roundcube flaw in code injection attacks
Attackers are exploiting patched Roundcube SQL injection CVE-2026-48842 to bypass login and steal database data.
78
AI Malware Keeps Changing Its Code to Break Traditional Signature-Based Detection
Google's GTIG documents AI-enabled malware PROMPTFLUX and PROMPTSTEAL that query LLMs at runtime to rewrite code and evade signature-based detection.
58
2,000 Leaked Documents Reveal How Russia Turns Engineering Students Into GRU Cyber Operators
Leaked Bauman Moscow State Technical University files reveal a hidden GRU training pipeline feeding APT28 and Sandworm units.
62
Leaked Russian Cyber-Operations Training Materials
Leaked Bauman university records reveal a formalized Russian pipeline training GRU cyber personnel, linking a graduate to Sandworm's Military Unit 74455.
42
Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.
78
APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
Recorded Future links new HOOKEDGE batch-script backdoor campaigns against Romanian, Spanish and Turkish government targets to Russia's APT28 (BlueDelta).
78
The AI Malware Maturity Gap
Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.
55
Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw
CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.
78
8,539 Reasons To Rethink How Vulnerabilities Get Patched
Rapid7 counted 8,539 high and critical CVEs in Q2 2026, double last year, with PoC availability up 76%.
52
Hackers target Ukrainian agency managing assets seized from sanctioned Russians
Ukraine's ARMA asset agency reported a cyberattack amid selecting a manager for seized IDS Ukraine assets linked to sanctioned Russians.
45
Fancy Bear Exploits Office Flaw
Fancy Bear (APT28) is reported exploiting a Microsoft Office flaw, per Infosecurity Magazine; details unavailable.
55
Related CVEs
by mentions- CVE-2026-2151061%8.8Security Feature Bypass in Microsoft Windows Shell Actively Exploited (CVE-2026-21510)
- CVE-2026-3220271%4.3Spoofing Flaw in Windows Shell (CVE-2026-32202) Actively Exploited
- CVE-2021-4402670%9.8SQL Injection in Roundcube Webmail via Search Parameters
- CVE-2026-7357072%8.9Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite
- CVE-2025-4911399%8.8Authenticated PHP Object Deserialization RCE in Roundcube Webmail
- CVE-2025-6846127%6.1Cross-Site Scripting via SVG animate Tag in Roundcube Webmail
- CVE-2023-563176%5.4Stored XSS in Roundcube Webmail exploited in the wild (CVE-2023-5631)
- Code injection in IBM i HTTP Server Administration
- CVE-2026-488422%8.1Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash…
- Signature check flaw enables privilege elevation in SharePoint Server
Appears with
- Hookedgemalware · 8
- GRUorganization · 6
- Fancy Bearthreat actor · 6
- Symantecorganization · 6
- Recorded Futureorganization · 5
- Microsoftvendor · 5
- Forest Blizzardthreat actor · 4
- Microsoft Wordproduct · 3
- Geminiai model · 3
- PromptFluxmalware · 3
- Swallowtailthreat actor · 3
- BlueDeltathreat actor · 3
- Microsoft Edgeproduct · 3
- HEADLACEmalware · 3
- CISAorganization · 3
- Google Threat Intelligence Grouporganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.