Russia-aligned actors exploit MDaemon flaw to plant backdoors with no clicks
ESET says MDaemon before 26.0.4 runs CVE-2025-8088 while scanning a malicious RAR, dropping HELLAGE or HELLTAG DLLs in Ukraine.
74
Country
Russia
- Mentions · 7d20
- Mentions · 30d146
- All mentions323
- First seenAug 11, 2026
- Last mentioned3h ago
Timeline
323 articles · newest firstn0n extortion operator exposed AI-aided attack files on open server
SOCRadar says every examined break-in used weak or stolen credentials, not a software vulnerability.
74
Cyberattack keeps Russian retailer Poryadok disrupted for five days
The 48-store chain closed some shops and took its site and app offline, with no word on stolen data.
44
ESET: Belarus-linked FrostyNeighbor wipes Ukrainian transport manufacturer
UNC1151 used Chisel, UltraVNC, Cobalt Strike and a VBScript wiper delivered through Group Policy.
74
GhostWriter linked to first Belarus data wipe at Ukrainian firm
ESET ties FrostyNeighbor to the wipe and says Belarus-aligned operators increasingly mirror Russian priorities in Ukraine.
64
US seizes Virtualine bulletproof hosting domain used by cybercriminals
TRM Labs says the provider took nearly one-fifth of tracked illicit bulletproof-hosting inflows in 2026, and the seizure may not kill the infrastructure.
62
Unit 42 warns retailers of ransomware, extortion and DDoS
As of September 30, 2026, operators had claimed 565 retail victims, with median revenue about $22 million.
34
US sanctions Russians and North Koreans over IT-worker laundering
Treasury says two Russians each moved about $3.5 million in crypto tied to North Korean IT workers in Russia.
64
ESET: GhostWriter wiper hit a Ukrainian manufacturer
ESET calls the late-May attack the first destructive Belarus-aligned operation it has documented in Europe and says intent is unclear.
74
ASD chief warns AI will drive more disruptive cyberattacks
The annual report also covers an Amadey network of 180,000 computers and ASD wiping about 4.8 million stolen files.
62
Yoba campaign uses signed ChatGPT and Claude installers to sideload malware
Fake GitHub ZIPs pair signed OpenAI or Anthropic Setup.exe with a rogue DLL that loads an XMRig miner via Telegram and DNS.
72
Fake Android apps push ZloyRAT at Russians amid fuel and drone fears
F6 says three apps, including a police-and-fuel map, steal banking data; download counts and losses were not disclosed.
58
Moscow to restrict mobile internet during two October summits
From October 27 to 29, voice calls, Wi-Fi and a government whitelist stay available while wider mobile internet is cut.
34
Rapid7 says 71% of tracked exploitation starts within a week
Across 43 newly exploited high- and critical-severity flaws, disclosure-to-exploitation averaged three days.
54
ICMacOS Mac malware sold for $699 a week with remote commands
Version 2 adds a WebSocket shell and LaunchAgent persistence while still stealing developer and wallet secrets.
64
Ukraine says Starlink restored, disputes Musk misuse claim
Nearly two weeks of speed limits disrupted missions; officials say commercial terminals could not fly the alleged strikes.
58
CERT-UA warns hackers are compromising Dahua surveillance cameras
Attackers use Easy4IP serial patterns, weak passwords or outdated firmware to reach cameras even when they sit behind firewalls.
72
ICMacOS macOS stealer gains RAT capabilities with reboot persistence
ICMacOS now includes WebSocket remote commands and LaunchAgent persistence that survives reboots.
70
Digital Dissident devroom at FOSDEM 27 seeks anti-censorship talks
Speakers should cover end-to-end toolchains for people in Russia, Iran, China and similar regimes, not single-product pitches.
16
Starshield limits on Ukraine fuel European sovereignty debate
Steve Blank writes that a reported personal order by Elon Musk showed allies a US vendor kill switch.
34
Roundup: Tor exit hijacks, Heartbreaker ransomware, and platform breaches
A researcher says 333 Tor exits, about a tenth of them, captured SSH passwords and tried to plant Ebury.
58
DDoS waves took North Korean state websites offline for about 32 hours
Kentik tied failures starting October 20 to traffic from Vietnam, Venezuela and elsewhere, but named no operator.
48
UK proposes 14-year prison terms for undersea cable sabotage
Deliberate damage could bring 14 years and unlimited fines; a 12-week consultation closes January 14, 2027.
58
UK proposes up to 14 years in prison for undersea cable damage
A DCMS White Paper would also impose unlimited fines, new cable-operator duties and national-security direction powers.
52
Sandworm wiped a Ukrainian logistics firm after UAC-0099 access
ESET says MythicRatatoskr used a Yggdrasil mesh C2, and Sandworm wiped systems with SDelete on September 17, 2025.
73
UK proposes up to 14 years in prison for damaging subsea cables
A 12-week consultation would replace 1885 penalties and add security duties for telecoms operators; the plans are not law yet.
46
DDoS waves knock more than 40 North Korean websites offline
Kentik tied October 20 outages to synchronized traffic from Vietnam, the Philippines and Venezuela; no perpetrator was identified.
52
Book says Dutch spies viewed Kushner’s iPhone after GRU breach
Matthew Cole writes that MIVD saw a Dubai account that had received hundreds of millions from Azerbaijan.
44
FBI raids Texas laptop farms tied to North Korean IT schemes
Operation Lonestar Roundup seized 187 devices, charged 14 people, and affected more than 70 US companies, the FBI says.
62
House bill would direct NIST guidance on AI distillation attacks
The AI Cyber Defense Act covers entities tied to Russia, China, Iran, and North Korea and would add an industry roundtable.
54
ICRC tells UN autonomous weapons already amplify wartime harm
Gisel says AI targeting in Gaza and Ukraine speeds lethal decisions and can leave humans out of the loop.
48
UAC-0099 handed Ukraine grain firm access to Sandworm
MythicRatatoskr used Yggdrasil for C2; Sandworm later wiped data with SDelete via Group Policy.
76
PHP says Chainguard broke embargo on critical PHP2shell bugs
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution, and at least one hits every PHP release back to 5.4.
88
Russian satellite Kosmos 2612 closed in on ICEYE-X36
LeoLabs says the low-Earth-orbit approach fits proximity operations, but intent and the closest distance remain disputed.
8
Lawmakers say Russia seeks to undermine Democrats before midterms
They say a classified assessment finds influence activity by Russia, China, Iran, and North Korea, but no vote-system hacking.
44
Rapid7: high-severity flaws exploited within three days in Q3
The Gentlemen and Qilin led claimed ransomware incidents, the US accounted for 60% of attacks, and AI was operational in 8%.
56
Sandworm wiped a Ukrainian grain firm after UAC-0099 access
ESET says a July 2025 phishing foothold led to a September wipe, using a new backdoor that talked over Yggdrasil.
68
APT28 used Hookedge to tunnel into NATO shipbuilder
The unnamed intrusion began July 24, 2026, via a Word macro and lasted at least two months.
76
APT28 uses Hookedge and an SSH tunnel against NATO defense firms
A naval shipbuilder intrusion starting July 24, 2026 lasted at least two months and included stolen credentials.
76
Cyber Partisans hid Vasilek in VMware Tools for two years
Vasilek 1.5.8 ran from a fake VMware Tools service and could log keys, capture screens, and move the cursor.
74
Related CVEs
by mentions- CVE-2025-808894%8.4WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution
- CVE-2019-0708100%9.8Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep)
- CVE-2020-0688100%8.8RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys
- CVE-2026-2007988%10.0Authentication bypass to root access in Cisco Secure Firewall Management Center
- CVE-2026-2031635%5.3Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center
- CVE-2026-07682%9.8Langflow code Code Injection Remote Code Execution Vulnerability
- CVE-2026-2158999%9.3Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- CVE-2026-8877911%8.7Unauthenticated denial of service in NetScaler ADC and Gateway
- CVE-2021-33045100%9.8Authentication Bypass in Dahua IP Cameras, NVRs and Video Intercoms
- CVE-2024-3994337%8.8rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload…
Appears with
- Microsoftvendor · 44
- FBIorganization · 27
- Anthropicvendor · 21
- CISAorganization · 19
- Anthropicorganization · 19
- CERT-UAorganization · 17
- Sandwormthreat actor · 17
- Kasperskyvendor · 16
- ESETorganization · 16
- Microsoftorganization · 16
- OpenAIvendor · 16
- ShinyHuntersthreat actor · 16
- Claudeai model · 15
- Recorded Futureorganization · 15
- UAC-0099threat actor · 15
- Midnight Blizzardthreat actor · 14
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.