ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
ThreatsDay details the RemControl Android banking trojan, a ZCode source leak, and related phishing and ICS risks.
61
Malware
Medusa
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenAug 12, 2026
- Last mentionedSep 24, 2026
Timeline
7 articles · newest firstNew Android malware RemControl steals banking PINs and blocks removal attempts
Group-IB says RemControl, a new Android banking trojan, steals PINs from customers of more than 30 banks.
73
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off
Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.
35
Week in review: Records allegedly stolen from Azure tenants, Medusa ransomware hits 500+ orgs
Week in review: Medusa ransomware hit 500+ orgs per CISA, millions of Azure tenant records allegedly stolen, SafePal and French tax authority breaches disclosed.
42
Over 500 Critical Infrastructure Organizations Hit by Medusa Ransomware
FBI warns Medusa ransomware-as-a-service has hit over 500 critical infrastructure organizations while significantly improving its tactics, techniques and procedures.
87
Storm-1175 Replaces Medusa With New StormEncryptor Ransomware
Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.
62
N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577
N-able shipped a second N-central hotfix as attackers actively exploit authentication bypass CVE-2026-18577, attributed to ransomware group Storm-1175.
78
Related CVEs
by mentions- CVE-2026-1857715%8.2Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch)
- CVE-2025-31161100%9.8Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161)
- CVE-2026-2376096%9.3Unauthenticated Admin Password Reset Bypass in SmarterTools SmarterMail
- CVE-2023-2152959%8.8Authenticated Deserialization RCE in Microsoft Exchange Server (CVE-2023-21529)
- CVE-2024-170895%8.4Path Traversal RCE in ConnectWise ScreenConnect (CVE-2024-1708)
- CVE-2024-5772797%7.5Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
- CVE-2024-27199100%7.3Path Traversal in JetBrains TeamCity Allows Limited Admin Actions
- CVE-2026-74232<1%9.3Backdoor implant in Zbtlink and MoreQuick routers allows unauthenticated root access
- CVE-2026-66747<1%9.3Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line
- CVE-2026-742333%9.3Unauthenticated Root Command Injection in Zbtlink (ZBT) Router infosrvd Service
Appears with
- Microsoftvendor · 3
- FBIorganization · 3
- AnyDeskproduct · 2
- SimpleHelpproduct · 2
- Group-IBorganization · 2
- Medusathreat actor · 2
- Telegramproduct · 2
- Androidproduct · 2
- CISAorganization · 2
- TVTapproduct · 2
- RemControlmalware · 2
- Google Playproduct · 2
- N-ablevendor · 2
- StormEncryptormalware · 2
- Storm-1175threat actor · 2
- Metavendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.