Overlord and Lampion campaigns hide malware with Windows tools
Phishing in Brazil and Portugal delivers VBScript downloaders that persist as fake Windows Error Reporting tasks and side-loaded DLLs.
58
- Mentions · 7d0
- Mentions · 30d4
- All mentions8
- First seenSep 16, 2026
- Last mentioned7d ago
Timeline
8 articles · newest firstGentlemen ransomware disables Defender, deletes backups and spreads
Acronis describes a Go-based RaaS from 2025 that also targets Linux, NAS and BSD, with more than 800 claimed victims.
74
Gentlemen ransomware kills security tools with Lenovo and Safetica drivers
Acronis droppers load BootRepair.sys 2.5.30.11281 and Safetica ProcessMonitorDriver 11.26.18, then terminate matching processes from kernel mode.
74
How to secure RMM software: 8 controls MSPs should test
An Acronis-backed checklist tells MSPs to test eight RMM controls, citing N-able and SharePoint flaws.
28
Red Heron Exploits Critical Gitea Flaw to Steal Repositories and Deploy Linux Rootkit
Red Heron exploited Gitea CVE-2026-60004 to steal repositories and deploy the JITTERLY backdoor and SIXZUT rootkit.
78
Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers
Chinese hackers exploited ZyXEL CVE-2026-7273 on GS1900 switches in 48 countries; CISA added it to KEV.
82
Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks
Acronis warns CVE-2026-87886, a local privilege escalation flaw in its cPanel/WHM and Plesk backup plugins, is exploited in targeted attacks.
65
Acronis Backup Plugin Vulnerability Exploited in the Wild to Gain Elevated Linux Privileges
Acronis patched CVE-2026-87886 (CVSS 7.8), a local privilege escalation flaw in its cPanel & WHM backup plugin already exploited in targeted attacks.
62
Related CVEs
by mentions- CVE-2026-87886<1%7.8Incorrect Default Permissions in Acronis Backup Plugin for cPanel & WHM and Plesk Enable Privilege Escalation
- CVE-2025-70795<1%5.5STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that…
- CVE-2026-8621815%10.0Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild)
- CVE-2025-53770100%9.8Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises
- CVE-2026-6000424%9.8Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection
- CVE-2026-72733%8.8Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- CVE-2025-53771100%6.5Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing
Appears with
- Acronisvendor · 3
- Red Heronthreat actor · 2
- Pleskvendor · 2
- ProcessMonitorDriverproduct · 2
- Acronis Backup plugin for cPanel & WHMproduct · 2
- WordPressproduct · 2
- Giteaproduct · 2
- Safeticavendor · 2
- Lenovovendor · 2
- BootRepair.sysproduct · 2
- Microsoftvendor · 2
- cPanelvendor · 2
- CISAorganization · 2
- Acronis Backup extension for Pleskproduct · 2
- GreyNoiseorganization · 1
- Acronis RMMproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.