Fake Polymarket sites sold by traffer teams rig bets and block withdrawals
Insikt Group says affiliates get turnkey sites and crypto payouts while operators set each victim’s win chance.
64
Organization
Recorded Future
- Mentions · 7d3
- Mentions · 30d28
- All mentions56
- First seenAug 12, 2026
- Last mentioned18h ago
Timeline
56 articles · newest firstFake Polymarket platforms claim nearly $11 million in crypto deposits
Insikt Group says three Russian-language teams sell fake Polymarket and Kalshi sites; the deposit totals are the operators’ unverified claims.
52
Public PHP2Shell scripts drive mass scans of internet-facing PHP
Fastly saw about 250,000 probe requests from roughly 3,200 IPs, but those counts do not prove servers were compromised.
74
Storm-0940 used AI tool Artex in ConnectWise customer intrusions
Microsoft logged more than 151,000 failed logons and successful sign-ins with ConnectWise cloud application identities.
80
Microsoft links ConnectWise breach to Storm-0940 using AI tool ARTEX
Stolen application credentials were used against 2,250 Microsoft 365 tenants, with privileged access in under three hours in some cases.
82
Amazon says PHP2Shell was probed before disclosure and is now exploited
Fixes are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12; PHP 8.1 and earlier get no official patches.
92
Storm-0940 used ARTEX and AI coding agents against many targets
Microsoft says the group tried more than 2,250 tenants at about 2,900 sign-ins a minute.
74
Zscaler details AI setup behind a global hacking campaign
Jump host 38.244.50.120 routed connections to targets while ARTEX requested DeepSeek through an unverified gateway.
74
APT28 uses Hookedge and an SSH tunnel against NATO defense firms
A naval shipbuilder intrusion starting July 24, 2026 lasted at least two months and included stolen credentials.
76
APT28 targeted NATO shipbuilder, engine maker and police agency
Symantec says the operators used Hookedge and an undocumented loader, ld.exe, whose decrypted payload was not recovered.
76
TAG-217’s South Korea bank operation exposed its own tools
Open directories showed crypto, Linux and mobile tooling; cited breaches cover at least 68,000 people.
72
APT28 targeted European defense firms in two NATO countries, Symantec says
A July Word attachment led to Hookedge and an in-memory tool; activity ran from July 24 to September 24.
76
TAG-217 used Claude, DeepSeek and Grok against South Korean banks
Cited reporting says at least 68,000 people's data was exposed at seven or more financial institutions.
73
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Qilin and Settra are exploiting PAN-OS GlobalProtect flaw CVE-2026-0257, alongside new RATs and a DNS wallet drainer.
86
Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government
Kazakhstan-linked Silent Lynx spies on Russia's Orsk refinery and regional governments using spear-phishing and lightweight malware.
76
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Talos says 2026 CVE volume passed 70,000 while KEV growth lagged, so discovery is not exploitation.
58
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
Silent Lynx used a WinRAR flaw and phishing to plant reverse shells on CIS government targets.
76
Suspected Kazakhstan-linked hackers target governments across former Soviet states
Suspected Kazakhstan-linked UAT-6275 ran at least eight espionage campaigns against former Soviet governments since 2025.
76
UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations
UAT-6275 used WinRAR CVE-2025-8088 to plant reverse shells on CIS government systems via malicious archives.
78
Russia Is Tightening Internet Controls, Leading to Operational Risks
Insikt Group says Russia’s expanding VPN blocks, shutdowns, and surveillance raise operational and sanctions risks without full internet isolation.
64
TAG-217 Targets South Korean Financial Services with ARTEX
TAG-217 used the ARTEX AI framework in attacks that exposed data on 68,000 people at South Korean banks.
74
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
Kazakhstan-linked UAT-6275 targeted CIS governments using phishing and a WinRAR exploit.
78
TAG-193’s Regional Espionage Operations
TAG-193 ran regional government espionage, adding WinRAR CVE-2025-8088 exploitation to its phishing and reverse-shell toolkit.
76
Malware Indicators of Compromise (IoCs) | Recorded Future
Recorded Future explains malware IoCs for detection and why they decay without context.
34
September 2026 CVE Landscape
Recorded Future says 80 vulnerabilities were actively exploited in September 2026, including NetScaler zero-days.
85
Working in Boston at the World’s Largest Intelligence Company
Recorded Future moved its Boston headquarters from a former Somerville laundromat to downtown Post Office Square.
3
Recorded Future Introduces AI Infrastructure Indicator Lists, Strengthening AI Governance
Recorded Future launched indicator lists so security teams can monitor and control AI infrastructure traffic.
34
Japan Adopts Proactive Cyber Defense Strategy
Japan's Active Cyber Defense law mandates critical-infrastructure incident reporting from October 2026, with disruption powers later.
70
Social Engineering in the Age of Synthetic Media
Recorded Future details how threat actors abuse jailbroken and legitimate AI tools to scale phishing, deepfake impersonation, and phishing-as-a-service operations.
55
Recorded Future Debuts Autonomous Defense, Built for Machine-Speed Threats
Recorded Future debuted an autonomous defense platform that acts on threat intelligence at machine speed.
28
Recorded Future Launches MCP, the Intelligence Layer for Agentic Security Operations
Recorded Future made its MCP generally available so AI agents can query its threat intelligence.
48
The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
Wiz finds Lumma, RedLine, and Vidar dominate infostealer theft of AWS, GitHub, and OpenAI credentials from endpoints.
64
Using Threat Intelligence to Stop Ransomware Attacks
Recorded Future says threat intelligence can flag ransomware access and infrastructure before files are encrypted.
32
The Lure Isn't The Malware. It's Your Logo.
Recorded Future launches Malicious Site Monitoring in Digital Risk Protection, showcasing ClickFix brand-impersonation detection with AI triage.
15
Agent Running in the Age of AI
Recorded Future argues AI agents need trusted threat intelligence to make better security decisions.
22
The New Rules of Machine Speed Defense
Recorded Future panel discussion argues for intelligence-led, machine-speed defense as AI-enabled threats and frameworks like NIST's Cyber AI Profile evolve.
15
Recorded Future Launches Digital Risk Protection, Unifying Brand and Identity Monitoring
Recorded Future launched Digital Risk Protection, unifying brand and identity monitoring across five external threat surfaces in one workflow.
52
The Convergence of Space and Cyber: Evolving Threats in the Space Race 2.0
Recorded Future whitepaper warns nation-state cyber operations targeting satellites, ground stations and space supply chains will intensify during 'Space Race 2.0'.
25
August 2026 CVE Landscape
Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.
68
Recorded Future Announces Automated Signature Creation, Accelerating Vulnerability Prioritization
Recorded Future launched Automated Signature Creation in ASI, turning new CVEs into deployable detection signatures in as little as 31 minutes.
32
Related CVEs
by mentions- CVE-2025-808894%8.4WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2021-44228100%10.0JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)
- CVE-2026-1949033%9.3Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
- CVE-2026-7136290%9.1Unauthenticated Privilege Escalation Flaw in Adobe Commerce (Magento)
- CVE-2026-72733%8.8Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- CVE-2026-58704<1%8.8Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation
- CVE-2026-598002%9.29Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not…
Appears with
- Recorded Futurevendor · 20
- Insikt Grouporganization · 15
- Cisco Talosorganization · 7
- UAT-6275threat actor · 7
- TAG-193threat actor · 6
- WinRARproduct · 6
- Microsoftvendor · 6
- Hookedgemalware · 6
- DeepSeekai model · 5
- APT28threat actor · 5
- Grokai model · 5
- Claude Codeproduct · 5
- GitHubproduct · 5
- Silent Lynxthreat actor · 5
- BlueDeltathreat actor · 4
- Forest Blizzardthreat actor · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.