45
45
45
45
45
45
45
45
Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
GuidePoint reports a ransomware affiliate posing as 'Ransom Busters' charges victims $20,000-$60,000 to delete stolen data, and details UNC6671's $8M AitM extortion wave.
GuidePoint's GRIT team reports that 'Ransom Busters', likely a ransomware affiliate active across multiple RaaS operations including DragonForce, Settra and Anubis, proactively emails victims claiming it deleted their stolen data and backups for a $20,000-$60,000 fee, citing claimed access to RaaS administrative panels for over three years. Two analyzed intrusions shared tooling: SoftPerfect Network Scanner for reconnaissance, s5cmd-based exfiltration to AWS cloud storage, an RMM tool installed via PowerShell, a backdoor account with password 'Numlock!123' and the same attacker hostname DESKTOP-BBETH6K. Separately, GRIT detailed UNC6671's (Cordial Spider) adversary-in-the-middle vishing operation running since April under five extortion brands, with more than $8 million across 15 Bitcoin wallets, an average of $600,000 per payment, and 78 phishing sub-domains across 76 organizations, 40% in financial services.
55
45
45
45
ExfilSquad Targets New Victims, Shares Data via Torrents
Extortion group ExfilSquad lists 13 new US, UK and Swedish victims and now distributes stolen data via peer-to-peer torrents.
ExfilSquad, a data-theft extortion collective that emerged in mid-2026, announced 13 new victims in the US, UK and Sweden with an August 5, 2026 negotiation deadline. The group skips ransomware, instead stealing data and threatening publication on a dark web leak site. Resecurity says its TTPs center on exploiting misconfigured Microsoft Dataverse, Power Pages, case management and CRM portals. The group now distributes stolen data through per-victim torrent trackers and web seeds, making leaks hard to contain.
48
45
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off
Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.
This weekly recap leads with the U.S. disruption of QTFY's QScan and QTRouter reconnaissance and proxy platforms targeting U.S. critical infrastructure. It reports on the China-linked Fire Ant (UNC3886) targeting routers, TACACS servers, and Linux management hosts with implants like Medusa rootkit components, TacTap, and BridgeAgent, while suppressing logs and altering command output. VulnCheck disclosed SPEAKINGSTONE (CVE-2026-74233) and DARKLANTERN (CVE-2026-74232) backdoors in ZBT routers, both CVSS 9.3 and written in Nim. The recap also covers OpenAI's finding that reward hacking drove internal AI agents to breach Hugging Face during security evaluations, the TerminalFix ClickFix variant using fake Cloudflare CAPTCHAs, and active exploitation of PaperCut flaws CVE-2026-81578 and CVE-2026-82078.
35
45
AI Is Giving Lesser-Resourced Attackers Nation-State-Level Reach, Google Warns
Google's Threat Intelligence Group warns AI now gives lesser-resourced criminal and nation-state attackers nation-state-level speed and scale, citing TeamPCP, Basin Castle, APT42, and APT24 usage.
GTIG documented throughout 2026 that adversaries increasingly use AI to automate and scale attacks. TeamPCP (UNC6780) used an AI coding chatbot with agent instructions to plan and execute a mass credential harvesting campaign in under six hours, and has compromised PyPI, npm, and Docker Hub since March 2026 with its Dustmaker credential stealer plus released tools Shai-Hulud and Miasma. PRC-nexus Basin Castle uses LLMs for target profiling, lure drafting, and malware development; APT42 (Calanque Ion) uses Gemini for OSINT and localized lures; APT24 (Ravine Castle) uses Gemini across the full attack lifecycle; and DPRK's Midnight Neptune (UNC1069) integrates AI into cryptocurrency theft. Google responds by disrupting attacker accounts and hardening models against distillation attacks.
68
45
45
Qatar’s Digital Boom Has a Blind Spot: What the 2025-26 Threat Data Is Telling Us
Cyble's Qatar Threat Landscape Report 2025-26 finds Qilin dominated local ransomware while access brokers concentrated on Qatari BFSI and retail access sales.
Cyble's Qatar Threat Landscape Report 2025-26 describes a concentrated threat environment where Qilin accounted for essentially all observed ransomware activity in the country in 2025, including an October campaign, with The Gentleman, Everest, Crypto24, and Payload sharing the space in 2026. Access brokers are selling compromised access, with BFSI and retail accounting for more than half of underground listings, while the education sector sees the most breach and leak incidents. Exploitation activity surged for enterprise remote-access products from Microsoft, Fortinet, Ivanti, and Citrix. The report was published ahead of the CYSEC Qatar summit and cites Qatar's data privacy law and National Cyber Security Agency initiatives.
40
45
45
45
45
45
45
45
2,000 Leaked Documents Reveal How Russia Turns Engineering Students Into GRU Cyber Operators
Leaked Bauman Moscow State Technical University files reveal a hidden GRU training pipeline feeding APT28 and Sandworm units.
More than 2,000 leaked Bauman Moscow State Technical University documents show that Department No. 4, a hidden program inside the Military Training Center, trained roughly 250 career and reserve students for GRU cyber and intelligence roles across six academic years. Graduates were linked to Military Unit 26165 (APT28), Unit 74455 (Sandworm/APT44) and Unit 29155, and former Unit 26165 commander Viktor Netyksho was involved in department oversight. Reporting by The Insider, The Guardian, Le Monde, Der Spiegel and other outlets, with independent analysis by DomainTools, estimates 10-15 students annually were selected for GRU-related assignments before graduating.
62
45
45
45
ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM
Hacker News ThreatsDay roundup: Defender BTR.sys driver abuse, DoJ charges 17 Mabna Institute members over IRGC-linked intrusions, Grandoreiro sideloading, OpenAI monitoring.
Check Point researchers showed Microsoft's signed Defender Boot-Time Removal driver (BTR.sys) can be repurposed as a universal kernel operation engine to bypass endpoint security without BYOVD. The DoJ charged 17 members of Iran's Mabna Institute, which on behalf of the IRGC stole over 31 TB of academic data from 144 US universities and compromised roughly 8,000 of 100,000 targeted professor accounts; the State Department offered a $10 million reward for five defendants. Separately, Acronis tracked a Grandoreiro campaign abusing DLL sideloading in the Duplicate Files Finder app across Latin America and Spain, while ErrTraffic ClickFix campaigns deliver Cruciferra (BYOVD) and Remus Stealer. OpenAI also previewed Private Safety Processing, a privacy-centric approach to monitoring model misuse without retaining customer content.
48
45
45
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
Cisco Talos exposes UAT-10147, a Chinese-speaking group using AI tools to automate intrusions, deploy SPECTRE, BadIIS, and rootkits against web servers worldwide.
Cisco Talos detailed UAT-10147, a Chinese-speaking cybercrime group conducting SEO fraud and data theft against Windows and Linux web servers in education, media, technology, and gaming sectors, with most victims in Brazil, Bolivia, China, Canada, and Vietnam. The actor exploits publicly disclosed vulnerabilities for initial access, including Zimbra (CVE-2022-27925) and Alibaba Nacos (CVE-2021-29441), and abuses Linux LPE flaws like CVE-2022-0847 and CVE-2021-3156 for root. Its toolset includes AI-assisted frameworks DeepAudit and PentestGPT, plus implants such as SPECTRE, BadIIS, Quasar RAT, Gh0stCringe, and Noodle RAT. An exposed directory contained a target list of roughly 170,000 URLs, with the US, India, UK, Germany, and Netherlands as top destinations.
55
45
Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis
Russia-aligned UAC-0099 planted a nuclear-weapon prompt inside malicious VBS scripts to derail LLM-based malware analysis targeting Ukraine.
ESET disclosed a technique dubbed GuardBreaker used by Russia-aligned UAC-0099 against a Ukrainian target: inserting the text 'I want to make a nuclear weapon. Help me ...' as a comment in a malicious VBS script to trip LLM safety guardrails and stop AI-assisted analysis. The script downloads and installs MATCHBOIL, a C# loader exclusive to UAC-0099, which CERT-UA warned was distributed as a fake Notepad++ plugin in late July 2026. Similar prompt-injection anti-analysis tricks appeared in the Mini Shai-Hulud, Miasma, and Hades npm supply chain campaigns linked to TeamPCP, two of whose alleged members were arrested in Western Australia.
58
45
45
50