Search: “in-the-wild”

20 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 213 Vulnerability 202 Malware 79 Ransomware 47 Threat actor 20 Data breach 15 AI safety & security 5 Advisory 5 AI research 3 Phishing & fraud 3 Policy & legal 3 Research 2 Industry 2 Tools 1

SeverityAll critical 410 high 166 medium 16 low 0 info 9

A threat actor exploited 11 zero

Security AffairsMar 20, 20:11 UTC · Mar 20, 2021Threat actor in the wildCVE-2020-27930 CVE-2020-27950 CVE-2020-27932+8 CVEs

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

Proofpoint links four espionage clusters, including China's APT31, using shared exploit kit BlueMoon chaining Chrome V8 and Windows ALPC zero-days.

Proofpoint reports a previously undocumented exploit kit, BlueMoon, chains Chrome V8 type confusion CVE-2026-85046 with an unassigned V8 sandbox escape and Windows ALPC heap overflow CVE-2026-85880 to achieve code execution and local privilege escalation. APT31 first used it on August 28, 2026 against US NGOs, mining, and commodity trading firms, deploying the GemStone browser backdoor disguised as a Google Gemini extension via the GhostChrome-X integrity bypass. UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket followed on September 2-3, targeting US aerospace, Vietnamese manufacturing, and Indonesian/Singaporean sectors with ShadowPad and sideloaded Rust and .NET payloads. Both V8 flaws were patch-gap zero-days, and verbose code suggests possible AI-assisted development.

The Hacker NewsSep 9, 16:34 UTC · 7d agoThreat actor in the wild 2 sources CVE-2026-85046 CVE-2026-858801

Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated)

Trojanized 3CXDesktopApp installers for Windows and macOS loaded RC4-encrypted shellcode delivering a backdoor to hundreds of thousands of 3CX users.

Threat actors compromised the 3CXDesktopApp build process, adding malicious libraries (ffmpeg.dll, d3dcompiler_47.dll) to installers downloaded from the developer's website. The Windows MSI loader decrypts embedded shellcode with RC4, sleeps for a random 1-4 weeks, then beacons to C2 hidden in icon files on GitHub. Unit 42 fingerprinted 247,277 IPs across 199 countries using 3CX applications and blocked shellcode execution at 127 Cortex XDR customers between March 9-30, 2023.

Palo Alto Unit 42Aug 17, 12:18 UTC · Aug 17, 2026Threat actor in the wild1

Search: “in-the-wild”

A threat actor exploited 11 zero

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated)

Threat Actors Probe Gitea Docker Flaw CVE-2026

PhishLumos: Exposing phishing campaigns that evade detection by hiding content

APT28 exploits Microsoft Office flaw in Operation Neusploit

FileFix Campaign Using Steganography and Multistage Payloads

Week in review: 2 threat actors exploiting WinRAR 0-day, Microsoft fixes “BadSuccessor” Kerberos flaw

Microsoft pins on-prem SharePoint attacks on Chinese threat actors

Compromised SAP NetWeaver instances are ushering in opportunistic threat actors

Lazarus APT steals cryptocurrency and user data via a decoy MOBA game

Russia-linked APT29 reused iOS and Chrome exploits previously developed by NSO Group and Intellexa

Threat actors actively exploit D-Link DIR

Lazarus Hackers Exploited Windows Kernel Flaw as Zero

Log4Shell attacks expand to nation-state groups from China, Iran, North Korea, and Turkey

Multiple Nation-State actors are exploiting Log4Shell flaw

StrikeReady Recon now provides access to the most active campaigns targeting the Middle East

StrikeReady Recon assists organizations in protecting their mission-critical infrastructure and systems

Russian Shadow behind the Gamaredon 's Ukrainian MOD Campaign

ESET: Vietnamese hacking group hijacks Southeast Asian sites in watering hole campaign