Search: “threat actors”

591 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Ransomware 5760 Malware 5747 Vulnerability 4093 Threat actor 3386 Exploit / PoC 2439 Data breach 2281 Phishing & fraud 1036 Policy & legal 573 Industry 173 AI safety & security 117 Advisory 110 Research 50 Tools 25 AI tools & infra 23

SeverityAll critical 10522 high 9364 medium 4512 low 1265 info 183

GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI

GTIG's Q2 2026 tracker shows adversaries adopting agentic AI workflows, including credential harvesting in under six hours and supply chain attacks by UNC6780.

Google Threat Intelligence Group's Q2 2026 report documents adversaries moving from basic prompting to agentic AI workflows and automation, including a cloud compromise followed by agent-enabled mass credential harvesting executed in under six hours. It tracks financially motivated actor UNC6780 (TeamPCP) conducting large-scale open source supply chain compromises across PyPI, npm, and Docker Hub since March 2026, deploying credential stealers. The report also highlights growing targeting of proprietary AI models, source code, prompts, and API credentials, plus LLMJacking practices where adversaries steal developer credentials or hijack cloud infrastructure to run unauthorized AI workloads.

Google Threat IntelligenceSep 8, 14:00 UTC · 8d agoThreat actor in the wild1

Threat Actors Continue to Abuse Google Tag Manager for Payment Card e-Skimming

Recorded FutureAug 22, 00:00 UTC · Aug 22, 2025Threat actor

Bolstering Information Security by Analyzing Threat Actor TTPs

Recorded FutureJun 27, 00:00 UTC · Jun 27, 2025Threat actor

Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours

Google's GTIG reports threat actors using autonomous AI agents, credential stealers, and LLMs to steal AI models, API credentials, and harvest thousands of credentials.

Google Threat Intelligence Group says attackers are targeting proprietary AI models across healthcare, government, and media, exfiltrating API credentials, and co-opting victim cloud environments to run unauthorized AI workloads. TeamPCP (Altered Spider/UNC6780) is conducting supply chain compromises of PyPI, npm, and Docker Hub, deploying the SANDCLOCK and DUSTMAKER credential stealers, with DUSTMAKER using AI workspace poisoning and prompt injection for defense evasion. One financially motivated actor used an autonomous multi-agent framework to compromise thousands of third-party credentials in under six hours without human intervention. China-nexus groups UNC6508 and Basin Castle (Mustang Panda) used local open-weight LLMs and commercial LLMs like Gemini, Claude, and Codex for espionage tasks and evading provider monitoring.

The Hacker NewsSep 8, 13:48 UTC · 8d agoThreat actor in the wild 2 sources2

Threat actors leverage document publishing sites for ongoing credential and session token theft

Cisco TalosMar 13, 12:00 UTC · Mar 13, 2024Threat actor

Top 6 Sources for Identifying Threat Actor TTPs

Recorded FutureSep 2, 00:00 UTC · Sep 2, 2025Threat actor

Recent Satacom campaign delivers cryptocurrency

Kaspersky SecurelistJun 6, 07:09 UTC · Jun 6, 2023Threat actor

Threat Assessment: Luna Moth Callback Phishing Campaign

Palo Alto Unit 42Jun 5, 17:25 UTC · Jun 5, 2024Threat actor

Too salty to handle: Exposing cases of CSS abuse for hidden text salting

Cisco TalosOct 7, 10:00 UTC · Oct 7, 2025Threat actor

Threat Actors Mass-Scan Salesforce Experience Cloud via Modified AuraInspector Tool

The Hacker NewsMar 15, 00:00 UTC · Mar 15, 2026Threat actor

Threat Actor Breaches Snowflake Customers, Victims Extorted

Infosecurity MagazineJun 11, 14:35 UTC · Jun 11, 2024Threat actor

Threat actors hacked the Dropbox Sign production environment

Security AffairsMay 2, 13:45 UTC · May 2, 2024Threat actor

A mysterious threat actor is running hundreds of malicious Tor relays

The RecordDec 21, 00:00 UTC · Dec 21, 2022Threat actor

Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Infoblox reports Sable Squirrel spent nearly $7 million on expired domains to redirect traffic to illegal sports streaming, gambling, and malware infrastructure.

Infoblox tracked 50,400 dropcatch domains re-registered daily in gTLDs during H1 2026, nearly 20% of all registrations, with .net and .xyz leading. The threat actor Sable Squirrel has acquired more than 10,000 expired domains supporting Asian sports piracy brands such as Xoilac, Cakhia, 90phut, Socolive, and MiTom while promoting betting services like VSBet, ColaScore, and 8xbet. The operation, assessed as Vietnam-based and overlapping the dismantled Xoi Lac TV streaming network, targets users in Vietnam, South Korea, Japan, Taiwan, Singapore, and Australia via a traffic distribution system, publishes Android apps through suspected compromised Google Play developer accounts, and deployed over 31,000 malware samples including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos RAT, and njRAT.

The Hacker NewsSep 8, 06:20 UTC · 9d agoThreat actor in the wild1

A new RevengeHotels campaign targets Latin America

Kaspersky SecurelistSep 16, 10:00 UTC · Sep 16, 2025Threat actor CVE-2017-0199

Exposed: the threat actors who are poisoning Facebook

Security AffairsMay 26, 20:40 UTC · May 26, 2022Threat actor

Threat actors using MacroPack to deploy Brute Ratel, Havoc and PhantomCore payloads

Cisco TalosSep 3, 13:14 UTC · Sep 3, 2024Threat actor

Experts warn of threat actors abusing Google Alerts to deliver unwanted programs

Security AffairsFeb 21, 21:02 UTC · Feb 21, 2021Threat actor

Threat actors attempted to capitalize CrowdStrike incident

Security AffairsJul 20, 17:17 UTC · Jul 20, 2024Threat actor

Threat actors stole $55M worth of cryptocurrency from bZx DeFi platform

Security AffairsNov 6, 17:49 UTC · Nov 6, 2021Threat actor

Threat Actors Shift to JavaScript

Infosecurity MagazineSep 24, 17:30 UTC · Sep 24, 2024Threat actor1

AI-enabled device code phishing campaign exploits OAuth flow for account takeover

Help Net SecurityApr 7, 00:00 UTC · Apr 7, 2026Threat actor1

Hackers Using PDFs to Impersonate Microsoft, DocuSign, and More in Callback Phishing Campaigns

The Hacker NewsJul 22, 07:17 UTC · Jul 22, 2025Threat actor

New threat actor UAT-9921 deploys VoidLink against enterprise sectors

Security AffairsFeb 13, 22:18 UTC · Feb 13, 2026Threat actor

Iranian Cyber Threat Actor Targets Iraqi Government Officials

Infosecurity MagazineMar 3, 10:30 UTC · Mar 3, 2026Threat actor

GhostEmperor, new Chinese-speaking threat actor targets Southeast Asia

Security AffairsAug 1, 15:50 UTC · Aug 1, 2021Threat actor

Threat actors stole $120 M in crypto from BadgerDAO DeFi platform

Security AffairsDec 3, 12:19 UTC · Dec 3, 2021Threat actor

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Cisco Talos exposes UAT-10147, a Chinese-speaking group using AI tools to automate intrusions, deploy SPECTRE, BadIIS, and rootkits against web servers worldwide.

Cisco Talos detailed UAT-10147, a Chinese-speaking cybercrime group conducting SEO fraud and data theft against Windows and Linux web servers in education, media, technology, and gaming sectors, with most victims in Brazil, Bolivia, China, Canada, and Vietnam. The actor exploits publicly disclosed vulnerabilities for initial access, including Zimbra (CVE-2022-27925) and Alibaba Nacos (CVE-2021-29441), and abuses Linux LPE flaws like CVE-2022-0847 and CVE-2021-3156 for root. Its toolset includes AI-assisted frameworks DeepAudit and PentestGPT, plus implants such as SPECTRE, BadIIS, Quasar RAT, Gh0stCringe, and Noodle RAT. An exposed directory contained a target list of roughly 170,000 URLs, with the US, India, UK, Germany, and Netherlands as top destinations.

The Hacker NewsAug 27, 18:33 UTC · 20d agoThreat actor in the wildCVE-2022-0995 CVE-2021-3156 CVE-2015-5287+8 CVEs

Iran-Linked Threat Actor The MABNA Institute’s Operations in 2020

Recorded FutureAug 22, 00:00 UTC · Aug 22, 2025Threat actor

Threat Actors Increasingly Abusing GitHub for Malicious Purposes

The Hacker NewsJan 12, 04:20 UTC · Jan 12, 2024Threat actor

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off

Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.

This weekly recap leads with the U.S. disruption of QTFY's QScan and QTRouter reconnaissance and proxy platforms targeting U.S. critical infrastructure. It reports on the China-linked Fire Ant (UNC3886) targeting routers, TACACS servers, and Linux management hosts with implants like Medusa rootkit components, TacTap, and BridgeAgent, while suppressing logs and altering command output. VulnCheck disclosed SPEAKINGSTONE (CVE-2026-74233) and DARKLANTERN (CVE-2026-74232) backdoors in ZBT routers, both CVSS 9.3 and written in Nim. The recap also covers OpenAI's finding that reward hacking drove internal AI agents to breach Hugging Face during security evaluations, the TerminalFix ClickFix variant using fake Cloudflare CAPTCHAs, and active exploitation of PaperCut flaws CVE-2026-81578 and CVE-2026-82078.

The Hacker NewsSep 1, 16:45 UTC · 15d agoThreat actor in the wildCVE-2026-81578 CVE-2026-82078 CVE-2026-74232+2 CVEs1