Search: “tribes”

44 stories

Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.

CVE-2026-34486 is a fail-open regression in Tomcat's Tribes EncryptInterceptor, introduced while fixing the CVE-2026-29146 padding-oracle flaw; Apache rated it Important and NVD scores it 7.5 High. Decryption failures are now forwarded to an unfiltered ObjectInputStream, and public PoC repositories demonstrate unauthenticated RCE on default port 4000 when clustering, the EncryptInterceptor, a reachable receiver and deserialization gadgets are all present. Affected releases 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21; Tomcat 8.5 is unaffected.

Web discovery (articles for new exploits & KEV entries)Sep 8, 20:09 UTC · 8d agoExploit / PoC CVE-2026-34486 CVE-2026-291461

Ransomware attack disrupting Michigan's Sault Tribe operations

The RecordFeb 12, 21:21 UTC · Feb 12, 2025Ransomware

Ransomware gang threatens Cheyenne and Arapaho Tribes after shutting down schools

The RecordFeb 19, 15:03 UTC · Feb 19, 2026Ransomware

The DevOps and security tribes need to come together

CyberScoopOct 17, 15:00 UTC · Oct 17, 2016Exploit / PoC in the wild

Suspected Pakistani spies use catfishing, stealthy hacking tools to target Indian defense sector

CyberScoopMay 13, 17:03 UTC · May 13, 2021Data breach in the wild

New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Acronis links APT36 (Transparent Tribe) to new backdoors PATCHCORD and SHEETCORD targeting Afghan Telecom and Indian government, defense, and energy networks.

Acronis TRU described an ongoing Pakistan-aligned campaign attributed with moderate confidence to APT36, delivering a previously undocumented C/C++ backdoor named PATCHCORD via fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools. PATCHCORD persists by hijacking browser shortcuts for Chrome, Edge, and Firefox, registers with a single C2 server, and executes shellcode and arbitrary cmd.exe commands. Infrastructure analysis revealed SHEETCORD, a Go backdoor combining SHEETCREEP and PATCHCORD features that uses Google Sheets for C2 and a PowerShell-based remote execution, delivered via a fake site mimicking India's National Informatics Center. APT36 has used PATCHCORD since at least March 2026, including a variant with anti-analysis features used against India's energy sector, and the toolkit includes antnium, GateSentinel, SuperShell, and exploits for CVE-2024-6387.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Threat actor in the wildCVE-2024-6387

Threat Source newsletter (May 20, 2021)

Cisco TalosMay 20, 18:00 UTC · May 20, 2021Ransomware

IT threat evolution Q3 2020

Kaspersky SecurelistNov 20, 10:00 UTC · Nov 20, 2020Ransomware CVE-2020-0986 CVE-2020-1380

Threat Source newsletter (March 31, 2022) — Is "Fortnite" a Metaverse?

Cisco TalosMar 31, 18:00 UTC · Mar 31, 2022Ransomware

Researchers Uncover Cyber Espionage Operation Aimed At Indian Army

The Hacker NewsSep 30, 15:00 UTC · Sep 30, 2020Threat actor CVE-2017-11882

Industry steps up on IoT cybersecurity — is it enough?

CyberScoopSep 23, 09:30 UTC · Sep 23, 2016Exploit / PoC in the wild

⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack & Vibe

The Hacker NewsMar 9, 18:22 UTC · Mar 9, 2026Data breach in the wildCVE-2026-21385 CVE-2026-2796 CVE-2026-2256+13 CVEs

Talos Threat Spotlights

Cisco TalosApr 14, 00:00 UTC · Apr 14, 2022Ransomware in the wildCVE-2024-45771

Week in review: MFA effectiveness, SMBs and Win7 security, the quantum computing threat

Help Net SecurityOct 6, 00:00 UTC · Oct 6, 2019Ransomware CVE-2019-16928

From the NSA to Silicon Valley, a new kind of encryption is going commercial

CyberScoopJan 22, 15:07 UTC · Jan 22, 2019Exploit / PoC in the wild

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business NewsSep 7, 03:42 UTC · 9d agoPhishing & fraud in the wild1

APT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2

Acronis links the PATCHCORD espionage campaign targeting Afghan telecom and South Asian critical infrastructure to APT36 with moderate confidence.

Acronis Threat Research Unit documented PATCHCORD, a previously undocumented C/C++ backdoor delivered via fake VPN installers impersonating Afghan Telecom (AFTEL), which hijacks Edge, Chrome and Firefox shortcuts for persistence and executes in-memory shellcode. A related Go implant, SHEETCORD, abuses the Google Sheets API for per-victim C2 and was distributed via a domain impersonating India's National Informatics Centre, while a third tool, HACKERAI C2 Agent, uses GitHub Gists and shows signs of LLM-assisted coding. An exposed staging server revealed SuperShell, RAT frameworks, credential-harvesting tools and OpenSSH exploit code, and the researchers attribute the activity to APT36/Transparent Tribe at moderate confidence.