ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Arctic Wolf”

90 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 27Vulnerability 24Ransomware 23Threat actor 6Malware 5Phishing & fraud 3Policy & legal 1Advisory 1
SeverityAllcritical 72high 16medium 2low 0info 0

GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address

Arctic Wolf links new Go-based GoCaracal malware with Ethereum smart-contract C2 fallback to Dark Caracal, targeting a Venezuelan communications organization.

Arctic Wolf assessed with medium confidence that a June 2026 intrusion at an unnamed Venezuelan communications organization used GoCaracal, a previously undocumented Go-based malware framework linked to Dark Caracal. The lightweight profile provides encrypted C2, interactive shell access, and shellcode injection; the extended profile adds browser data theft, keylogging, WebRTC remote desktop, and SOCKS5 proxying. When the primary C2 server is unreachable, the malware queries an Ethereum smart contract via eth_getStorageAt at public JSON-RPC endpoints to fetch a replacement C2 address. Bandook was deployed in parallel, and Arctic Wolf published a YARA rule and indicators of compromise.

The Hacker News · 20d agoMalware in the wild1

Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback

Dark Caracal targeted a Venezuelan communications organization with new Go-based GoCaracal malware and an updated Bandook backdoor using Ethereum smart-contract C2 fallback.

Arctic Wolf Labs linked a June 2026 intrusion against a communications organization in Venezuela to Dark Caracal, an espionage group associated with Lebanon's General Directorate of General Security (GDGS). The group deployed a previously undocumented Go-based framework called GoCaracal in lightweight and extended builds alongside a Delphi-loaded Bandook backdoor, with delivery via phishing emails carrying weaponized SVG attachments through URL shorteners. The extended build uses a custom Solidity contract, BulletproofC2, on Ethereum to retrieve replacement C2 addresses without redeploying malware, and Arctic Wolf traced 249 related samples from January to July 2026 showing a modular evolution arc.

Security Affairs · 20d agoThreat actor in the wild

IT help-desk vishing tricks executives into handing over Microsoft 365 access

Arctic Wolf tracks PREY-0058 (linked to UNC6671), a vishing campaign stealing Microsoft 365 session tokens via AiTM panels for SaaS data theft and extortion.

Arctic Wolf is tracking a campaign, PREY-0058, sharing tradecraft with Google Threat Intelligence Group's UNC6671, in which callers posing as internal IT talk employees through fake passkey/MFA setups. Operator-controlled adversary-in-the-middle pages harvest passwords and MFA approvals to seize session tokens, then actors enumerate and bulk-exfiltrate data from SharePoint, OneDrive, Exchange, and Box. Extortion brands include BlackFile, Pink, Helix, Cinder, and Redact; targets are mostly US-based executives in construction, healthcare, real estate, finance, and professional services, with exfiltration shifting to residential proxies like NodeMaven.

Help Net Security · 8d agoThreat actor in the wild1

Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

Arctic Wolf tracks PREY-0058, a vishing and AitM token-theft crew targeting Microsoft 365 executives for data theft and extortion.

Arctic Wolf disclosed a widespread data theft and extortion cluster, PREY-0058, which overlaps with Mandiant's UNC6671 and possibly the Pink/Cinder extortion groups. Attackers impersonate IT help desk staff by phone, direct executives to authentication-themed lure domains, and run adversary-in-the-middle Microsoft 365 logins to harvest credentials, MFA approvals, and session tokens replayed via residential proxies such as NodeMaven. After access, they run discovery in SharePoint and Entra ID, then bulk-exfiltrate data from SharePoint, OneDrive, Exchange, and Box before sending extortion demands. Targets are primarily US construction, healthcare, real estate, finance, and professional services organizations.

The Hacker News · 9d agoThreat actor in the wild 2 sources1

Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities

Attackers exploit newly disclosed PaperCut auth bypass CVE-2026-81578 and RCE CVE-2026-82078 to steal credentials from schools and universities in the US and Europe.

Arctic Wolf observed threat actors chaining CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution) in PaperCut to execute commands, perform reconnaissance, and create privileged accounts on servers at K-12 schools and universities in the US and Europe. Post-exploitation includes registry hive collection with lsa_collect.exe delivered via certutil, Meterpreter Java payloads from 194.180.48.134, and searches of PaperCut config files for passwords, LDAP bindings, and tokens. Stolen logins could provide a pathway into other critical systems across compromised environments.

The Hacker News · 12d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-820781

PaperCut Flaws Exploited in Attacks on U.S. and European Schools

Attackers are chaining recently disclosed PaperCut flaws CVE-2026-81578 and CVE-2026-82078 to steal credentials and create privileged accounts at US and European schools.

Arctic Wolf researchers observed threat actors exploiting PaperCut servers via CVE-2026-81578 and CVE-2026-82078, chaining an authentication bypass with remote code execution. Post-exploitation included creating a privileged account named Administrator17, downloading credential-harvesting tools with certutil, Meterpreter Java payloads, and registry hive collection to recover the Windows BootKey and reach the SAM database. PaperCut disclosed active exploitation on August 27, 2026, and CISA added both flaws to its Known Exploited Vulnerabilities catalog on August 31. PaperCut has a history of exploitation, including attacks that delivered LockBit ransomware.

Security Affairs · 11d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-820781

PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.

A suspected Russian-speaking actor exploited the CVE-2026-81578 authentication bypass and CVE-2026-82078 RCE chain in PaperCut NG/MF, compromising at least 440 instances across 395 organizations in 48 countries, heavily targeting education in the US, UK, France, and elsewhere. The actor used hundreds of AI agents powered by OpenAI Codex and DeepSeek plus tools like Mimikatz, SharpHound, Certipy, Rubeus, and Impacket, reaching domain admin at 12 victims and full domain admin at a US high school within seven minutes. Post-exploitation included registry hive collection and Metasploit/Meterpreter payloads, with origin traced to IP 45.142.193.132.

The Hacker Newsupdated · 5d agofirst · 6d agoThreat actor in the wild 6 sourcesCVE-2026-81578CVE-2026-820781