ShinyHunters: Six Years of Cybercrime — Expert Analysis and Ransomware Group Perspectives
SuspectFile reviews six years of ShinyHunters activity, but the excerpt lacks new incident details.
Stories per day · 30 days
311 RSS
5,889 stories, newest first · one card per story
Stories tagged #threat-actor
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Microsoft Threat Intelligence has observed Storm-2570, a ransomware affiliate linked to multiple ransomware payloads, using consistent tradecraft across deployments.
3
Operation Master: Deconstructing a Multi-Tiered Intrusion and Monetization Pipeline
SOCRadar exposes 'Operation Master,' an end-to-end cybercrime operation where a threat actor monetizes multi-tiered intrusions.
How tax policy can stop threat actors from breaching US water systems
State-backed threat actors are actively breaching US water systems and industrial infrastructure, with a 2024 incident causing water tank overflow in Texas.
2
AI Agents Are Rewriting the Rules of Lateral Movement
Security teams have traditionally treated movement between unrelated systems as a warning sign. An identity accesses a new environment, retrieves a credential, assumes a different role, or touches a resource it has…
2
CSuite Targets US and EU Organizations with Device-Code Phishing and Remote Access
CSuite targets US and EU organizations with device-code phishing and remote access. 60% of identified victims are US-based; 351 related sandbox analyses detected; 23 modules in the phishing panel.
4
GPT-6 Astra Breaks an Old Enigma Message
>A local user gains SYSTEM privileges and can run commands with them. The attack exploits elevated session IDs stored in a log file. The attack is also easy to carry out.
Critical MaxKB AI Agent Flaw Lets Prompt Injection Execute System Commands
A critical vulnerability in the MaxKB AI knowledge-base platform lets attackers execute OS commands via prompt injection, using the sandbox shell backend and elevated privileges; it can lead to remote code execution.…
Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)
Chinese-speaking threat actor exploited a vulnerability in unpatched ZyXEL switches (CVE-2026-7273) affecting 996 devices across multiple countries; the exploit was contained in June 2026 and is now part of a broader…
10
Jun Kim, oMLX creator and maintainer, joins Hugging Face to support the MLX community
An anonymous comment can run code if an admin opens the page, using a crafted link to install a theme and execute commands with admin access. These are stack-based buffer overflow vulnerabilities in CGI of Zyxel…
North Korea’s job interview scam runs both ways
North Korea's Contagious Interview group targets Rust developers with fake job scams to steal credentials and crypto, infecting 30,000+ devices.
2
BlackHatSect0r Hackers Disable AI Safety Controls to Automate Credential Theft and Cyberattacks
French-speaking crew BlackHatSect0r disabled AI agent safety controls to automate scanning, credential harvesting, and vishing, exposing 16,834 stolen credentials.
6
Discernment Deleted: Inside the Operation Server of BlackHatSect0r && DXQRTXX
SOCRadar analyzes the operation server of French-speaking crew BlackHatSect0r && DXQRTXX, revealing operators rewrote their AI agent's memory to read 'I am a weapon'.
Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours
Google's GTIG reports threat actors using autonomous AI agents, credential stealers, and LLMs to steal AI models, API credentials, and harvest thousands of credentials.
7
What We Missed: Did ShinyHunters 'Breach' ReliaQuest?
Dark Reading editors discuss whether ShinyHunters breached ReliaQuest and new research questioning the prevalence of AI-generated malware.
'Breeze Comet' Tears Into Brazilian & Global Financial Systems
Threat group 'Breeze Comet' is attacking Brazil's financial systems and reportedly stealing funds directly, per Dark Reading threat intelligence.
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off
Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.
RMM Tools for MSPs: Features, Risks & How to Stay Secure
Threat actors continue abusing MSP remote monitoring and management tools to reach downstream customers, four years after the Kaseya supply chain attack.
Insights into Suspected DPRK Workers
Huntress details incidents involving suspected DPRK remote workers (Famous Chollima) in partner environments and shares detection indicators.
US Sanctions Mabna Institute Hackers for Iranian Cyber-Attacks
US sanctions individuals tied to Iranian hacking-for-hire group the Mabna Institute over cyber-attacks.
UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
Cisco Talos tracks UAT-10147, a Chinese-speaking cybercrime group exploiting vulnerable web servers and using agentic AI in post-compromise operations.
1
Mark Zuckerberg Posts Deranged 6,500-Word Essay About Giving Everyone AI Superintelligence
2 min readthreat-actor
2
Russian military hackers pose as recruiters to target Ukrainian IT workers
3 min readthreat-actor
1
SMOKE#SCREEN Campaign Abuses ScreenConnect to Give Attackers Remote Control Access
6 min readthreat-actor
3