Victims
Last 90 days
Priority Threats
Live Feed Last 24 hours
Data refreshes every 30 minutes.
Active IOC Feed
| IOC Value | Type | Malware / Family | Threat Type | Source | Confidence | First Seen | Ref |
|---|---|---|---|---|---|---|---|
57f4cdc0363e85d6542a2473eb252711dfc1667d6a2875d2c507fc817bced680
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
358346be7566fc2ffb13141eabc5af270a9e0e8f71fa99aebc6a5b5d6281a101
|
sha256 | js | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
2b27f573a2803501782484e855ed67d53d9c6bdba5e94172871fb91d9eb06780
|
sha256 | sh | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
9d5a4fcba60a9f9459570417411e8d4a90da4d274de8f352ef5d4ff6d50c2b9a
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
http://123.8.154.235:54627/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://27.215.81.133:43043/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://91.214.78.173:8080/bins/bot-mips
|
url | 91-214-78-173-8080, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://91.214.78.173:8080/bins/bot-arm7
|
url | 91-214-78-173-8080, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://91.214.78.173:8080/bins/bot-amd64
|
url | 91-214-78-173-8080, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
https://cloudruntime.courses/354b7637-d386-4074-8286-cbcc7ae1a08f/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
http://91.214.78.173:8080/d.sh
|
url | 91-214-78-173-8080, sh, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://115.49.208.50:60662/i
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://175.173.191.206:59847/i
|
url | — | malware_download | URLhaus | — | 2026-05-14 | |
https://packet-routing-lab.courses/f8dc7215-b51d-4762-b7cd-08a21b0bba3b/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
http://182.122.131.240:41588/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://123.8.154.235:54627/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://222.138.101.226:35477/bin.sh
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://115.53.243.30:49524/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://222.138.101.226:35477/i
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://115.48.163.93:39204/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://115.48.163.93:39204/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://182.122.131.240:41588/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://162.221.222.179:48314/bin.sh
|
url | — | malware_download | URLhaus | — | 2026-05-14 | |
https://microservicehub.courses/e9238b57-9112-46cd-a4ed-fa8a8cf04ec7/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
http://115.53.243.30:49524/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://221.14.37.195:36180/bin.sh
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://123.5.112.174:35968/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://42.58.18.164:43772/bin.sh
|
url | 32-bit, arm, elf, mirai, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
https://serverless-mesh-core.courses/848b17c1-37ea-4abf-a4ee-9c59c9a4f888/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
104.243.248.63:1806
|
ip:port | win.asyncrat | botnet_cc | ThreatFox | 75% | 2026-05-14 | 🔗 |
138.9.219.221:8015
|
ip:port | win.remcos | botnet_cc | ThreatFox | 75% | 2026-05-14 | 🔗 |
95.141.133.7:7443
|
ip:port | unknown | botnet_cc | ThreatFox | 75% | 2026-05-14 | 🔗 |
cloudruntime.courses
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
packet-routing-lab.courses
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
https://sup.dusapp.com.br/
|
url | win.vidar | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
sup.dusapp.com.br
|
domain | win.vidar | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
206.119.0.252:8884
|
ip:port | win.vshell | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
206.119.0.249:8884
|
ip:port | win.vshell | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
206.119.0.251:8884
|
ip:port | win.vshell | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
https://evamotion.com/
|
url | unknown | payload_delivery | ThreatFox | 90% | 2026-05-14 | 🔗 |
best-seller.lavanille.buzz
|
domain | win.cobalt_strike | botnet_cc | ThreatFox | 50% | 2026-05-14 | 🔗 |
attachment-storage-asset-static.needbinding.icu
|
domain | win.picasso_loader | botnet_cc | ThreatFox | 50% | 2026-05-14 | 🔗 |
book-happy.needbinding.icu
|
domain | win.picasso_loader | botnet_cc | ThreatFox | 50% | 2026-05-14 | 🔗 |
nama-belakang.nebao.icu
|
domain | win.picasso_loader | botnet_cc | ThreatFox | 50% | 2026-05-14 | 🔗 |
easiestnewsfromourpointofview.algsat.icu
|
domain | win.picasso_loader | botnet_cc | ThreatFox | 50% | 2026-05-14 | 🔗 |
mickeymousegamesdealer.alexavegas.icu
|
domain | win.picasso_loader | botnet_cc | ThreatFox | 50% | 2026-05-14 | 🔗 |
hinesafar.sardk.icu
|
domain | win.picasso_loader | botnet_cc | ThreatFox | 50% | 2026-05-14 | 🔗 |
shinesafar.sardk.icu
|
domain | win.picasso_loader | botnet_cc | ThreatFox | 50% | 2026-05-14 | 🔗 |
microservicehub.courses
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
serverless-mesh-core.courses
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
1y9a9xkq.bitter-salty.digital
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
p4l3fctz.bitter-salty.digital
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
91.215.85.121:8848
|
ip:port | win.dcrat | botnet_cc | ThreatFox | 75% | 2026-05-14 | 🔗 |
129920ec14a26075d60b2c7cd717067460b4a201d8ee775036a9975364d6b388
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
1f1b8eeb3b796743977fa1427422f05a636dc3b16f5f71ff44740de7461a819e
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
53b1fda699801c9de8888444132062ebeea7698b6e9b4c670dbbf5591a08962d
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
9f47d69c21e6131b0055331232c3e8f6fbdead4ff6e2c50c71ebbebb8cf3feaa
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
503205ff7ccad32d1286c98c5dfdb1731a4cf881d7539eb84e5d7e9a55c66f11
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
0d271ecf2ec206ecd419bc43cc7a57291d3542763c957646883bc97aad9240ff
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
4b492c9bcd6fb439206027ac7b5250fbf0b3bbc56d4dde28477589413b126ed9
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
1316a7a0bef67ed870bf9c15a60461b2774e28a2219d815378b89bbdb99935c3
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
ea54d5bf0258daaca1b6c1cc5e31335bafe4c402fee264e159cdb6a72da6b8f5
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
bc228da3d90ff1974d9d4d11ea8bac700567427a5b3e85b9ee84c484b4a3f079
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
25ec24e0b0130b7c6042e21ead1c7407fca85d4bbe80393e506e64366474ea7c
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
f7f01b7578e96c7745d3752384a32b8aaab1100353d90183d45c867173902664
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
b70205e17ba18a88089e41ea3b0ae890b47a5e25596dcbc467d00866aa5a93e7
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
73f6ca608570362be180d6d4c5cbded8e8f3de9fc4fae43ade4697522273155e
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
f3c98a3f47639b69968e75c99a87fdbee9e7aa910997f85bf01417bcbfbf77aa
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
20c686f849df9dd452ec0a2eaf19225341607b886d42b454ece270ae32dd4470
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
6f90f1f5a4b13bbb2280245cd86ecc3d2d916d91d3a497d902702ae8b7c455a7
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
07e0f63403ff2161e1fd30f5a5027f9d2e566f2ae301b3a945294155d036695c
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
1f79b7fbb4dc5efda34246c5703b2cbb07424d77762a312d716ec5881655ebfc
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
31598947ad76c55e0c4f159925e74c3813d09e3080e1f5b5c7963b5ee7a69ada
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
04e390688d9f52d33c25e7e0bf6b5068ee47411f67a16fbf2224a5b9b72372c4
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
a2dc1a576ef43b335e3dfc2ae905d5dcd4997ae3b3c18a47d9bf3ea4f9c77d58
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
8e247f24515a0caf92ac8205556c9b84ef18bac4fa6a662c3d7d49b47322b72b
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
12975876ab7d54b7d120a35569f3d9e0140ae7b803fe81dfa69f4982683d3dad
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
4f3efcfcfc24df90f64118a2fea1de5bb50f1a55a843841f071eda1f9d3ce672
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
c9e164b96ba7916e6ab6c5ad4f94c11858a72c495b81de2cd64c3dbf543b2cb3
|
sha256 | sh | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
a592a83e5773dbea9bbbe10f7fdeb9aeed07e077e0fac85b0bcd1d8e485dac0e
|
sha256 | sh | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
https://212.232.22.81/Bin/ScreenConnect.ClientSetup.exe
|
url | 212-232-22-81, connectwise, exe, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://176.65.139.177/bot.m68k
|
url | elf, m68k, mirai, opendir, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://110.38.223.172:60712/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://27.37.84.228:34846/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://112.239.97.62:43725/bin.sh
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
https://coder-logic-vault.courses/0afb7780-04e8-40be-b342-45a8dd51c61e/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
http://115.49.208.50:60662/bin.sh
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/7
|
url | 64-89-163-218, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/axis.x86_64
|
url | 64-89-163-218, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/axis.mips
|
url | 64-89-163-218, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/8
|
url | 64-89-163-218, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/axis.ppc
|
url | 64-89-163-218, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/5
|
url | 64-89-163-218, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/11
|
url | 64-89-163-218, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/axis.x86
|
url | 64-89-163-218, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/2
|
url | 64-89-163-218, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/3
|
url | 64-89-163-218, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/1
|
url | 64-89-163-218, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/axis.sh4
|
url | 64-89-163-218, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/axis.arm6
|
url | 64-89-163-218, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/10
|
url | 64-89-163-218, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/axis.arm7
|
url | 64-89-163-218, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/6
|
url | 64-89-163-218, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/axis.arm5
|
url | 64-89-163-218, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/9
|
url | 64-89-163-218, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins/axis.mpsl
|
url | 64-89-163-218, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/loader.sh
|
url | 64-89-163-218, sh, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/bins.sh
|
url | 64-89-163-218, elf, mirai, sh, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/1.sh
|
url | 64-89-163-218, elf, mirai, sh, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/b.sh
|
url | 64-89-163-218, elf, mirai, sh, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/d.sh
|
url | 64-89-163-218, elf, mirai, sh, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
https://sup.fatherchrismas.com/
|
url | win.vidar | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
sup.fatherchrismas.com
|
domain | win.vidar | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
1439913d6d2fde1e73eed936da25933f5cab5890aa98f99124e0f36d1e1d1472
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
b437a764869ac93e13448746c789757541d6ab3675592ceca3315d6ec1ef8086
|
sha256 | sh | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
417759d58ed424b4a6af6be1472107b959b8125b9a3fa1e0b6072f76849cf180
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
4f20681b24c041a10ed71ea49b0859e486cada3381ed16372e8e3cb6e9af8d62
|
sha256 | AsyncRAT | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
https://46.151.182.208/bin/support.client.exe
|
url | 46-151-182-208, connectwise, exe, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
https://46.151.182.208/Bin/ScreenConnect.ClientSetup.exe
|
url | 46-151-182-208, connectwise, exe, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://156.238.242.196/bins/linux_mips_hardfloat
|
url | elf, mips, mirai, opendir, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://156.238.242.196/bins/manji.x86
|
url | elf, mirai, opendir, ua-wget, x86 | malware_download | URLhaus | — | 2026-05-14 | |
http://218.24.16.123:49959/i
|
url | — | malware_download | URLhaus | — | 2026-05-14 | |
http://112.248.191.168:54211/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://221.13.248.82:42225/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
https://130.12.181.111/Bin/ScreenConnect.ClientSetup.exe
|
url | 130-12-181-111, connectwise, exe, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://116.140.2.94:46035/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://219.156.178.218:42176/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://125.43.225.65:53092/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://110.36.19.51:35149/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://81.29.156.127/ppc64
|
url | 81-29-156-127, DDoSAgent, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://81.29.156.127/mipsel
|
url | 81-29-156-127, DDoSAgent, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://81.29.156.127/mips
|
url | 81-29-156-127, DDoSAgent, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://81.29.156.127/x86
|
url | 81-29-156-127, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://81.29.156.127/i686
|
url | 81-29-156-127, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://81.29.156.127/armv5l
|
url | 81-29-156-127, elf, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://81.29.156.127/armv6l
|
url | 81-29-156-127, elf, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://81.29.156.127/armv7l
|
url | 81-29-156-127, elf, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://182.126.183.211:52352/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://182.126.183.211:52352/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://123.4.44.212:49087/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://130.12.182.175:8080/21.exe
|
url | 130-12-182-175-8080, exe, Tofsee, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://125.43.225.65:53092/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://123.4.44.212:49087/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
https://masteringdigital-arch.courses/851ed414-d2ca-4b11-a466-a9f58b025cc8/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
http://42.227.177.133:54013/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://110.38.201.35:46732/i
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://125.46.215.186:38346/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://123.5.152.185:45274/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://61.243.140.9:60983/i
|
url | — | malware_download | URLhaus | — | 2026-05-14 | |
http://123.5.152.185:45274/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
https://quickwebdevops.courses/1e815954-32e3-4c4c-8e1a-c1ee19b912e6/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
https://enterprise-security-log.courses/0281b943-135c-4e7e-a18f-3a0caed9eff6/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
http://200.115.102.14:42192/i
|
url | 32-bit, arm, elf, mirai, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://60.18.56.21:39045/bin.sh
|
url | — | malware_download | URLhaus | — | 2026-05-14 | |
http://60.18.56.21:39045/i
|
url | — | malware_download | URLhaus | — | 2026-05-14 | |
https://advanced-it-infrastructure.courses/f8c73b68-f542-4300-a89e-6d1778c42196/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/x.sh
|
url | 64-89-163-218, elf, mirai, sh, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://64.89.163.218/lol.sh
|
url | 64-89-163-218, elf, mirai, sh, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://27.215.81.133:43043/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
https://coder-logic-vault.courses/7e533182-9ac1-48de-8948-ec74b0f1aee9/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
ws09ax4h.limous-nitout.digital
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
jmlzwn2l.limous-nitout.digital
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
expert-trading-academy.courses
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
172.233.38.244:25001
|
ip:port | apk.kimwolf | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
172.235.191.18:25001
|
ip:port | apk.kimwolf | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
172.235.191.229:25001
|
ip:port | apk.kimwolf | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
38.244.38.42:80
|
ip:port | unknown | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
66.154.104.204:8084
|
ip:port | win.vshell | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
118.31.62.238:80
|
ip:port | win.cobalt_strike | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
coder-logic-vault.courses
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
41.98.219.186:1177
|
ip:port | win.njrat | botnet_cc | ThreatFox | 75% | 2026-05-14 | 🔗 |
46.253.143.52:8080
|
ip:port | win.adaptix_c2 | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
46.253.143.52:80
|
ip:port | win.adaptix_c2 | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
46.253.143.52:443
|
ip:port | win.adaptix_c2 | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
154.213.180.50:10000
|
ip:port | win.vshell | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
103.75.190.47:49152
|
ip:port | win.vshell | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
advanced-it-infrastructure.courses
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
sd9arw2r.flos-strip.digital
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
3az65saf.flos-strip.digital
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
https://whbackend.ru/files/jar/elevator
|
url | unknown | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
https://whbackend.ru/files/jar/module2
|
url | unknown | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
https://whbackend.ru/files/jar/component
|
url | unknown | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
https://whbackend.ru/files/jar/RuntimeBroker.exe
|
url | unknown | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
https://whbackend.ru/files/jar/Pjibf.exe
|
url | unknown | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
https://whbackend.ru/files/jar/security
|
url | unknown | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
https://whbackend.ru/files/jar/module
|
url | unknown | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
https://remotev2.whbackend.ru/ws/client
|
url | unknown | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
remotev2.whbackend.ru
|
domain | unknown | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
enterprise-security-log.courses
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
whbackend.ru
|
domain | unknown | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
quickwebdevops.courses
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
45.138.16.182:8080
|
ip:port | unknown_stealer | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
vanta.st
|
domain | unknown | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
http://latiendadelafelicidad.com:5200/
|
url | win.remus | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
154.213.180.27:10000
|
ip:port | win.vshell | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
8.137.157.249:8085
|
ip:port | win.vshell | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
47.110.87.212:9999
|
ip:port | win.vshell | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
38.244.38.42:8080
|
ip:port | unknown | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
118.31.62.238:8080
|
ip:port | win.cobalt_strike | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
latiendadelafelicidad.com
|
domain | win.remus | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
172.235.173.185:25001
|
ip:port | apk.kimwolf | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
system-analytics-pro-guide.courses
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
172.235.173.105:25001
|
ip:port | apk.kimwolf | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
172.233.40.153:25001
|
ip:port | apk.kimwolf | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
0x295bae89192c32.com
|
domain | unknown | botnet_cc | ThreatFox | 50% | 2026-05-14 | 🔗 |
masteringdigital-arch.courses
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
logic-buffer-skills.courses
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
e9e15953ad2b9424d4bb72097bdb5d993bfec22f19797c739ef7eb2bd87783c9
|
sha256 | chm | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
a55a560802bea130e690d55e0ea059bd8eb1657ae2cdfdafaf6e3413413fa2d6
|
sha256 | chm | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
http://123.9.242.177:40138/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://115.57.181.25:42778/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://42.237.56.4:50021/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
https://smartworkflowmanagement.courses/db517e21-2d05-4ee9-960d-670ce7fe4cbd/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
http://222.136.153.49:43357/i
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://110.39.249.174:34779/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://116.140.2.94:46035/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://123.9.242.177:40138/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
smartworkflowmanagement.courses
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
df77fa417aee26c656609dfb92a3f982dc70077e24de46915bb0360b40bd837a
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
http://140.237.44.205:56557/i
|
url | 32-bit, arm, elf, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://113.229.119.138:46079/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://123.5.174.131:55099/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
https://pro-cyber-defense.courses/655a1817-12cf-47d9-ae92-6a7092e43547/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
http://182.121.109.8:32975/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://123.5.174.131:55099/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
https://pro-cyber-defense.courses/b6b778a2-9a7b-4b46-84c1-822dfdda5a21/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
https://obese-table-usweb-play.wiki/b7f892e0-e5c3-4e36-9aa6-26e0daecc724/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
http://42.238.170.120:33629/i
|
url | — | malware_download | URLhaus | — | 2026-05-14 | |
38.60.253.35:80
|
ip:port | win.vshell | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
obese-table-usweb-play.wiki
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
pro-cyber-defense.courses
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
38.190.198.12:8084
|
ip:port | win.vshell | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
a13224ad7037a6fdadde2373f83dd0a35ad9afdb888544c529720d3fbababbc2
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
5fb830acf3046ba7152112c03a62f85feeef592dee7bdbecd41c9d40e38dc203
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
8549cad41837c921ad75b6a84e1dca4b53850694cd637102cdcd5fd7a6b1fa2e
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
03f18e137625b7f7ee2b53b70a37474b5674080aab67a7298f909af621d1c866
|
sha256 | NanoCore | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
135607be3db66b1e5d6894ac1e8a02c81acbb99491b542840df6ec3299bf0822
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
69f5515ff3f554233840ad2f2397b345f955013017a9ae14ed4e762f52d936af
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
bddf223ac334758b8373de1b46ab12c80032c9b141d972681dd2fd9b14b27bce
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
4209b66b89a5c71726b5fbadc8e3ce04ea92d935143170fd25c8928bd1fcdf50
|
sha256 | NanoCore | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
913e879e80d3e3dcf8341c43145ed5f6a85d1cdd2d3e0b5c006788dba6d2dc7c
|
sha256 | NanoCore | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
9cf20bbcb95106f2a5b8cdb1d9586adbeb8b3ebf356c2d4dea6f77dcfe8f3477
|
sha256 | NanoCore | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
http://219.156.101.252:38613/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://222.136.153.49:43357/bin.sh
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://112.239.97.62:43725/i
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
https://layer-obs-usget-tron.wiki/62622778-096e-4c6b-abd0-0fc14d34237c/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
http://112.242.22.75:51862/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://42.239.153.29:37445/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
https://layer-get-win-tron.wiki/a99f888b-41bd-4e51-bcc0-653742cd92a8/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
http://112.242.22.75:51862/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://222.139.36.21:34142/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
https://card-oracle-mac-laptop.wiki/aeb4036d-536c-40b9-b8ab-9f8a2ef9cec5/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
https://212.232.22.81/bin/support.client.exe
|
url | 212-232-22-81, connectwise, exe, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
layer-obs-usget-tron.wiki
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
bigsolutionsgc.com
|
domain | win.remus | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
sahalexchange.com
|
domain | win.remus | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
revvedupnet.com
|
domain | win.remus | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
brullercorp.com
|
domain | win.remus | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
iasolopreneur.com
|
domain | win.remus | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
layer-get-win-tron.wiki
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
123.57.106.8:33972
|
ip:port | win.vshell | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
38.244.38.42:60000
|
ip:port | unknown | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
38.244.38.42:443
|
ip:port | unknown | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
ywh94lky.champag-mannered.digital
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
jpfwdwpz.champag-mannered.digital
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
card-oracle-mac-laptop.wiki
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
4b7a0879cf0a7ab62b248281e4075ada4988501fe8e5c6fb7b42d79e1e5b2a8a
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
5274bee0128b0dda0c02dbe44bc195ab77999283104cbdbb97106d041dc1ff01
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
http://27.207.241.68:58150/i
|
url | — | malware_download | URLhaus | — | 2026-05-14 | |
https://www.terramarketgroup.com/
|
url | unknown | payload_delivery | ThreatFox | 90% | 2026-05-14 | 🔗 |
https://www.alfonsocerreti.it/
|
url | unknown | payload_delivery | ThreatFox | 90% | 2026-05-14 | 🔗 |
https://eternalchess.com/
|
url | unknown | payload_delivery | ThreatFox | 90% | 2026-05-14 | 🔗 |
https://cmvpl.com/
|
url | unknown | payload_delivery | ThreatFox | 90% | 2026-05-14 | 🔗 |
31ab874b463588727ebd9635124f3f02125c87b6cb93dd348bf2f60d0d12ac1b
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
https://handout-voivo-desk-ship-link.wiki/15ce3a08-7c9c-4292-b549-6f4bc27fb873/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
https://master-voivo-system-shop-slink.wiki/7ba6e339-50bb-4db5-b1f8-2bc8118b7b23/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
http://41.216.188.223/files/admin/ClipClap.exe
|
url | exe | malware_download | URLhaus | — | 2026-05-14 | |
http://108.170.136.155:59643/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://162.141.92.192/arm
|
url | elf, moobot, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
handout-voivo-desk-ship-link.wiki
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
77.90.51.233:443
|
ip:port | elf.mirai | botnet_cc | ThreatFox | 75% | 2026-05-14 | 🔗 |
static.alfreshup.com
|
domain | js.fakeupdates | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
185.203.39.71:8853
|
ip:port | unknown | botnet_cc | ThreatFox | 75% | 2026-05-14 | 🔗 |
185.203.39.71:7070
|
ip:port | unknown | botnet_cc | ThreatFox | 75% | 2026-05-14 | 🔗 |
6hndc.com
|
domain | unknown | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
l1.topayapp.org
|
domain | unknown | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
158.94.209.207:57872
|
ip:port | unknown | botnet_cc | ThreatFox | 75% | 2026-05-14 | 🔗 |
158.94.209.207:58827
|
ip:port | unknown | botnet_cc | ThreatFox | 75% | 2026-05-14 | 🔗 |
75.119.154.8:8808
|
ip:port | win.asyncrat | botnet_cc | ThreatFox | 100% | 2026-05-14 | 🔗 |
5.230.201.146:5003
|
ip:port | unknown | botnet_cc | ThreatFox | 75% | 2026-05-14 | 🔗 |
master-voivo-system-shop-slink.wiki
|
domain | js.clearfake | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
833a0e0ed8bc34a1af0fbb43c56f7bea2c73dde2295f4df2e2c27011d70f52fa
|
sha256 | zip | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
a8b208b931f88bf8bc1d2fb6d7c069dd9221a113a0c760428eb177e322c8aaa4
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
500b9d6ee3192a79d387f8322d0c1e2c6a3d175eb17c599de0eab9108f9f5de3
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
e6483ecd2e263e5cb67b7e8c9c0c9ba8c0f389152b7e81e30d0eaa41bc071ebb
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
60ca5fc1dbf606dccb5bb39bd3d886ba8122a9006558eecda848930a454f32f3
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
1411c4c559644f98145acbc86325b60f4be944d5deddac2c9995cdd4c0ceeb93
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
8bff0e268e72794a1f8f583d4de731b77ec809f45560e0eec34d59c4d9b6a8d1
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
9c841796f660355e6d516fc6cef6f101e40d1cf41067c4a1d9b0dea13fa1b30f
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
30a944907d868d2f820cf2e8f569ef6271cedbb2c44dd20decc9d7b3f6b4fc42
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
ccff4653ff6519f2083c22b877a28e33f7bb73a5af6b6043170666958095f3a6
|
sha256 | SalatStealer | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
683e886963d1644a6369652d94410c1fdde649108821860fbdca00eb97a12508
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
f5286c639c299102c296f129dd23d814615f98e71d03f7853e43e901c400ff55
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
5f5f33d963ef205ea5ccf35dd75105c99572dba9ec8ed66d8268481ad56f274d
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
9fbf6e1bd7ca3922c017491ef52ffa8c123084e231021e7610942f65303c86b2
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
8e982c2dda21e95c9f6d58774cc34f61962d7a83a606904c6123920f5624aab9
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
0bd46b20aee11ffba45eefd514e8706cef747e8856237bf4af0282a3504c37bd
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
37cd2dedf46cd8a98a917b92b9a141e7e84c82312b0fb07c0c6c31ab47e538b2
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
2a6805cb595d2ba98ec779dc127a3e7f86a89b75172ee5bc0486394e5622ecb6
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
a287341f1aeb319a71d9e0b029ce2b007b97ac93889abe69813f537a0f2c9a9e
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
http://94.156.152.234/bot.arc
|
url | elf, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://94.156.152.234/bot.m68k
|
url | elf, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://94.156.152.234/bot.sh4
|
url | elf, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://110.167.74.66:33448/i
|
url | 32-bit, arm, elf, mirai, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://176.65.139.161/iran.armv5l
|
url | elf, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://94.156.152.234/bot.aarch64
|
url | elf, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://94.156.152.234/bot.mipsr
|
url | elf, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://94.156.152.234/bot.powerpc
|
url | elf, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://110.37.53.25:53775/bin.sh
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://83.217.208.211/files/big.exe
|
url | 83-217-208-211, exe, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
https://master-core-system-date-slink.wiki/6717bd2a-2cb6-4d1c-94fa-369d8db4a3e9/google.cl
|
url | ClearFake | malware_download | URLhaus | — | 2026-05-14 | |
http://219.71.131.225:40182/i
|
url | 32-bit, arm, elf, mirai, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://150.40.126.53/bins/rcuop_0
|
url | 150-40-126-53, elf, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://156.238.242.196/bins/manji.sh4
|
url | elf, mirai, opendir, SuperH, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://42.87.156.224:45818/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://176.65.139.177/bot.mipsel
|
url | elf, mips, mirai, opendir, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
qiig7t2nzog.com
|
domain | js.kongtuke | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
https://qiig7t2nzog.com/d
|
url | js.kongtuke | payload_delivery | ThreatFox | 100% | 2026-05-14 | 🔗 |
45.192.219.138:443
|
ip:port | win.ghost_rat | botnet_cc | ThreatFox | 50% | 2026-05-14 | 🔗 |
144.31.123.157:443
|
ip:port | win.ghostsocks | botnet_cc | ThreatFox | 75% | 2026-05-14 | 🔗 |
mas.uk.net
|
domain | win.quasar_rat | botnet_cc | ThreatFox | 75% | 2026-05-14 | 🔗 |
185.99.255.17:80
|
ip:port | apk.ermac | botnet_cc | ThreatFox | 75% | 2026-05-14 | 🔗 |
217.60.241.17:8080
|
ip:port | win.tofsee | botnet_cc | ThreatFox | 75% | 2026-05-14 | 🔗 |
f76ea661fa050e2198e2a54aec00c24a9e4a8b54e2264ee458a04343ec6c6460
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
9347c058bb6f40a699fc045feb9d56382513832f03ff1806c2de36de3f4a442f
|
sha256 | xls | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
882903a1cee7804fdc607853cc9e55e17534c658fa20100a63dffb0a30b7ee5f
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
01da321b6f411f6ffcf3e8940eee85af6eae509763ad4840c6c26b7da10de07d
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
f98076654c6eeddd06a769bda19f30b89ab7fc0f759b95a495a1267001f5a8c2
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
beea94b8354c143732dba555c69097d42d42b960af644b038cc3ba46ef877d64
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
c4e4085c85a398ae4b50c00ea3d6d71786c36ab090e011e5a012a117dab71662
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
6b8b21d4f66549ac52afc30837731ea8d1fc57b58b52f3b23542f05008135336
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
22b502b08268e7456fb021aa970ab1c36c706c411a8f43ab0420636845bee395
|
sha256 | ConnectWise | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
8b40a7652af4b2195f37dc49682d459f791b94fba7aa5a193892412f60aa13c5
|
sha256 | sh | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
fb5aff6d737ab1bda82cbfaf4d73c612026f3cbc7321ddc44cffa899de2a6daa
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
bb8c834d4066f900b01783087299e5da97ee27ac1d6a09bd7c231eabc2b77569
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
1b8a000dc510563fac3f4084727d6fc53736f4b4425137651c426d8d44291a4b
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
2cec1784a799f5b5953eaf1ab81be78b3b01a8803b11ffb34b497e9abc09a372
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
a43b3acee42de96b27a990e9c19b6fd7081d73c3e0516fc77de3bf4153f077e7
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
eebad34642be1e5256c715ab3746d4a67a7d3ee8685b6055a0f1a45744ce9e56
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
4d515501de5304db50daeb0bc151326a940d6a19ff7911a298ba666c5aa9a499
|
sha256 | sh | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
ab7bf496e32643527f16b2e424af5b7edb75f89bca7ab0bdb875d6534a9ccd70
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
423d6172df1acc2ef2ea751ef28727a2589a1677f08d666e4d553e06600284a2
|
sha256 | ConnectWise | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
5739b9652302bf52b2dea790956581dba814d9750643e29b1cd829f4a6e24d2a
|
sha256 | ConnectWise | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
9bb75b8ff8cf75c4f203c6572ee9cf65125d9b659f3f3aa4b0e1ece717a495e5
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
5d21ddaa89883041716417e15c840f6146c9d9d15f38ce97109aeafd8b12022e
|
sha256 | msi | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
3b1b289f81132244d9aa0702967464db3b99f296141faee92f30e66c20707b0f
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
c2253567a3f2d21e6967ccde19dd2dbaede5da54a46eb872c68a732358a81796
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
1080a64f454e01a3e5b59aced1413d72148223604923ad1fc8bd22372b3cc8f9
|
sha256 | exe | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
6d9fcd1b3561b2aea68f18825e9b0e8b804bcc3cd12c75f03f793acc255675b5
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
5d7918225442451dd8b9d685cf4e61e0128a49d31a33027bf57a7ddff5d16812
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
14c1d6d39878896f5835960e9c2c9c9058f81201236c4003f0ccbe269b4b41db
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
b4400659a6dd40962ec00446ece5fbec3094ac8576f77bba15e464258d83784c
|
sha256 | elf | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
d72cb6182e844f8364c0112659cdc82f1fc405179a1810846896269633ac18df
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
45e3ced4a54c9f4c38ae7f36c50e1ea6ccdc09ad0594f0353b34b857314db72f
|
sha256 | vbs | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
4fbef1d0d9d4673d1256e875ab9e45151f932aff093bf5030bf3d2d784d63150
|
sha256 | DDoSAgent | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
06ac500275281828fb427d399463d0442e08cee3744137e0f8bf61e13c1b78e1
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
3312af307463d657e729cd5e466e0dfbb2e13969458547492b51a04b67caa494
|
sha256 | Mirai | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
e8318d2c5023d9b1a29b20918610d7625ba04e58dfe1fc5da51aeac65dbdff9d
|
sha256 | xlsx | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
e0149c0c3476c97e13ab5f4d656ad0b53ba45dea1b3f8fdaf51d0e4ef5db2aa9
|
sha256 | xlsx | Malware Sample | MalwareBazaar | — | 2026-05-14 | 🔗 |
http://156.238.242.196/bins/ARMV4L
|
url | arm, elf, mirai, opendir, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://156.238.242.196/bins/manji.ppc440
|
url | elf, mirai, opendir, PowerPC, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://156.238.242.196/bins/ARMV6L
|
url | arm, elf, mirai, opendir, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://156.238.242.196/bins/linux_ak.sh
|
url | opendir, sh, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://156.238.242.196/bins/manji.arm5
|
url | arm, elf, mirai, opendir, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://156.238.242.196/w.sh
|
url | opendir, sh, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://156.238.242.196/bins/manji.mips
|
url | elf, mips, mirai, opendir, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://60.211.105.231:33275/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://182.121.215.49:58921/bin.sh
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://162.141.92.192/x86_64
|
url | elf, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://162.141.92.192/mipsel
|
url | elf, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://162.141.92.192/arm7
|
url | elf, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://182.116.39.138:49602/i
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://162.141.92.192/arm5
|
url | elf, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://222.137.86.183:57761/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://110.36.80.162:54927/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://42.52.194.3:40757/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://182.116.39.138:49602/bin.sh
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://60.211.105.231:33275/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://116.149.146.119:46205/i
|
url | 32-bit, arm, elf, mirai, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://94.156.152.234/selfrep.sh
|
url | mirai, opendir, sh, ua-wget | malware_download | URLhaus | — | 2026-05-14 | |
http://110.38.221.182:46486/bin.sh
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://110.39.237.192:40532/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://116.149.146.119:46205/bin.sh
|
url | 32-bit, arm, elf, mirai, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://27.210.35.32:36830/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://219.157.159.219:57032/i
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://42.87.156.224:45818/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://115.55.31.109:50067/i
|
url | — | malware_download | URLhaus | — | 2026-05-14 | |
http://27.210.35.32:36830/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://171.39.12.170:54831/i
|
url | 32-bit, arm, elf, mirai, Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://61.52.106.147:34515/i
|
url | Mozi | malware_download | URLhaus | — | 2026-05-14 | |
http://115.55.31.109:50067/bin.sh
|
url | — | malware_download | URLhaus | — | 2026-05-13 | |
http://42.224.65.149:38218/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://42.224.65.149:38218/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://222.137.75.23:41212/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://221.13.149.86:41083/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://222.137.75.23:41212/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://221.13.149.86:41083/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://175.175.55.124:46567/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://222.139.32.25:46329/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://42.55.139.100:53832/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://42.224.67.26:35749/i
|
url | Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://42.239.150.156:57296/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://182.122.239.203:47211/i
|
url | mirai | malware_download | URLhaus | — | 2026-05-13 | |
http://42.239.150.156:57296/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://110.36.12.61:47712/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://42.224.67.26:35749/bin.sh
|
url | Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://176.65.139.177/bot.arc
|
url | arc, elf, mirai, opendir, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://176.65.139.177/bot.armv6l
|
url | arm, elf, mirai, opendir, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://176.65.139.177/bot.powerpc
|
url | elf, mirai, opendir, PowerPC, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://176.65.139.177/bot.aarch64
|
url | arm, elf, mirai, opendir, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://176.65.139.177/load.sh
|
url | opendir, sh, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://176.65.139.177/bot.armv7l
|
url | arm, elf, mirai, opendir, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://176.65.139.177/bot.armv5l
|
url | arm, elf, mirai, opendir, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://176.65.139.177/bot.i486
|
url | elf, mirai, opendir, ua-wget, x86 | malware_download | URLhaus | — | 2026-05-13 | |
http://176.65.139.177/bot.armv4l
|
url | arm, elf, mirai, opendir, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://176.65.139.177/bot.x86_64
|
url | elf, mirai, opendir, ua-wget, x86 | malware_download | URLhaus | — | 2026-05-13 | |
http://176.65.139.177/bot.mips
|
url | elf, mips, mirai, opendir, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://176.65.139.177/bot.sh4
|
url | elf, mirai, opendir, SuperH, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://176.65.139.177/bot.mipsr
|
url | elf, mips, mirai, opendir, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://61.53.82.252:46127/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://27.220.243.108:45016/i
|
url | Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://60.23.224.10:60412/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://27.220.243.108:45016/bin.sh
|
url | Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://182.117.151.166:55410/i
|
url | Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://112.249.61.9:34551/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://60.23.224.10:60412/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://182.117.151.166:55410/bin.sh
|
url | Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://123.5.5.135:56083/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://125.44.46.158:59841/i
|
url | Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://123.5.5.135:56083/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://61.52.185.69:46774/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://123.13.28.236:50656/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://39.81.90.118:53969/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://39.81.90.118:53969/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://112.248.185.5:57152/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://112.248.185.5:57152/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://221.203.124.220:60683/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://42.57.219.68:52228/i
|
url | — | malware_download | URLhaus | — | 2026-05-13 | |
http://27.215.121.135:58017/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://221.203.124.220:60683/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://27.215.121.135:58017/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://60.22.192.81:59759/bin.sh
|
url | — | malware_download | URLhaus | — | 2026-05-13 | |
http://125.41.231.11:40951/bin.sh
|
url | Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://42.57.219.68:52228/bin.sh
|
url | — | malware_download | URLhaus | — | 2026-05-13 | |
http://60.162.33.50:45659/i
|
url | 32-bit, arm, elf, mirai, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://42.57.53.136:59615/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://123.190.79.253:32873/i
|
url | — | malware_download | URLhaus | — | 2026-05-13 | |
http://175.149.170.129:37335/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://175.149.170.129:37335/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://110.36.80.162:54927/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
https://solar-sanat.net/imagetest0071154z7.png
|
url | — | malware_download | URLhaus | — | 2026-05-13 | |
https://solar-sanat.net/imagetest00711z5.png
|
url | — | malware_download | URLhaus | — | 2026-05-13 | |
https://solar-sanat.net/imagetest0093t536.png
|
url | — | malware_download | URLhaus | — | 2026-05-13 | |
https://solar-sanat.net/imagecab001.png
|
url | — | malware_download | URLhaus | — | 2026-05-13 | |
https://solar-sanat.net/imagetext0117z45.png
|
url | — | malware_download | URLhaus | — | 2026-05-13 | |
http://222.137.76.7:35441/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://218.16.164.153:55697/i
|
url | mirai | malware_download | URLhaus | — | 2026-05-13 | |
http://222.137.76.7:35441/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
https://solar-sanat.net/MDClient.exe
|
url | VenomRAT | malware_download | URLhaus | — | 2026-05-13 | |
http://124.29.223.148:54801/i
|
url | Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://107.173.9.85/67/img_171102.png
|
url | Formbook | malware_download | URLhaus | — | 2026-05-13 | |
http://107.173.9.85/67/weneedbetterthingsforbest.HtA
|
url | Formbook | malware_download | URLhaus | — | 2026-05-13 | |
http://124.29.223.148:54801/bin.sh
|
url | Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://209.54.103.178/32/img_221919.png
|
url | — | malware_download | URLhaus | — | 2026-05-13 | |
http://209.54.103.178/32/givemegoodpersoninlifeforlove.hta
|
url | — | malware_download | URLhaus | — | 2026-05-13 | |
http://110.36.12.61:47712/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://24.95.54.96:57781/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://123.148.241.62:43983/i
|
url | 32-bit, arm, elf, mirai, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://39.87.238.242:44751/i
|
url | Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://123.148.241.62:43983/bin.sh
|
url | 32-bit, arm, elf, mirai, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://115.61.111.142:46490/i
|
url | Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://216.129.184.213:51759/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://27.37.112.190:41763/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://216.129.184.213:51759/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://27.37.112.190:41763/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://42.52.194.3:40757/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://175.149.123.111:52663/i
|
url | — | malware_download | URLhaus | — | 2026-05-13 | |
http://110.37.95.117:53934/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://150.255.27.41:55895/i
|
url | 32-bit, arm, elf, mirai, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://42.227.177.133:54013/bin.sh
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 | |
http://175.149.123.111:52663/bin.sh
|
url | — | malware_download | URLhaus | — | 2026-05-13 | |
http://45.153.34.170/huhu/titanjr.i686
|
url | elf, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://45.153.34.170/huhu/titanjr.ppc
|
url | elf, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://45.153.34.170/huhu/titanjr.i486
|
url | elf, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://45.153.34.170/huhu/titanjr.ppc440
|
url | elf, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://45.153.34.170/huhu/titanjr.arm5
|
url | elf, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://45.153.34.170/huhu/titanjr.arm7
|
url | elf, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://45.153.34.170/huhu/titanjr.arc
|
url | elf, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://45.153.34.170/huhu/titanjr.spc
|
url | elf, mirai, ua-wget | malware_download | URLhaus | — | 2026-05-13 | |
http://78.25.107.160:58641/i
|
url | 32-bit, elf, mips, Mozi | malware_download | URLhaus | — | 2026-05-13 |
Analyst Tools
Paste raw text — emails, reports, logs — to automatically extract and classify all IOCs.
| IOC Value | Type | Defanged | Actions |
|---|
Enter any IOC — type is auto-detected and a curated set of intel sources appears.
Decode common obfuscation schemes found in malware, phishing kits, and threat reports.
Convert IOCs between defanged (report-safe) and live formats. Handles hxxp, [.], and [://] notations.
Convert timestamps between Unix epoch, UTC, and local time. Paste any format into any field.
Paste raw email headers to extract the sending chain, authentication results (SPF / DKIM / DMARC), originating IPs, and timing data.
Threat Intelligence News
Krebs on Security
- May 12Patch Tuesday, May 2026 EditionVulnerability
The Hacker News
- May 14Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access
- May 14Stealer Backdoor Found in 3 Node-IPC Versions Targeting Developer SecretsMalware
- May 14ThreatsDay Bulletin: PAN-OS RCE, Mythos cURL Bug, AI Tokenizer Attacks, and 10+ StoriesVulnerability
- May 14Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt StrikePhishingMalware
- May 14PraisonAI CVE-2026-44338 Auth Bypass Targeted Within Hours of DisclosureVulnerability
Dark Reading
- May 14Maximum Severity Cisco SD-WAN Bug Exploited in the Wild
- May 14'FrostyNeighbor' APT Carefully Targets Govt Orgs in Poland, UkraineAPT
- May 14AI Drives Cybersecurity Investments, Widening 'Valley of Death'
- May 14Foxconn Attack Highlights Manufacturing's Cyber Crisis
- May 13Checkbox Assessments Aren't Fit to Measure to Risk
Talos Intelligence
- May 14The time of much patching is coming
- May 14Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities
- May 13Breaking things to keep them safe with Philippe Laulheret
- May 12Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilitiesVulnerability
Bleeping Computer
- May 14Cisco warns of new critical SD-WAN flaw exploited in zero-day attacksVulnerability
- May 14OpenAI confirms security breach in TanStack supply chain attackSupply Chain
- May 14Windows 11 and Microsoft Edge hacked at Pwn2Own Berlin 2026
- May 1418-year-old NGINX vulnerability allows DoS, potential RCEVulnerability
- May 14Cyber-Enabled Cargo Crime: How Cybercrime Tradecraft is Used to Steal Freight
The Record
- May 14OpenAI asks macOS users to update after TanStack npm supply chain attackSupply Chain
- May 14ODNI taps officials to coordinate response to foreign election threats
- May 13Alleged Dream Market admin arrested in Germany after US indictment
- May 13European Commission head pushes creation of new law delaying teens’ social media access
- May 13UK moves to shield security researchers in cybercrime law overhaul
CISA Alerts
- May 14Siemens Solid Edge
- May 14Siemens Teamcenter
- May 14Siemens Ruggedcom Rox
- May 14Universal Robots Polyscope 5
- May 14Siemens Simcenter Femap
SANS Internet Storm Center
- May 14Simple bypass of the link preview function in Outlook Junk folder, (Thu, May 14th)
- May 14ISC Stormcast For Thursday, May 14th, 2026 https://isc.sans.edu/podcastdetail/9932, (Thu, May 14th)
- May 13[GUEST DIARY] Tearing apart website fraud to see how it works., (Wed, May 13th)
- May 13ISC Stormcast For Wednesday, May 13th, 2026 https://isc.sans.edu/podcastdetail/9930, (Wed, May 13th)
- May 13Proxying the Unproxyable? Sending EXE traffic to a Proxy, (Wed, May 13th)
Malwarebytes Labs
- May 14 Why Malwarebytes blocks some Yahoo Mail redirects Malware
- May 14 Deepfake sextortion forces schools to remove student photos from websites Vulnerability
- May 13 Texas sued Netflix over claims it secretly collected and sold users’ data
- May 13 May 2026 Patch Tuesday: no zero-days but plenty to fix Vulnerability
Infosecurity Magazine
- May 14Mustang Panda Linked to Updated FDMTP Backdoor in Asia-Pacific Espionage CampaignAPTMalware
- May 14Google Launches Android Spyware Forensics Tool for High-Risk UsersMalware
- May 14New Fragnesia Flaw Hands Linux Local Users Root Access
- May 14Most Organizations Now Use AI Agents for Sensitive Security Tasks
- May 14ICO Publishes Five-Step Plan to Counter Emerging AI-Powered Attacks
Ransomware activity
| Victim Name | Ransom Group | Industry / Sector | Country | Date Discovered |
|---|---|---|---|---|
|
Houston Eye Associates
CRITICAL SECTOR
|
cmdorganization | Healthcare | US | 2026-05-14 |
|
PowerCampus
|
shadowbyt3$ | Education | IN | 2026-05-14 |
|
Ellucian PowerCampus Warning (Contact Us)
|
shadowbyt3$ | Education | US | 2026-05-14 |
|
Stride Learning
|
shadowbyt3$ | Education | US | 2026-05-14 |
|
Amplify Technology
|
shadowbyt3$ | Technology | GB | 2026-05-14 |
|
University Of Georgia
|
shadowbyt3$ | Education | US | 2026-05-14 |
|
Hotelogix
|
shadowbyt3$ | Hospitality and Tourism | SG | 2026-05-14 |
|
Schulte-Lindhorst GmbH & Co.
|
qilin | Manufacturing | DE | 2026-05-14 |
|
Institute of PrivateEnterprise Development
|
akira | Business Services | Unknown | 2026-05-14 |
|
Fab-Masters
|
qilin | Manufacturing | US | 2026-05-14 |
|
technic.com
|
abyss | Technology | US | 2026-05-14 |
|
Goodstone Group
|
cmdorganization | General | AU | 2026-05-14 |
|
BAYTECH A/S
|
morpheus | Business Services | DK | 2026-05-14 |
|
Ira & Larry Goldberg Coins & Collectibles
|
cmdorganization | Consumer Services | US | 2026-05-14 |
|
dsdlawfirm.com
|
killsec | Business Services | US | 2026-05-14 |
|
ttt.vn UPDATE-FULL DATA DUMP
|
stormous | General | VN | 2026-05-13 |
|
vspsolutions.com.au SAMPLE-FREE 20GB
|
stormous | Business Services | AU | 2026-05-13 |
|
Silergy Corp
|
incransom | Technology | US | 2026-05-13 |
|
Spirit Medical Transport
CRITICAL SECTOR
|
qilin | Healthcare | US | 2026-05-13 |
|
Mayer
|
qilin | General | US | 2026-05-13 |
|
Bluize
|
qilin | Technology | AU | 2026-05-13 |
|
Brand X Hydrovac Services
CRITICAL SECTOR
|
qilin | Energy | CA | 2026-05-13 |
|
LTJ Industrial Services
|
qilin | Business Services | GB | 2026-05-13 |
|
Johnson Carter Architects
|
qilin | Construction | US | 2026-05-13 |
|
Domaine Des Tournels
|
qilin | Agriculture and Food Production | FR | 2026-05-13 |
|
MicroMarketing
|
dragonforce | Business Services | Unknown | 2026-05-13 |
|
Pamil Modulsystem
|
dragonforce | Manufacturing | SE | 2026-05-13 |
|
Tricon Infotech
|
dragonforce | Technology | IN | 2026-05-13 |
|
One Legal
|
qilin | Business Services | SG | 2026-05-13 |
|
John G Yphantides A Professional Law
|
qilin | Business Services | US | 2026-05-13 |
|
Belz Institutions
|
qilin | General | IL | 2026-05-13 |
|
Buenos Aires Software
|
coinbasecartel | Technology | AR | 2026-05-13 |
|
Allele Diagnostics
CRITICAL SECTOR
|
akira | Healthcare | FR | 2026-05-13 |
|
Institute of Private Enterprise Development
|
akira | Business Services | US | 2026-05-13 |
|
Gorey Community School
|
payload | Education | IE | 2026-05-13 |
|
Inteceng.com.my (+ Tsksynergy.com.my + Amemanufacturing.com.my + Woodnova.com.my)
|
payload | Manufacturing | MY | 2026-05-13 |
|
A.R.Ge.Co
|
anubis | Business Services | IT | 2026-05-13 |
|
NTN Bearing Corporation of America
|
payoutsking | Manufacturing | US | 2026-05-13 |
|
The Gravity Group
|
qilin | Business Services | US | 2026-05-12 |
|
Porter Wright
|
SilentRansomGroup | Business Services | US | 2026-05-12 |
|
Marshall Dennehey
|
SilentRansomGroup | Business Services | US | 2026-05-12 |
|
SHERIFF
|
qilin | Public Sector | UA | 2026-05-12 |
|
Infoworld Membership Systems
|
play | Technology | Unknown | 2026-05-12 |
|
Town Car International
|
play | Transportation/Logistics | US | 2026-05-12 |
|
Northern Mechanical Contractors
|
play | Construction | CA | 2026-05-12 |
|
ACC Construction
|
play | Construction | US | 2026-05-12 |
|
IWC Food Service
|
play | Agriculture and Food Production | US | 2026-05-12 |
|
Ashcroft Homes
|
play | Construction | CA | 2026-05-12 |
|
DURAND-WAYLAND
|
play | Manufacturing | US | 2026-05-12 |
|
Focus Design Partners
|
thegentlemen | Business Services | QA | 2026-05-12 |
|
Shajarpak Securities
|
thegentlemen | Financial Services | IR | 2026-05-12 |
|
Qatar National Broadband
|
thegentlemen | Telecommunication | QA | 2026-05-12 |
|
Electroban SAE
|
thegentlemen | Manufacturing | PY | 2026-05-12 |
|
Oriental Diamond
|
thegentlemen | Manufacturing | JP | 2026-05-12 |
|
SETCAR
|
thegentlemen | Transportation/Logistics | TN | 2026-05-12 |
|
Value Exchange International
|
thegentlemen | Financial Services | HK | 2026-05-12 |
|
Dodson & Horrell
|
thegentlemen | Agriculture and Food Production | GB | 2026-05-12 |
|
Amstel Securities
|
thegentlemen | Financial Services | NL | 2026-05-12 |
|
GeTeCe
|
thegentlemen | General | DE | 2026-05-12 |
|
dentoncalvary.org
CRITICAL SECTOR
|
lockbit5 | Healthcare | US | 2026-05-12 |
|
Bestat Pharmaservices Corp.
CRITICAL SECTOR
|
worldleaks | Healthcare | TW | 2026-05-12 |
|
Notification.
|
shinyhunters | Technology | Unknown | 2026-05-12 |
|
Taylor Clay Products
|
akira | Manufacturing | US | 2026-05-12 |
|
Kaplan Companies
|
akira | Business Services | US | 2026-05-12 |
|
PRESS STATEMENT 13/05/2026
|
shinyhunters | General | Unknown | 2026-05-12 |
|
Mediapost Spain
|
qilin | Business Services | ES | 2026-05-12 |
|
Manhattan Broadcasting
|
akira | Telecommunication | US | 2026-05-12 |
|
Vision 3 Architects
|
akira | Construction | US | 2026-05-12 |
|
Avanti Windows & Doors
|
aurora | Manufacturing | US | 2026-05-12 |
|
NaRaYa
|
lamashtu | General | TH | 2026-05-12 |
|
Saharuang
|
lamashtu | General | TH | 2026-05-12 |
|
Startec Group of Companies
|
aurora | Business Services | PH | 2026-05-12 |
|
NorthWest Handling Systems
|
aurora | Transportation/Logistics | CA | 2026-05-12 |
|
Rivadeneyra Treviño
|
bravox | General | MX | 2026-05-12 |
|
SmilePoint Dental Group
CRITICAL SECTOR
|
spacebears | Healthcare | US | 2026-05-12 |
|
Pequod Associates
|
genesis | General | US | 2026-05-12 |
|
rbh aerospace inc
|
incransom | Manufacturing | US | 2026-05-11 |
|
Bideawee
|
incransom | Consumer Services | US | 2026-05-11 |
|
Casino Gaming Commission
|
genesis | Public Sector | JM | 2026-05-11 |
|
Fargo Moorhead West Fargo Chamber
|
genesis | Business Services | US | 2026-05-11 |
|
Integrated Process Engineers & Constructors.
|
genesis | Construction | US | 2026-05-11 |
|
Ben F. Barcus and associates pllc
|
genesis | Business Services | US | 2026-05-11 |
|
Palo
|
genesis | Technology | US | 2026-05-11 |
|
HostBooks (HOT!)
|
genesis | Business Services | US | 2026-05-11 |
|
FANASA.COM UPDATE-FULL DATA DUMP
|
stormous | General | Unknown | 2026-05-11 |
|
arc-reins.com + fidelityunited.ae UPDATE-FULL DATA DUMP
|
stormous | Financial Services | AE | 2026-05-11 |
|
AppDirect
|
qilin | Technology | CA | 2026-05-11 |
|
Arwini
|
kairos | General | DE | 2026-05-11 |
|
Ayuntamiento de Valdemoro
|
kairos | Public Sector | ES | 2026-05-11 |
|
lalsgroup.com
|
incransom | General | AE | 2026-05-11 |
|
Advanced Software Products Group
|
cmdorganization | Technology | US | 2026-05-11 |
|
Keller Williams Real Estate - Exton
|
qilin | Consumer Services | US | 2026-05-11 |
|
International Customer Care Services
|
qilin | Business Services | GB | 2026-05-11 |
|
Pangolin Editions
|
qilin | Consumer Services | GB | 2026-05-11 |
|
Forestdale
|
moneymessage | Business Services | GB | 2026-05-11 |
|
Depósito Dental Universitario
CRITICAL SECTOR
|
lamashtu | Healthcare | MX | 2026-05-11 |
|
Sistemas Electrónicos y de Telecomunicaciones
|
lamashtu | Telecommunication | MX | 2026-05-11 |
|
First United Methodist Church Boerne
|
interlock | Consumer Services | US | 2026-05-11 |
|
ice.org.uk
|
BrainCipher | Education | GB | 2026-05-11 |
|
Kent District Library
|
interlock | Public Sector | US | 2026-05-11 |
qilin
thegentlemen
apt73
incransom
akira
coinbasecartel
shinyhunters
genesis
payload
lockbit5
braincipher
worldleaks
dragonforce
leakbazaar
safepay
threeam
blacknevas
everest
lamashtu
lynx
silentransomgroup
play
anubis
krybit
pear
shadowbyt3$
interlock
kairos
stormous
cmdorganization
nightspire
ransomhouse
ailock
aurora
bravox
chaos
killsec
insomnia
lapsus$
mnt6
ransomexx
abyss
auditteam
beast
crypto24
fulcrumsec
moneymessage
morpheus
nitrogen
payoutsking
securotrop
sinobi
spacebears
termite
0apt
0mega
8base
abrahams_ax
adminlocker
againstthewest
agl0bgvycg
ako
alp-001
alphalocker
alphv
apos
arcusmedia
argonauts
arkana
arvinclub
atomsilo
avaddon
avos
avoslocker
aware
aztroteam
babuk
babuk2
babyduck
benzona
bert
bianlian
blackbasta
blackbyte
blacklock
blackmatter
blackout
blackshadow
blackshrantac
blacksuit
blacktor
blackwater
bluebox
bluelocker
bluesky
bonacigroup
bqtlock
brotherhood
cactus
cephalus
cheers
chilelocker
chort
cicada3301
ciphbit
cipherforce
cloak
clop
contfr
conti
cooming
crazyhunter
crosslock
cry0
crylock
cryp70n1c0d3
cryptbb
cryptnet
cuba
cyclops
d4rk4rmy
dagonlocker
daixin
dan0n
darkangels
darkbit
darkleakmarket
darkpower
darkrace
darkside
darkvault
datacarry
datakeeper
dataleak
desolator
devman
diavol
direwolf
dispossessor
donex
donutleaks
doppelpaymer
dragonransomware
dread
dunghill
ech0raix
eldorado
embargo
entropy
ep918
esxiargs
exitium
exorcist
fletchen
flocker
fog
frag
freecivilian
fsteam
funksec
gdlockersec
global
grief
groove
gunra
hades
handala
haron
hellcat
helldown
hellogookie
hellokitty
hive
holyghost
hotarus
hunters
icarus
icefire
imncrew
insane
j
karakurt
karma
kawa4096
kazu
kelvinsecurity
kittykatkrew
knight
kraken
kryptos
kyber
la_piovra
leaktheanalyst
lilith
linkc
lockbit
lockbit2
lockbit3
lockbit3_fs
lockdata
loki
lolnek
lorenz
losttrust
lunalock
lv
m3rx
madcat
madliberator
malas
malekteam
mallox
mamona
marketo
maze
mbc
medusa
medusalocker
meow
metaencryptor
midas
mindware
minteye
mogilevich
monti
mosesstaff
mountlocker
ms13089
mydecryptor
n3tworm
nasirsecurity
nefilim
nemty
netrunner
netwalker
nevada
nightsky
noescape
nokoyawa
noname
nova
obscura
onepercent
onyx
orca
orion
osiris
pandora
pay2key
payday
payloadbin
playboy
prinzeugen
projectrelic
prolock
prometheus
promptlock
pysa
qiulong
qlocker
quantum
rabbithole
radar
radiant
ragnarlocker
ragnarok
ralord
ramp
rancoz
ranion
ransombay
ransomcartel
ransomcortex
ransomed
ransomhub
ranstreet
ranzy
raworld
raznatovic
rebornvc
redalert
redransomware
revil
reynolds
rhysida
robinhood
rook
royal
rransom
runsomewares
sabbath
sarcoma
satanlockv2
secp0
sensayq
shadow
shaoleaks
shinysp1d3r
sicarii
siegedsec
silent
skira
slug
snatch
solidbit
sparta
spook
sugar
suncrypt
synack
teamxxx
tengu
thegreenbloodgroup
timc
toufan
tridentlocker
trigona
trinity
trisec
u-bomb
underground
unknown
unsafe
valencialeaks
vanhelsing
vanirgroup
vect
vendetta
vfokx
vicesociety
walocker
wannacry
warlock
werewolves
weyhro
x001xs
xinglocker
xinof
xp95
yanluowang
yurei
zeon
zerolockersec
zerotolerance
Global Victim Distribution (30 days)
Targeted Sectors (30 days)
Top Targeted Countries (30 days)
| Country | Incidents (30d) | Share |
|---|---|---|
| US | 159 |
|
| GB | 35 |
|
| DE | 30 |
|
| CA | 18 |
|
| AU | 9 |
|
| ES | 8 |
|
| FR | 8 |
|
| MX | 7 |
|
| BR | 7 |
|
| ID | 7 |
|
| IT | 6 |
|
| SG | 6 |
|
| IN | 6 |
|
| TH | 6 |
|
| AT | 5 |
|
Vulnerabilities
High Severity (>9.0)
CVE-2026-42555
Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32...
CVE-2026-45375
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan's Bazaar (community marketplace) r...
CVE-2026-42457
vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prio...
CVE-2026-8181
The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulne...
CVE-2026-6510
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions ...
CVE-2026-42589
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write...
CVE-2026-44542
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-contr...
CVE-2026-44592
Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the N...
CVE-2026-2347
Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Comme...
CVE-2026-6271
The Career Section plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7...
CVE-2026-6512
The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1....
CVE-2026-20182
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fi...
CVE-2026-41615
No description provided yet.
CVE-2026-42596
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's d...
CVE-2026-44482
soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8...
CVE-2026-44523
Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JW...
Medium Severity (5.0 - 8.9)
CVE-2026-6504
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr...
CVE-2026-42559
RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate'...
CVE-2026-6252
The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagN...
CVE-2026-6479
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a...
CVE-2026-44586
SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's...
CVE-2026-6225
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress i...
CVE-2026-6473
Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to ca...
CVE-2026-6478
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an at...
CVE-2026-3829
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugi...
CVE-2026-40893
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if...
CVE-2026-41937
Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoin...
CVE-2026-42592
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, FilterOutboundURL resolv...
CVE-2026-43907
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format...
CVE-2026-44312
css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTT...
CVE-2026-44516
Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, ...
CVE-2026-45370
python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_comm...
CVE-2026-5243
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCom...
CVE-2026-6145
The User Registration & Membership plugin for WordPress is vulnerable to Missing Authorization in al...
CVE-2026-6206
The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and...
CVE-2026-6335
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.3 that...
CVE-2026-6472
Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries tha...
CVE-2026-6475
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superus...
CVE-2026-6477
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export()...
CVE-2026-6514
The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, ...
CVE-2026-6670
The Media Sync plugin for WordPress is vulnerable to Path Traversal in all versions up to, and inclu...
CVE-2026-3718
The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'MWP-K...
CVE-2026-3892
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbit...
CVE-2026-4031
The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all ...
CVE-2026-41932
Vvveb before 1.0.8.3 contains a stored cross-site scripting vulnerability in the customer signup flo...
CVE-2026-41935
Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispat...
CVE-2026-42334
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to...
CVE-2026-42591
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversi...
CVE-2026-42595
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, Gotenberg's Chromium URL...
CVE-2026-43996
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format...
CVE-2026-8280
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.9.7, 18.10 ...
CVE-2026-44513
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code by...
CVE-2026-44520
Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge grap...
CVE-2026-44637
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a ...
CVE-2026-45369
python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method i...
CVE-2026-46446
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows S...
CVE-2026-5193
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is v...
CVE-2026-5486
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'da...
CVE-2026-6073
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 be...
CVE-2026-6174
The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more' ...
CVE-2026-6417
The GLS Shipping for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scriptin...
CVE-2026-6476
SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription right...
CVE-2026-6506
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to,...
CVE-2026-6637
Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute ...
CVE-2026-20209
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow...
CVE-2026-20210
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow...
CVE-2026-20224
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow...
CVE-2026-7377
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 be...
CVE-2026-7481
GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.9.7, 18.10 be...
CVE-2026-3694
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tex...
CVE-2026-1659
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 ...
CVE-2026-4029
The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export...
CVE-2026-4030
The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file ...
CVE-2026-3160
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.9.7, 18.10...
CVE-2026-41933
Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows u...
CVE-2026-42283
DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3....
CVE-2026-42572
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale....
CVE-2026-42590
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.30.0, The ExifTool metadata wr...
CVE-2026-42593
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, pdfengines/merge, pdfeng...
CVE-2026-42594
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the webhook middleware s...
CVE-2026-42597
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the /forms/chromium/conv...
CVE-2026-42897
No description provided yet.
CVE-2026-43644
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api...
CVE-2026-43908
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format...
CVE-2026-43909
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format...
CVE-2026-1184
GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 be...
CVE-2026-44375
Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, N...
CVE-2026-44511
Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin...
CVE-2026-44514
Kubetail is a real-time logging dashboard for Kubernetes. Prior to 0.14.0, Kubetail's dashboard expo...
CVE-2026-44636
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, si...
CVE-2026-44633
Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Liv...
CVE-2026-1322
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10...
CVE-2026-44673
libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parse...
CVE-2026-44827
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, diffusers 0.37.0 allow...
CVE-2026-4524
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9.1 before 18.9.7, 18....
CVE-2026-4527
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.9.7, 18.1...
CVE-2026-46419
Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a funct...
CVE-2026-46445
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
CVE-2026-5361
The Envira Gallery Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the RE...
CVE-2026-5395
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin fo...
CVE-2026-5396
The Fluent Forms plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled ...
CVE-2026-6008
Authorization bypass through User-Controlled key vulnerability in Im Park Information Technology, El...
Low Severity (1.0 - 4.9)
CVE-2026-44374
Backstage is an open framework for building developer portals. Prior to 0.6.11, ...
CVE-2026-8144
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 ...
CVE-2026-44348
PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double...
CVE-2026-6575
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts arr...
CVE-2026-45147
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, P...
CVE-2026-6923
A side-channel attack, which requires a physical presence to the TPM, can lead t...
CVE-2026-7648
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin ...
CVE-2026-3607
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 ...
CVE-2026-45448
CWE-601 URL redirection to untrusted site ('open redirect')
CVE-2026-44919
In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infin...
CVE-2026-5365
The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery i...
CVE-2026-6063
GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 be...
CVE-2026-6474
Externally-controlled format string in PostgreSQL timeofday() function allows an...
CVE-2026-6638
SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH P...
CVE-2026-6883
GitLab has remediated an issue in GitLab EE affecting all versions from 15.7 bef...
CVE-2026-7471
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 bef...
CVE-2026-7525
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to...
CVE-2026-3074
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 ...
CVE-2026-44501
DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub front...
CVE-2026-27680
Due to improper input handling under certain conditions, SAP NetWeaver Applicati...
CVE-2026-3073
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 ...
CVE-2026-2900
GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 be...
CVE-2026-44589
Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl()...
CVE-2026-44638
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. F...
CVE-2026-44661
python-utcp is the python implementation of UTCP. Prior to 1.1.3, the utcp-http ...
CVE-2026-1338
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10...
CVE-2026-45148
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, b...
CVE-2026-46469
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsin...
CVE-2026-46470
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsin...
CVE-2026-20224
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in an affected system. The attacker does not need to have valid user credentials. This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to read arbitrary files that are stored in the affected system.
CVE-2026-45147
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, POST /api/tag/getTag is registered with model.CheckAuth only, omitting both model.CheckAdminRole and model.CheckReadonly, despite the handler performing a configuration write that is normally guarded by both. Any authenticated user — including publish-service RoleReader accounts and RoleEditor accounts on a read-only workspace — can call this endpoint with a sort argument to mutate model.Conf.Tag.Sort and trigger model.Conf.Save(), which atomically rewrites the entire workspace conf.json. This vulnerability is fixed in 3.7.0.
CVE-2026-46470
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.
CVE-2026-42594
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the webhook middleware spawns a goroutine that holds a reference to the request's echo.Context after the synchronous handler returns ErrAsyncProcess and Echo recycles the context back to its sync.Pool. When a concurrent request claims the recycled context, c.Reset() clears the store. If the webhook goroutine reaches hardTimeoutMiddleware at that moment, an unchecked type assertion on a nil store entry panics outside any recover() scope, crashing the Gotenberg process. Any anonymous caller reaches the webhook path (default webhook-deny-list filters only the webhook destination, not the submitter). A single-source stress of ~24 webhook requests plus ~60 GET /version requests crashes the process in about two seconds. This vulnerability is fixed in 8.32.0.
CVE-2026-43996
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, the bounds check in TGAInput::decode_pixel computes k + palbytespp as unsigned 32-bit arithmetic. When k = 0xFFFFFFFC and palbytespp = 4, the addition wraps to 0, which compares less than palette_alloc_size and passes the check. The subsequent palette access uses the unwrapped k (0xFFFFFFFC) as the index, reading ~4 GB past the start of the palette buffer — SEGV. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
CVE-2026-44670
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View (AV / database) names without any HTML escape, then a render template uses raw strings.ReplaceAll(tpl, "${avName}", nodeAvName) to embed the name in HTML before pushing to all clients via WebSocket. Three independent client paths (render.ts:120 → outerHTML, Title.ts:401 → innerHTML, transaction.ts:559 → innerHTML) consume the value without escaping. Because the main BrowserWindow runs nodeIntegration:true, contextIsolation:false, webSecurity:false (app/electron/main.js:407-411), HTML injection in the renderer becomes Node.js code execution. This vulnerability is fixed in 3.7.0.
CVE-2026-44515
Nextcloud News is an RSS/Atom feed reader. Prior to 28.3.0-beta.1, Nextcloud News allows authenticated users to add feeds by providing a feed URL (via the web interface or the API). In affected versions, an authenticated attacker could provide a URL pointing to internal/private IP ranges or localhost, causing the Nextcloud server to perform server-side HTTP requests to attacker-controlled destinations, but not relaying the result. This enables blind SSRF, which can be used to scan or probe internal network services that are reachable from the Nextcloud server. This vulnerability is fixed in 28.3.0-beta.1.
CVE-2026-44348
PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in compute_hash_to_sign() in src/podofo/private/OpenSSLInternal_Ripped.cpp. If EVP_DigestFinal fails after buf has already been freed, the Error label frees buf a second time, causing heap corruption. This vulnerability is fixed in 1.0.4.
CVE-2026-6332
CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it.
CVE-2026-46469
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_parse_trak function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.
CVE-2026-20182
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks. A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
CVE-2026-42572
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint caused Hatchet's tenant-membership check to be skipped for this route. A user authenticated to any tenant on the same Hatchet instance could query the endpoint with another tenant's UUID and a DAG UUID belonging to that tenant, and receive task metadata for that DAG. This vulnerability is fixed in 0.83.39.
CVE-2026-43904
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, softimageinput.cpp:469 (mixed RLE) and :345 (pure RLE) do not clamp the run length to remaining scanline width before writing pixels. The raw packet path (line 403) correctly clamps with std::min, but RLE paths skip this check. A crafted .pic file causes heap overflow up to 65535 bytes. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
CVE-2026-44523
Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.
CVE-2026-42281
MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0.
CVE-2026-42159
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Flowsint allows a user to create investigations, which are used to manage sketches and analyses. Sketches have controllable graphs, which are comprised of nodes and relationships. The sketches contain information on an OSINT target (usernames, websites, etc) within these nodes and relationships. A remote attacker can create a node with a malicious description that contains arbitrary HTML. When the node is selected, it will render the arbitrary HTML, potentially triggering stored XSS. This vulnerability is fixed in 1.2.3.
CVE-2026-42598
Pode is a Cross-Platform PowerShell web framework for creating REST APIs, Web Sites, and TCP/SMTP servers. From 2.4.0, to before 2.13.0, when requesting content from a Static Route, it was possible to request paths such as http://localhost:8080/c:/Windows/System32/drivers/etc/hosts and have the contents returned. This vulnerability is fixed in 2.13.0.
CVE-2026-44542
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete arbitrary files outside the shared directory within the share owner’s configured storage scope. This affects public/api/resources and public/api/resources/bulk. This vulnerability is fixed in 1.3.1-stable and 1.3.9-beta.
CVE-2026-44522
Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided through the X-Name HTTP request header. This value is stored directly in the database without any sanitization or validation - no path separator filtering, no directory traversal sequence rejection, and no use of filepath.Base() to strip directory components. The unsanitized name is persisted as-is in the note_assets table (Name column, varchar(80)). When an administrator subsequently runs the data export CLI commands (note-mark migrate export-v1 or note-mark migrate export), the stored asset name is passed directly into filepath.Join() and path.Join() calls as part of the output file path argument to os.Create(). Since Go's filepath.Join() resolves ../ sequences during path normalization, an attacker-controlled asset name containing directory traversal sequences causes the export process to write files to arbitrary locations on the filesystem, completely outside the intended export directory. This vulnerability is fixed in 0.19.4.
CVE-2026-42559
RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. This vulnerability is fixed in 1.4.0.
CVE-2026-41888
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.
CVE-2026-44633
Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in a department they cannot read. The endpoint accepts arbitrary chat object fields, so the user can change the chat hash and status and then access or tamper with the chat through visitor/widget paths. The same write primitive can set operation_admin, which is later emitted as operator-side JavaScript.
CVE-2026-20210
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker with read-only permissions to modify configurations and perform unauthorized actions on an affected system. This vulnerability exists because of a failure to redact sensitive information within device configurations and templates. An attacker could exploit this vulnerability by elevating their read-only permissions to those of a high-privileged user. A successful exploit could allow the attacker to access or modify configuration settings within Cisco Catalyst SD-WAN Manager as a high-privileged user.
CVE-2026-44511
Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies were not invalidated when an admin user logged out. An attacker with access to a valid admin session cookie could continue to access admin functionality after logout, until the cookie expired or session secrets were rotated. This vulnerability is fixed in 4.20.0 and 5.6.0.
CVE-2026-27680
Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data into a web page served by the application. When a user accesses or clicks the affected page, the injected CSS is executed. As a result, the issue has a low impact on confidentiality, while integrity and availability are not impacted.
CVE-2026-24712
Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection.
CVE-2026-41615
No description provided yet.
CVE-2026-44592
Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the NixOS module default), anyone who can reach /proto can register as a worker without any credentials by sending a fresh, never-registered worker UUID. The resulting session has PeerAuth::Open, i.e. it sees jobs from every organisation, and can immediately NarPush/NarUploaded arbitrary store paths into nar_storage and the cached_path table. This vulnerability is fixed in 1.1.1.
CVE-2026-43908
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression i * 3 inside ConvertCbYCrYToRGB() causes the function to compute a large negative pointer offset into the output buffer, producing an out-of-bounds write that crashes the process. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
CVE-2026-42589
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes its keys directly to ExifTool via the go-exiftool library. No validation is performed on key characters. A \n embedded in a JSON key splits the ExifTool stdin stream into a new argument line, allowing an attacker to inject arbitrary ExifTool flags — including -if, which evaluates Perl expressions. This achieves unauthenticated OS command execution in a single HTTP request. The response is HTTP 200 with a valid PDF, making the attack transparent to basic monitoring. This vulnerability is fixed in 8.31.0.
CVE-2026-41315
mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command execution vulnerability. Due to the lack of authentication on the /modify_crond and /start_task interfaces, it is possible to modify the default built-in scheduled tasks and start them, achieving RCE.
CVE-2026-44371
Open OnDemand is an open-source high-performance computing portal. Prior to 4.0.11, 4.1.5, and 4.2.2, specially crafted filenames can execute javascript in the file browser This vulnerability is fixed in 4.0.11, 4.1.5, and 4.2.2.
CVE-2026-41932
Vvveb before 1.0.8.3 contains a stored cross-site scripting vulnerability in the customer signup flow where the Signup::addUser() controller copies raw POST username values into the display_name field before sanitization occurs. Attackers can submit HTML and script markup in the username field during signup, which gets stripped from the username column but persisted verbatim in the display_name column, allowing stored XSS execution when display_name is rendered without encoding in vulnerable views.
CVE-2026-42283
DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the same time uses a browser to access the internet, a malicious website they visit can use their browser to establish a cross-origin WebSocket connection to ws://127.0.0.1:8090. This vulnerability is fixed in 6.3.21.
CVE-2026-44501
DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend (datahub-frontend-react) deserializes attacker-controlled Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback flow, with no integrity protection (no HMAC, no encryption). This is a Deserialization of Untrusted Data vulnerability (CWE-502) affecting the GET /callback/oidc endpoint. Successful exploitation requires a valid user account in the configured OIDC identity provider This vulnerability is fixed in 1.5.0.3.
CVE-2026-44588
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app/src/block/popover.ts reads aria-label via getAttribute and passes it through decodeURIComponent before assigning to messageElement.innerHTML in app/src/dialog/tooltip.ts:41. The encoder used at the producer side, escapeAriaLabel in app/src/util/escape.ts:19-25, only handles HTML special characters (", ', <, literal <) — it leaves %XX URL-escapes untouched. So a doc title containing %3Cimg src=x onerror=...%3E round-trips through escapeAriaLabel and the HTML attribute layer unmodified. Then decodeURIComponent on the consumer side converts %3C to a literal < character (a real <, NOT a character reference). When that string is assigned to innerHTML, the HTML5 tokenizer enters TagOpenState on the literal <, parses the <img> element, and the onerror handler fires. Because the renderer runs with nodeIntegration: true, contextIsolation: false, webSecurity: false (app/electron/main.js:407-411), require('child_process') is reachable from the injected handler, escalating to arbitrary code execution.This vulnerability is fixed in 3.7.0.
CVE-2026-45375
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan's Bazaar (community marketplace) renders the name and version fields of a package's plugin.json (and the equivalent theme.json / template.json / widget.json / icon.json) into the Settings → Marketplace UI without HTML escaping. The kernel-side helper sanitizePackageDisplayStrings in kernel/bazaar/package.go HTML-escapes only Author, DisplayName, and Description — Name and Version flow through to the renderer raw. The frontend at app/src/config/bazaar.ts substitutes them into HTML template strings via ${item.preferredName} / ${data.name} / v${data.version} and assigns the result to innerHTML. As a consequence, malicious HTML in either field is parsed and executed when a user opens the marketplace tab. This vulnerability is fixed in 3.7.0.
CVE-2026-42596
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as http://[::ffff:127.0.0.1]:... and reach loopback or private HTTP services that the default deny-list is intended to block. This crosses a real security boundary because an external caller can force the server to make outbound requests to internal-only targets. This vulnerability is fixed in 8.31.0.
CVE-2026-42457
vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external scripts within the platform's browser context. In the worst case, a malicious user could potentially create a new Global-Admin user, bypassing other security restrictions. The attacker needs the ability to create namespaces. This vulnerability is fixed in 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0.
CVE-2026-42593
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, pdfengines/merge, pdfengines/split, libreoffice/convert, chromium/convert/url, chromium/convert/html, and chromium/convert/markdown accept stampSource=pdf + stampExpression=/path and watermarkSource=pdf + watermarkExpression=/path from anonymous callers. The dedicated stamp/watermark routes require an uploaded file when the source type is image or pdf; these six routes only overwrite the expression when a file is uploaded, leaving the user-controlled path intact when no file is attached. pdfcpu opens the path and composites its pages onto the output PDF, which returns to the caller. An attacker reads any PDF the Gotenberg process can access on the container filesystem. This vulnerability is fixed in 8.32.0.
CVE-2026-42897
No description provided yet.
CVE-2026-3607
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass package protection rules due to improper access control.
CVE-2026-6225
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'project_search' parameter in all versions up to, and including, 5.0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2026-44514
Kubetail is a real-time logging dashboard for Kubernetes. Prior to 0.14.0, Kubetail's dashboard exposes WebSocket endpoints that did not adequately validate the Origin header on connection upgrade. A malicious web page visited by a user with an active Kubetail session could open a WebSocket to the user's dashboard and read their Kubernetes logs in real time. This is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability and affects both the desktop deployment (default http://localhost:7500) and cluster deployments (typically behind an Ingress with HTTP basic auth). This vulnerability is fixed in 0.14.0.
CVE-2026-42334
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.
CVE-2026-20209
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker with read-only permissions to elevate their privileges from low to high and perform actions as a high-privileged user. This vulnerability exists because sensitive session information is recorded in audit logs. An attacker could exploit this vulnerability by elevating their read-only permissions in Cisco Catalyst SD-WAN Manager to those of a high-privileged user. A successful exploit could allow the attacker to perform actions as a high-privileged user.
CVE-2026-45148
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, broken access control in the searchAsset, searchTag, searchWidget, and searchTemplate publish-mode Readers can enumerate metadata from documents that are invisible to the publish service. This vulnerability is fixed in 3.7.0.
CVE-2026-6073
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.
CVE-2026-44589
Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl() denylist introduced in nuxt-og-image@6.2.5 to remediate GHSA-pqhr-mp3f-hrpp (Dmitry Prokhorov / Positive Technologies, March 2026) is incomplete. It has an incomplete IPv6 prefix list and is missing redirect re-validation. This vulnerability is fixed in 6.4.9.
CVE-2026-6512
The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or orders, mass-delete all comments on any post, and change any post's status.
CVE-2026-44283
etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled. This vulnerability is fixed in 3.4.44, 3.5.30, and 3.6.11.
CVE-2026-4524
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to access confidential issue content in public projects without proper authorization due to improper authorization checks.
CVE-2026-7481
GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.
CVE-2026-42186
OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace deletion fails, subsequent retries fail to properly remove all data before marking the namespace as deleted. This can affect any outstanding leases as well as potentially leaving unrelated storage entries around. This vulnerability is fixed in 2.5.3.
CVE-2026-6883
GitLab has remediated an issue in GitLab EE affecting all versions from 15.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to bypass merge request approval requirements due to improper cleanup of orphaned policy records.
CVE-2026-44919
In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.
CVE-2026-6474
Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVE-2026-44586
SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace renders package author metadata from the public bazaar stage feed into HTML without escaping. In the desktop app this becomes stored XSS, and because SiYuan's Electron windows are created with nodeIntegration: true and contextIsolation: false, a successful payload can call Node.js APIs and execute code on the host. This vulnerability is fixed in 3.7.0.
CVE-2026-45448
CWE-601 URL redirection to untrusted site ('open redirect')
CVE-2026-44520
Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit semantic relationships. Prior to 1.5.1, the URLInputHandler class in docling_graph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local IP address. The URLValidator only checks for a valid scheme and non-empty netloc, performing no IP-level validation. Additionally, requests.head() was called with allow_redirects=True, allowing an attacker to redirect requests to internal endpoints via an intermediary URL. An attacker who can control the --source CLI argument or PipelineConfig.source API parameter can trigger Server-Side Request Forgery (SSRF). This vulnerability is fixed in 1.5.1.
CVE-2026-8621
Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers. Attackers can inject malicious X-Crabbox-Owner and X-Crabbox-Org headers in requests authenticated with a shared token to bypass authorization checks and access owner/org-scoped lease operations belonging to victim accounts.
CVE-2026-24710
Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS.
CVE-2026-44484
PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.
CVE-2026-44374
Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module. This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30.
CVE-2026-42591
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversion endpoint (/forms/libreoffice/convert) passes uploaded documents directly to LibreOffice without inspecting their content. LibreOffice then fetches any embedded external URLs on its own, completely bypassing the SSRF filters. This vulnerability is fixed in 8.32.0.
CVE-2026-42881
STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1.2.7, an attacker can achieve local code execution (LCE) with the privileges of the user running STIGQter. This requires user interaction: the victim must open the malicious .stigqter file and explicitly run the "Export HTML" action. This vulnerability is fixed in 1.2.7.
CVE-2026-41935
Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.
CVE-2026-24711
Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.
CVE-2026-44375
Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled number of bytes on the stack. This can trigger a StackOverflowException, which is not catchable by user code and terminates the process. This vulnerability is fixed in 1.1.62.
CVE-2026-8468
Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing. 'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read_part_body has an explicit byte_size(acc) > length guard that stops accumulation once a limit is reached. No such guard exists in read_part_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service. This issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.
CVE-2026-44482
soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload executed locally in the Electron app. This means attacker-controlled SoundCloud track metadata can lead to local command execution on the user's machine. The application exposes a preload API (window.soundcloudAPI.sendTrackUpdate) to the remote SoundCloud page. Track metadata from SoundCloud is trusted and forwarded through IPC into the Electron main process. The app later renders that metadata as raw HTML inside privileged Electron views that have Node.js integration enabled. This vulnerability is fixed in 0.1.8.
CVE-2026-42595
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, Gotenberg's Chromium URL-to-PDF endpoint (/forms/chromium/convert/url) has no default protection against HTTP/HTTPS-based SSRF. The default deny-list regex only blocks file:// URIs. An unauthenticated attacker can point Chromium at any internal IP — including loopback, RFC 1918 ranges, and cloud metadata endpoints — and receive the response rendered as a PDF. Additionally, even when operators configure a custom deny-list, the protection is bypassed via HTTP redirects. Gotenberg's Chromium instance follows 302 redirects from an attacker-controlled external URL to internal targets without re-validating the redirect destination against the deny-list. This vulnerability is fixed in 8.32.0.
CVE-2026-42597
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the /forms/chromium/convert/url and /forms/chromium/screenshot/url routes accept url=file:///tmp/... from anonymous callers. The default Chromium deny-list intentionally exempts file:///tmp/ so HTML/Markdown routes can load their own request-local assets, and those routes apply a per-request AllowedFilePrefixes guard to scope the read. The URL routes never set AllowedFilePrefixes, so the scope guard silently skips. Alice enumerates /tmp/, walks Gotenberg's per-request working directories, and reads the raw source files of other in-flight conversions as rendered PDF output. This vulnerability is fixed in 8.32.0.
CVE-2026-1630
WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" endpoint. An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in versions 2026.1.3.109 and 2025.2.1.293.
CVE-2026-44504
Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared instance are vulnerable to a cross-tenant IDOR. Any authenticated attacker, given another user's thread_id, can execute graph runs against the user's thread, read the user's full checkpoint state, and inject arbitrary messages into the user's conversation history. This vulnerability is fixed in 0.9.7.
CVE-2026-44216
Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.
CVE-2026-44503
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.
CVE-2026-21730
Verba is affected by a Stored Cross-Site Scripting (XSS) vulnerability within its login logging mechanism. When an unauthenticated remote attacker attempts to log in using an incorrect username and password combination, the supplied username value is recorded in the application logs. Due to lack of input sanitization, an attacker can inject a malicious XSS payload into the username field. This payload will be executed in the context of the administrator’s browser when the admin accesses the web application's log viewer. The vendor was notified early about this vulnerability, but didn't respond to our messages. This issue was fixed in version 10.0.6
CVE-2026-5361
The Envira Gallery Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in versions up to and including 1.12.4. This is due to insufficient input sanitization in the update_gallery_data() function and improper output escaping in the gallery_init() function. The sanitize_config_values() function only sanitizes the justified_gallery_theme and justified_row_height parameters, but does not sanitize the arrows parameter. When the arrows value is output in the inline JavaScript configuration, it uses esc_attr() which is designed for HTML attribute contexts, not JavaScript contexts, allowing JavaScript expression injection. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-5395
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.0 via the exportEntries function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Fluent Forms manager-level access and above, to bypass form-level access restrictions to access submissions from forms they are not authorized to view, export data from arbitrary database tables, and enumerate database table names via error message disclosure.
CVE-2026-8280
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to cause denial of service through excessive memory consumption due to improper input validation.
CVE-2026-43644
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go's content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker's page.
CVE-2026-42592
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, FilterOutboundURL resolves the hostname, checks the resolved IPs against the private-address deny-list, and returns only the error. It discards the resolved addresses. Chromium later performs its own DNS resolution when it navigates to the URL. An attacker who controls DNS for a hostname with a short TTL returns a public IP on the first query (Gotenberg allows) and a private IP on the second query (Chromium connects to the attacker-chosen internal address). The CDP Fetch.requestPaused handler re-checks the URL but runs its own DNS resolution, leaving a timing window before Chromium's actual TCP connect. The rendered internal service response returns to the caller as a PDF. This vulnerability is fixed in 8.32.0.
CVE-2026-3718
The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'MWP-Key-Name' HTTP request header in all versions up to, and including, 4.9.31. This is due to insufficient input sanitization and output escaping of attacker-controlled header values. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator visits the plugin's connection management page with debug parameters.
CVE-2026-42590
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.30.0, The ExifTool metadata write blocklist in Gotenberg can be bypassed using ExifTool's group-prefix syntax, enabling arbitrary file rename, move, hardlink, and symlink creation on the server. ExifTool supports group-prefix syntax where File:FileName is processed identically to FileName -- the prefix is stripped by SetNewValue in Writer.pl before tag matching. The safeKeyPattern regex (^[a-zA-Z0-9\-_.:]+$) allows colons, so prefixed tag names pass validation. Any prefix works: File:FileName, System:Directory, a:HardLink, etc. Additionally, FilePermissions, FileUserID, and FileGroupID pseudo-tags are not blocked at all and can modify file attributes without any prefix. This vulnerability is fixed in 8.30.0.
CVE-2026-6475
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVE-2026-6174
The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-6008
Authorization bypass through User-Controlled key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co. DijiDemi allows Privilege Abuse. This issue affects DijiDemi: from v4.5.12.1 before v4.5.13.0.
CVE-2026-6479
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVE-2026-8181
The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the `is_mainwp_authenticated()` function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.
CVE-2026-6473
Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVE-2026-6510
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This is due to missing nonce verification and capability checks in the iwar_save_recipe() AJAX handler. This makes it possible for unauthenticated attackers to create a malicious automation recipe that pairs an HTTP post trigger with an auto-login action, allowing any unauthenticated visitor to visit a crafted URL and receive authentication cookies for any targeted user account (e.g., administrator), achieving complete authentication bypass and privilege escalation.
CVE-2026-22599
Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type. Setting `defaultTo` as a tuple `[value, { isRaw: true }]` caused the value to be passed directly into Knex's `db.connection.raw()` during schema migration without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine, this enabled arbitrary file read via database utility functions, denial of service via forced server crash on schema-migration error, and on engines that permit external program execution, remote code execution against the database server. The patch in versions 4.26.1 and 5.33.2 addresses this by restricting all Content-Type Builder write APIs to development mode only. Production deployments running v5.33.2 or later return 404 for requests against `/content-type-builder/content-types` and related endpoints, removing the network-reachable attack surface entirely.
CVE-2026-1338
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to delete protected container registry tags due to improper authorization checks.
CVE-2026-5193
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.5.13. This is due to insufficient role validation in the 'register_user' function, which only blocks the 'administrator' role. This makes it possible for authenticated attackers, with author level access and above, to create new user accounts with elevated privileges such as editor.
CVE-2026-6477
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVE-2026-4030
The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check combined with a user-controlled backup directory parameter. This makes it possible for unauthenticated attackers to read and delete arbitrary files on the server, leading to Sensitive Information Exposure and potential site takeover. Note: This vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists.
CVE-2026-5365
The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 5.3.2. This is due to missing nonce verification on the request_cancellation() function. This makes it possible for unauthenticated attackers to cancel a logged-in customer's bookings via a forged request, granted they can trick the customer into performing an action such as clicking on a link.
CVE-2026-6637
Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVE-2026-4031
The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2. This is due to the plugin not restricting access to the wp_db_temp_dir parameter, which controls where database backups are written. This makes it possible for unauthenticated attackers to send a request to wp-cron.php with a poisoned wp_db_temp_dir value pointing to a publicly accessible directory (e.g., wp-content/uploads/), and if a scheduled backup is due, intercept the backup file before it is cleaned up. The backup file has a predictable name based on the database name, table prefix, date, and Swatch Internet Time, making interception reliable. Successful exploitation leads to Sensitive Information Exposure including database credentials, user password hashes, and personally identifiable information. This vulnerability requires that the site administrator has configured scheduled backups.
CVE-2026-41937
Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user when accessed via unauthenticated HTTP requests to the plugin's public path.
CVE-2026-6638
SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.
CVE-2026-1322
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with a read_api scoped OAuth application to create issues and add comments to issues in private projects due to improper authorization.
CVE-2026-4527
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to create unauthorized Jira subscriptions for a targeted user's namespace via a specially crafted link due to missing CSRF protection.
CVE-2026-5798
Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated attacker could exploit this vulnerability to access information about any employee (first names, last names, roles, job titles, and vacation records, among others) by modifying that identifier in requests sent to the server.
CVE-2026-3892
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.4.107. This is due to insufficient file path validation in the become-dealer logo upload flow. The plugin allows any authenticated user to set an arbitrary filesystem path via the profile update handler. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary files on the server.
CVE-2026-3074
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to download private debugging symbols from inaccessible projects due to improper access control.
CVE-2026-3073
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass PyPI package protection rules and upload restricted packages due to improper authorization checks.
CVE-2026-45205
Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles. This issue affects Apache Commons: from 2.2 before 2.15.0. Users are recommended to upgrade to version 2.15.0, which fixes the issue.
CVE-2026-8295
An integer overflow vulnerability in the simdjson document-builder API allows incorrect buffer size calculations in "string_builder::escape_and_append()" when processing very large input strings on platforms with limited "size_t" width (e.g., 32-bit builds). The overflow can cause insufficient buffer allocation, leading to out-of-bounds memory reads in SIMD routines and potentially resulting in information disclosure, memory corruption, or malformed JSON output. This vulnerability has been fixed in 4.6.4 release
CVE-2026-1184
GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by uploading a specially crafted file due to improper validation.
CVE-2026-7471
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with control of a virtual registry upstream to make requests to internal hosts due to improper validation.
CVE-2026-7377
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.
CVE-2026-6271
The Career Section plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7 via the CV upload handler. This is due to missing file type validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
CVE-2026-3694
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the bt_bb_button shortcode in all versions up to, and including, 5.6.8. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-46446
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
CVE-2026-6063
GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user with developer-role permissions to remove code owner approval rules from merge requests due to improper access control.
CVE-2026-46419
Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.
CVE-2026-7525
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to bypass the moderation and approval workflow by tampering with the POST body to publish events or set other unauthorized statuses such as cancelled or private, in ways their role does not permit. While the UI correctly restricts low-privilege users to a draft-only submit button, this restriction is enforced only client-side, making it trivially bypassable by directly manipulating the POST request.
CVE-2026-44308
Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support (@NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping) did not verify the signature of incoming SNS messages. An unauthenticated attacker who knows the endpoint URL could send crafted HTTP POST requests mimicking SNS Notification or SubscriptionConfirmation messages. This vulnerability is fixed in 4.0.2.
CVE-2026-44312
css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0.
CVE-2026-6145
The User Registration & Membership plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.1.5. This is due to the is_admin_creation_process() method relying solely on the presence of action=createuser in the $_REQUEST superglobal without performing any authentication or capability check. This makes it possible for unauthenticated attackers to bypass the admin approval requirement when registering new accounts via the fallback submission path.
CVE-2026-41933
Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset paths, plugins, themes, and media folders to view filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps.
CVE-2026-6514
The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVE-2026-6206
The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.1.2 via the _get_post_property_from_querystring() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
CVE-2026-6478
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVE-2026-6506
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2. This is due to the infusedwoo_gdpr_upddata() function missing authorization and capability checks, as well as lacking restrictions on which user meta keys can be updated. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their own wp_capabilities user meta to grant themselves Administrator role privileges.
CVE-2026-2900
GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-level approval rule editing prevention was enabled, could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks.
CVE-2026-5486
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'data[filter_search]' parameter in the get_cat_addons AJAX action in versions up to and including 2.0.7. This is due to insufficient input sanitization and the use of deprecated escaping functions combined with direct string concatenation in SQL query construction. The vulnerability is exacerbated because the normalizeAjaxInputData() function calls stripslashes() on all user input, removing the protection provided by WordPress's wp_magic_quotes() function. Subsequently, the filter_search parameter is escaped using the deprecated wpdb->_escape() function and then directly concatenated into a LIKE clause without using prepared statements. This makes it possible for authenticated attackers, with Contributor-level access and above (who can obtain a valid nonce through the Elementor editor), to inject arbitrary SQL commands and extract sensitive information from the database.
CVE-2026-6472
Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVE-2026-6417
The GLS Shipping for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failed_orders' parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVE-2026-5790
Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and ‘employeeID’ parameters. The lack of proper input sanitization allows an attacker to inject malicious code that is persistently stored in the database. When other users or administrators access the affected sections, the code executes in their browsers, enabling the theft of session cookies and account hijacking.
CVE-2026-4029
The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check. This makes it possible for unauthenticated attackers to export database tables, leading to Sensitive Information Exposure. Note: This vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists.
CVE-2026-46445
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
CVE-2026-6575
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL 18.4 are affected. Versions before PostgreSQL 18 are unaffected.
CVE-2026-8144
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with project membership to enumerate private group members due to missing authorization checks.
CVE-2026-3829
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'wple_basic_get_requests' function in all versions up to, and including, 7.8.5.10. This makes it possible for authenticated attackers, with subscriber level access and above, to reset the SSL setup state, force SSL to appear complete, and modify plan selection options.
CVE-2026-5396
The Fluent Forms plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 6.1.21. This is due to the SubmissionPolicy class authorizing submission-level actions (read, modify, delete, add notes) based on a user-supplied `form_id` query parameter. This makes it possible for authenticated attackers, with Fluent Forms Manager access restricted to specific forms, to read, modify status, add notes to, and permanently delete form submissions belonging to any other form by spoofing the form_id parameter to a form they are authorized for.
CVE-2026-1659
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted requests due to insufficient input validation.
CVE-2026-2347
Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Session Hijacking. This issue affects E-Commerce Website: before 4.5.001.
CVE-2026-6252
The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' block attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-3160
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to view Jira issues outside the configured project scope due to an integration filter functioning only as a display control rather than enforcing access boundaries as specified.
CVE-2026-5243
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to stored cross-site scripting via the `menu_hover_click` parameter of the Navigation Menu Lite widget in all versions up to, and including, 6.4.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-6670
The Media Sync plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.9 via the 'sub_dir' and 'media_items' parameters. This is due to insufficient validation of user-supplied file paths, which are not checked for directory traversal sequences or restricted to the intended uploads directory. This makes it possible for authenticated attackers, with Author-level access and above, to perform actions on files outside of the originally intended directory.
CVE-2026-6476
SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.
CVE-2026-6335
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user to execute arbitrary code in another user's browser session due to improper sanitization.
CVE-2026-6504
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tag' parameter in all versions up to, and including, 1.7.1058 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-7648
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to payment bypass through user-controlled key in all versions up to, and including, 4.3.5. This is due to improper handling of user-supplied request parameters in the REST API endpoint, which passes the unsanitized parameter array to the add_to_cart() function where array_merge() allows attacker-controlled values to overwrite hardcoded defaults. This makes it possible for authenticated attackers, with subscriber-level access and above, to enroll in any paid course entirely free of charge by supplying a quantity value of zero, which causes the order total to calculate as $0 and bypasses all payment gateway requirements.
CVE-2026-43905
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, jpeg2000input.cpp:395 computes buffer size as const int bufsize = w * h * ch * buffer_bpp using signed 32-bit arithmetic. When the product exceeds INT_MAX, the result wraps to 0 or a small value. m_buf.resize() allocates an undersized buffer, and subsequent pixel write loops cause heap overflow. Conditional on USE_OPENJPH build flag. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
CVE-2026-20182
Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
CVE-2026-42208
BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.
CVE-2026-6973
Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.
CVE-2026-0300
Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
Advanced Persistent Threats (APT)
Disclosing new PebbleDash-based tools
Kaspersky researchers conducted an in-depth analysis of Kimsuky APT activity, revealing tactical shifts and new malware variants based on the PebbleDash platform. The group introduced HelloDoor, a Rust-based backdoor, httpMalice leveraging HTTP and Dropbox communications, and updated MemLoad and httpTroy variants. Kimsuky maintains persistence through legitimate tools including VSCode Tunneling with GitHub authentication and DWAgent remote management software. Initial access occurs via spear-phishing with malicious attachments disguised as documents. The group primarily targets South Korean entities across government and defense sectors, with additional PebbleDash attacks observed in Brazil and Germany. Infrastructure relies on free South Korean hosting services and tunneling services like Cloudflare Quick Tunnels and Ngrok. Both PebbleDash and AppleSeed malware clusters demonstrate ongoing development with shared distribution methods, stolen certificates, and overlapping targets, indicating single-actor c...
Device Code Phishing is an Evolution in Identity Takeover
Device code phishing attacks have exploded across the threat landscape, with new toolkits emerging weekly. This surge coincides with publicly released criminal toolkits and multiple phishing-as-a-service offerings like EvilTokens and Tycoon. Threat actors abuse the OAuth 2.0 device authorization grant flow to compromise Microsoft 365 and other enterprise accounts by tricking users into authorizing malicious applications. Current implementations use on-demand code generation, addressing the 15-minute expiration limitation of previous techniques. Most activity appears to be generated using AI-based coding techniques. Successful attacks lead to full account takeover, data theft, business email compromise, and potential ransomware deployment. The technique represents the natural evolution of credential phishing as organizations improve their defenses against traditional multifactor authentication bypass methods.
Thus Spoke…The Gentlemen
On May 4th, 2026, The Gentlemen RaaS administrator acknowledged that an internal backend database called Rocket had been leaked, exposing nine accounts including zeta88, the program's effective administrator. The leak revealed internal discussions detailing initial access methods through Fortinet and Cisco edge appliances, NTLM relay, and credential logs, along with the group's role divisions and toolsets. Evidence shows evaluation of CVEs including CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073. Leaked ransom negotiations showed a successful payment of 190,000 USD. The group reused stolen data from a UK software consultancy to attack a Turkish company, employing dual-pressure tactics during negotiations. Analysis of ransomware samples identified eight distinct affiliate TOX IDs, indicating the administrator actively participates in infections alongside managing the RaaS program.
ClickFix Evolves with PySoxy Proxying
A sophisticated ClickFix campaign was observed in April 2026 deploying PySoxy, a decade-old open-source Python SOCKS5 proxy tool, to establish encrypted proxy access on compromised hosts. The attack chain begins with social engineering that tricks users into executing obfuscated PowerShell commands, which then establishes scheduled task persistence and deploys an in-memory PowerShell-based command-and-control agent. Following domain reconnaissance activities, attackers deploy PySoxy to create a redundant encrypted access channel. The persistence mechanism continues attempting re-execution even after initial connections are blocked, demonstrating how single ClickFix executions can evolve into modular post-exploitation chains. This development represents a significant evolution from simple one-time execution to durable access with multiple redundant pathways, requiring comprehensive remediation beyond blocking initial callbacks.
Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign
A sophisticated campaign linked to APT37 delivers Python-based backdoors through spear-phishing emails containing malicious LNK files disguised as legitimate documents. Attackers use themes including airline e-tickets, North Korea research invitations, and impersonation of defense and police officials to induce execution. The LNK files employ environment variable-based obfuscation techniques to download additional BAT files, which establish a Python runtime environment and execute compiled Python bytecode disguised with .cat extensions. The malware functions as a remote command execution backdoor, communicating with C2 servers to receive commands and exfiltrate results. Persistence is maintained through scheduled tasks executing at one-minute intervals. The campaign shows strong tactical similarities to previous APT37 operations, including infrastructure patterns, script obfuscation methods, and the abuse of legitimate tools.
LBIOC-20260071 - The Gentlemens Leak
The Gentlemen is an active ransomware and extortion operation that emerged publicly in the second half of 2025, rapidly escalating into a high-volume threat actor. The group appears to be a continuation or reorganization of prior ransomware affiliate activity, with reported connections to the Qilin ecosystem and the Russian-speaking actor 'hastalamuerte.' This growth likely reflects existing ransomware experience, affiliate relationships, and access to established resources. Underground sources indicate attempts to sell data allegedly connected to The Gentlemen ransomware activity, though the available information lacks sufficient victim-specific or technical details to confirm authenticity. The operation utilizes SystemBC for command and control communications and deploys ransomware variants targeting both Windows and Linux systems.
Iran-Linked Hackers Breached Korean Electronics Maker in Global Spying Campaign
Iranian state-sponsored threat group Seedworm conducted a widespread espionage campaign in early 2026, compromising at least nine organizations across nine countries on four continents. Victims included a major South Korean electronics manufacturer, government agencies, an international airport in the Middle East, Southeast Asian industrial manufacturers, a Latin American financial services provider, and educational institutions. The attackers utilized DLL sideloading techniques with legitimately signed Fortemedia and SentinelOne binaries to execute malicious payloads, deployed Node.js-based implants for orchestration, and employed multiple PowerShell scripts for reconnaissance, credential theft, and privilege escalation. Data exfiltration was conducted through public file-transfer service sendit.sh to blend malicious traffic with legitimate cloud services. The campaign demonstrates Seedworm's evolved tradecraft and expanded targeting beyond traditional Middle Eastern focus areas.
TanStack npm Packages Compromised in Ongoing Supply-Chain Attack
Socket detected 84 compromised TanStack npm package artifacts modified with credential-stealing malware targeting CI systems, including GitHub Actions. Affected packages like @tanstack/react-router have over 12 million weekly downloads. The malicious versions contain router_init.js, a heavily obfuscated file with daemonization capabilities and environment variable access for GitHub Actions secrets. The compromise exploited GitHub Actions cache poisoning and pull_request_target patterns to extract OIDC tokens and authenticate malicious npm publishes through trusted-publisher bindings. The malware harvests credentials from GitHub Actions, AWS (IMDS, Secrets Manager, SSM), HashiCorp Vault, and Kubernetes, while establishing persistence in Claude Code and VS Code directories. Exfiltration occurs through Session's decentralized P2P network. The campaign includes self-propagation mechanisms that steal npm OIDC tokens and autonomously republish compromised packages. Updates indicate expansion to OpenSearch, Mistr...
Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America
Two distinct threat campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, have been identified targeting government entities and financial organizations across Latin America using agentic artificial intelligence to conduct cyber intrusions. SHADOW-AETHER-040, a Spanish-speaking group, compromised six government entities in Mexico between December 2025 and January 2026, while SHADOW-AETHER-064, operating in Portuguese, targeted Brazilian financial institutions starting in April 2026. Both campaigns established SOCKS5 tunnels via ProxyChains and SSH, enabling AI agents to execute commands directly within victim networks. The AI agents dynamically generated hacking tools and scripts on-demand, reducing detection by signature-based security solutions. Despite tactical similarities including shared toolsets like Chisel, Neo-reGeorg, CrackMapExec, and Impacket, the campaigns appear to be separate entities distinguished primarily by language. These operations represent emerging cases of AI agents executing complete...
Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware
An intrusion was observed in April 2026 where threat actors deployed EtherRAT malware through a malicious MSI installer disguised as a Sysinternals tool. The malware utilized Ethereum blockchain via EtherHiding for dynamic C2 configuration updates. Following reconnaissance activities, actors deployed TukTuk malware framework using DLL sideloading techniques with legitimate applications like Greenshot and SyncTrayzor. TukTuk established C2 channels through SaaS platforms including ClickHouse and Supabase, with backup channels via Ably, Dropbox, and GitHub Issues. The actors performed Kerberoasting, credential theft via Mimikatz and LSASS dumping, and deployed GoTo Resolve RMM tooling for lateral movement. Data exfiltration to Wasabi cloud storage was conducted using Rclone before deploying The Gentlemen ransomware domain-wide through a malicious GPO. The intrusion leveraged blockchain infrastructure, SaaS platforms, and decentralized services to evade traditional network defenses.
Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication
A sophisticated multi-stage infection chain was identified through proactive threat hunting, beginning with the execution of MicrosoftToolkit.exe, a commonly abused hack tool. The attack employed file masquerading techniques, renaming a .dot file to .bat format to evade detection. The malware performed process discovery and attempted to terminate security-related processes before extracting payloads using extract32.exe. An AutoIt-compiled executable (Replies.scr) functioned as a loader, processing an external encrypted payload file and establishing command-and-control communication with infrastructure associated with Vidar Stealer. The malware demonstrated advanced anti-analysis capabilities, including debugger detection and instrumentation callback queries. It targeted credentials, browser data, cryptocurrency wallets, and system information. Post-execution cleanup routines deleted artifacts and terminated processes to minimize forensic evidence and evade detection, significantly complicating incident res...
Website installer incident (May 2026)
In early May 2026, attackers compromised the official JDownloader website by manipulating specific installer download links through the content management system. Between May 6-7, 2026 (UTC), users who downloaded Windows installers via "Download Alternative Installer" links or the Linux shell installer were redirected to malicious third-party files instead of genuine installers. The attackers gained CMS-level access only, not server or filesystem control. The incident was detected on May 7 via Reddit alerts, and the server was immediately taken offline. Malicious links were removed, legitimate links restored, and security hardened before the site resumed normal operations on May 8-9. In-app updates and other download paths remained unaffected. Users who executed downloaded installers during the risk window are advised to perform clean OS reinstalls and change passwords from trusted devices.
Poisoning the well: AI supply chain attacks on Hugging Face and OpenClaw
Threat actors are actively exploiting AI distribution platforms like Hugging Face and ClawHub to deliver malware by embedding malicious code within models, datasets, and agent extensions. Over 575 malicious skills across 13 developer accounts were identified in the OpenClaw ecosystem, targeting Windows and macOS with trojans, cryptominers, and AMOS stealer. Attackers abuse trust relationships between users and AI platforms through indirect prompt injection, where hidden instructions cause AI agents to execute malicious actions on behalf of users. Trojanized skills masquerade as legitimate tools while instructing users to execute encoded commands or install hidden malicious dependencies. On Hugging Face, repositories host payloads within multistep infection chains disguised as legitimate applications. These campaigns employ social engineering, obfuscation, encryption, in-memory execution, process injection, and persistence techniques to evade detection while establishing covert command-and-control communica...
New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps
A new variant of the TrickMo Android banking trojan was identified between January and February 2026, representing a substantial platform redesign rather than new capabilities. The malware has migrated its command-and-control infrastructure entirely onto The Open Network (TON) using .adnl endpoints, moving away from conventional internet infrastructure. Active campaigns have targeted banking and wallet users in France, Italy, and Austria. Once accessibility permissions are granted, operators gain real-time device control including credential phishing, keylogging, screen recording, SMS interception, and bidirectional remote control. New features include network reconnaissance capabilities and SSH tunnelling that transform infected devices into programmable network pivots and SOCKS5 proxy exit nodes, enabling operators to bypass IP-based fraud detection systems while accessing victim networks.
Honeypot reveals botnet exploiting scriptText to launch DDoS attacks on game servers
Analysts observed attackers exploiting a Jenkins honeypot to deploy a new DDoS botnet targeting video game servers. Leveraging Jenkins scriptText abuse, the threat actors achieved remote code execution by sending malicious Groovy scripts to intentionally misconfigured instances with weak passwords. The multi-platform payload targets both Windows and Linux systems, deploying malware that evades detection through process renaming and daemonization. The botnet supports multiple attack vectors including UDP floods, TCP attacks, HTTP requests, and game-specific techniques targeting Valve Source Engine servers. Infrastructure hosted in Vietnam serves dual purposes for payload distribution and command-and-control communications. The campaign demonstrates continued opportunistic exploitation of internet-facing services, with gaming industry servers being primary targets for distributed denial-of-service attacks.
Inside a phishing panel
Security researchers gained direct access to Doko's Panel, a real-time phishing platform used in criminal campaigns by ShinyHunters and BlackFile groups. The investigation revealed four distinct infrastructure clusters operating independently customized variants of the tooling. Attacks combine voice phishing with adversary-in-the-middle techniques targeting enterprise identity providers like Okta, Microsoft, and Google, as well as cryptocurrency exchanges. Operators call victims impersonating IT helpdesk staff, directing them to combosquatted domains where credentials and MFA tokens are manually relayed in real-time. Confirmed breaches include SoundCloud (30M records), Match Group (10M records), Betterment (20M records), and Crunchbase. Over 400 domains have been identified linked to these operations. Evidence shows extensive use of AI language models in developing phishing infrastructure, with operators leveraging legitimate services to rapidly deploy and rotate attack infrastructure.
Needle: Inside a Modular Crypto-Stealing C2 That Left Its Keys in the Malware
A modular Malware-as-a-Service crypto-stealing platform called Needle has been discovered actively targeting cryptocurrency wallets through two main attack vectors: a browser extension spoofer targeting MetaMask, Phantom, and Trust Wallet, and a Rust-based desktop agent impersonating Exodus, Trezor, and Ledger applications. The campaign compromised 1,932 victims, including 111 browser extension users and 1,821 desktop sessions. The Rust agent embedded its C2 API key without protection, enabling complete enumeration of victims and withdrawal configurations across six blockchains. The operator's EVM hot wallet moved approximately $148 in ETH to cold storage. The panel's React SPA performed authentication entirely client-side, and the same credential used by infected machines could potentially redirect future auto-withdrawals. Infrastructure is hosted on ASN 202412, a known bulletproof hosting provider in Amsterdam.
Mysterious hacker organization operating secretly for 6 years is exploiting critical cPanel vulnerability to deploy backdoor trojans
A previously unknown threat group designated Mr_Rot13 has been exploiting CVE-2026-41940, a critical authentication bypass vulnerability in cPanel & WHM, to compromise Linux servers globally. Active since at least 2020, the group deploys a Go-based payload installer that plants SSH keys, PHP webshells, malicious JavaScript for credential harvesting, and a cross-platform remote access tool called Filemanager. Stolen data is exfiltrated to attacker-controlled Telegram channels and command servers. The group has maintained operational security for six years with extremely low detection rates. Attack infrastructure includes domains registered as early as 2020, with over 2,000 attacking IP addresses observed worldwide. The campaign primarily targets cPanel installations and WordPress systems, with confirmed compromise of Southeast Asian government and military entities resulting in 4.37GB of sensitive data theft.
OPERATION SILENTCANVAS: JPEG BASED MULTISTAGE POWERSHELL INTRUSION
A sophisticated multi-stage intrusion campaign was identified leveraging a weaponized PowerShell payload disguised as a JPEG image file (sysupdate.jpeg) to deploy a trojanized ConnectWise ScreenConnect instance for covert remote access. The attack likely originates through social engineering techniques including phishing emails or malicious attachments. Upon execution, the malware establishes a staging environment, retrieves additional payloads from attacker-controlled infrastructure, and dynamically compiles a custom launcher using Microsoft's legitimate .NET compiler (csc.exe) to evade detection. The intrusion abuses ComputerDefaults.exe and a malicious ms-settings registry hijack to perform a fileless UAC bypass and obtain elevated privileges. Once elevated, the malware deploys a persistent service masquerading as OneDriveServers and launches a modified ScreenConnect framework capable of credential interception, remote command execution, surveillance operations, SYSTEM-level execution, encrypted command...
Technical Advisory: Breach of Instructure Canvas LMS
In early May 2026, Instructure confirmed a breach affecting its Canvas learning platform after detecting unauthorized activity on May 1. ShinyHunters exploited the Free-For-Teacher account program, compromising the Canvas platform directly and exposing names, email addresses, student IDs, and private messages. The exposure window ran from April 30 to May 7, 2026. ShinyHunters claims 3.6 TB of data covering approximately 275 million users across 9,000 schools globally, including institutions in the US, Australia, and EU. This represents ShinyHunters' second attack against Instructure in eight months. Instructure shut down the Free-For-Teacher program permanently, rotated API keys and privileged credentials, and engaged forensic investigators. The stolen data enables personalized phishing campaigns targeting students and faculty, with attackers potentially having write access sufficient to deface login pages at multiple institutions.
Abuse of Cloud-Native Infrastructure in Modern Phishing Campaigns
An investigation has revealed a structural evolution in phishing operations where threat actors conduct entire campaigns through legitimate, enterprise-trusted cloud infrastructure rather than attacker-controlled systems. Adversaries weaponize platforms employees use daily, including cloud storage, productivity suites, and OAuth authentication endpoints. Attacks originate from legitimate Google or Microsoft systems, passing all authentication checks while linking to whitelisted cloud services. Multi-factor authentication is bypassed without touching passwords, and victim organizations show no anomalous SIEM events at compromise time. Campaigns employ five stages: delivery via provider-owned infrastructure, payload hosting on legitimate cloud storage, execution within browser memory using native APIs, credential theft through legitimate authentication flows, and persistent presence through licensed services. Detection requires behavioral analysis rather than traditional indicators, as attackers operate enti...
AI-Assisted Lure Factory Targets Developers & Gamers
A large-scale malware campaign tracked as TroyDen's Lure Factory has been identified distributing LuaJIT-based infostealers through over 300 delivery packages hosted on GitHub. The operation uses AI-generated lure names incorporating obscure biological taxonomy and medical terminology to target developers, gamers, Roblox players, and crypto users. The malware employs a two-component design with a renamed LuaJIT runtime and encrypted Lua payload that evades sandbox detection through anti-analysis checks and extreme sleep delays. Upon execution, it disables proxy detection, captures desktop screenshots, performs geolocation, and exfiltrates data to C2 servers in Frankfurt. The infrastructure demonstrates scalability with multiple IP addresses serving identical encrypted commands, while maintaining simultaneous campaigns across gaming cheats, developer tools, phone trackers, and VPN crackers.
Threat Actors Weaponize Tiflux RMMs in Malspam Attacks
Since late February, there has been an uptick in incidents involving Tiflux, a lesser-known Brazilian commercial remote management tool being weaponized by threat actors. The attack chain begins with phishing emails containing fake document lures that deliver a malicious MSI installer. Once executed, the installer deploys multiple remote access tools including UltraVNC, Splashtop, and ScreenConnect for persistent access. The Tiflux installer contains concerning components such as outdated VNC versions from 2014, expired certificates, hardcoded passwords, and a vulnerable HwRwDrv.sys driver known for privilege escalation abuse. The threat actors leverage these tools to establish persistence, capture screenshots, and collect system profiling information. This campaign exemplifies the continuing pattern of adversaries abusing legitimate remote management software for stealthy access to victim environments while chaining multiple tools together to maintain control.
PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale
PCPJack is a sophisticated credential theft framework that propagates across exposed cloud infrastructure while systematically removing artifacts linked to TeamPCP, a threat actor behind notable 2026 supply chain compromises. The toolset harvests credentials from cloud platforms, containers, developer tools, productivity applications, and financial services, exfiltrating data through attacker-controlled infrastructure. It targets exposed Docker, Kubernetes, Redis, MongoDB, RayML services and vulnerable web applications, enabling external propagation and lateral movement. Unlike typical cloud malware, PCPJack deploys no cryptominers, focusing instead on credential theft for monetization through fraud, spam campaigns, extortion, or access resale. The framework uses modular Python scripts orchestrated by a central component, employs Common Crawl data for target selection, and utilizes Telegram for command and control communications.
5 Malicious NuGet Packages Impersonate Chinese UI Libraries to Distribute Crypto Wallet and Credential Stealer
Five malicious NuGet packages published under account bmrxntfj impersonate Chinese .NET libraries to deploy an infostealer targeting browser credentials, cryptocurrency wallets, SSH keys, and local files. The packages typosquat legitimate Chinese UI and infrastructure libraries, grafting .NET Reactor-protected payloads onto decompiled legitimate code. The campaign uses version rotation to evade hash-based detection, with 219 of 224 total versions unlisted but fetchable. The stealer targets 12 browsers, 8 desktop crypto wallets, and 5 browser wallet extensions, exfiltrating data to a newly-registered C2 domain. With approximately 65,000 downloads across all versions, the campaign puts tens of thousands of developer workstations and CI/CD build servers at risk. The payload executes through .NET module initializers, hooks the CLR JIT compiler, and supports cross-platform infection including Linux and macOS infrastructure.
Donuts and Beagles: Fake Claude site spreads backdoor
A fraudulent website impersonating Anthropic's Claude AI platform has been distributing a previously undocumented backdoor called Beagle through malvertising campaigns. The attack begins when victims download a fictitious tool named Claude-Pro Relay from claude-pro[.]com, delivered as a 505 MB ZIP archive. The infection chain utilizes DLL sideloading, exploiting a signed G DATA antivirus updater to load malicious code. The technique mirrors PlugX delivery methods but deploys different payloads. Beagle supports eight commands including shell execution, file transfer, and directory listing, communicating with C2 servers using AES encryption. Related samples dating to February 2026 have been identified, with some variants delivering AdaptixC2 framework. Additional domains impersonated security vendors like Trellix, CrowdStrike, and SentinelOne. The infrastructure spans Cloudflare for distribution and Alibaba Cloud for command and control.
Direct-Sys Loader and CGrabber Stealer Five-Stage Malware Chain
A sophisticated five-stage malware operation delivers two new malware families: Direct-Sys Loader and CGrabber Stealer. The attack begins with ZIP archives distributed via GitHub user attachment URLs, exploiting a legitimate Microsoft-signed binary (Launcher_x64.exe) for DLL sideloading. Direct-Sys Loader employs ChaCha20 encryption, direct syscall execution, and multiple anti-analysis checks including text file verification, enumeration of 67 analysis tool processes, and hypervisor detection. CGrabber Stealer collects extensive system metadata, browser credentials, cryptocurrency wallets, password managers, VPN configurations, and application artifacts from over 150 applications and extensions. The stealer excludes CIS region systems and uses ChaCha20 encryption with HMAC SHA256 authentication for data exfiltration via custom HTTP headers. Both families share identical cryptographic implementations, suggesting common development origin and representing operationally mature infrastructure designed for larg...
Dissecting macOS intrusion from lure to compromise
Microsoft Threat Intelligence uncovered a macOS-focused cyber campaign by North Korean threat actor Sapphire Sleet utilizing social engineering to compromise systems. The attack chain begins with a malicious AppleScript file disguised as a Zoom SDK update, which executes cascading payloads through curl-to-osascript chains. The campaign deploys multiple backdoors including com.apple.cli, services, icloudz, and com.google.chromes.updaters for persistence and command execution. Credential harvesting occurs through fake system dialogs that mimic legitimate macOS password prompts. The threat actor bypasses Transparency, Consent, and Control protections by directly manipulating the TCC database, enabling extensive data exfiltration targeting cryptocurrency wallets, browser credentials, Telegram sessions, SSH keys, and Apple Notes. Operations focus on cryptocurrency, finance, and blockchain organizations with the primary objective of stealing digital assets.
Takes Aim at the Ransomware Throne
In February 2025, BlackBasta ransomware operations ceased after their internal chat logs were leaked online, leading to disbandment. However, former affiliates continued launching attacks using different ransomware families, including the relatively unknown Payouts King group that emerged in April 2025. ThreatLabz has observed continued ransomware activity consistent with former BlackBasta initial access brokers since early 2026, utilizing similar tactics including spam bombing, Microsoft Teams phishing, and Quick Assist abuse. Payouts King implements sophisticated evasion techniques including stack-based string obfuscation, API hashing, and direct system calls to terminate security processes. The ransomware leverages 4,096-bit RSA and 256-bit AES counter mode encryption, selectively encrypting files while targeting security software and employing anti-forensics techniques like shadow copy deletion and event log clearing.
Joomla SEO Spam Injector: Obfuscated PHP Backdoor Hijacking Site Visitors
A compromised Joomla website displayed suspicious product links unrelated to the business. Investigation revealed heavily obfuscated PHP code injected at the top of index.php that contacted external command-and-control servers to receive instructions and manipulate content. The malware acts as a remote loader, assembling strings from two-character chunks to evade signature-based detection. It contacts primary C2 cdn.erpsaz.com and fallback cdn.saholerp.com, sending server fingerprint data and receiving dynamic instructions. Based on responses, it redirects visitors, injects spam content, or serves fake SEO pages to search engines. This approach allows attackers to control compromised sites remotely without modifying local files again, enabling dynamic spam injection, visitor redirection, and search engine manipulation while remaining undetected for extended periods.
A Deep Dive Into Attempted Exploitation of CVE-2023-33538
Active exploitation attempts targeting CVE-2023-33538 in end-of-life TP-Link Wi-Fi routers were identified after CISA added it to the KEV catalog in June 2025. The vulnerability affects several router models including TL-WR940N, TL-WR740N, and TL-WR841N. Observed attacks attempted to deploy Mirai-like botnet malware, specifically variants associated with the Condi IoT botnet. Through firmware emulation and reverse engineering, researchers confirmed the vulnerability exists but discovered that successful exploitation requires authentication. The in-the-wild attacks contained critical flaws: they targeted the wrong parameter (ssid instead of ssid1), lacked authentication, and relied on utilities not present in the router firmware. The command injection vulnerability in the WlanNetworkRpm endpoint allows remote attackers to execute arbitrary commands when authenticated. The malware establishes C2 communication and propagates across architectures. TP-Link confirmed affected devices are end-of-life with no patc...
Beyond the breach: inside a cargo theft actor's post-compromise playbook
A cargo theft threat actor maintained access to a decoy environment for over a month, providing extensive visibility into post-compromise operations. The attacker established redundant persistence using multiple remote access tools, including four ScreenConnect instances, Pulseway RMM, and SimpleHelp RMM. A previously unknown signing-as-a-service capability was employed to evade detection by re-signing ScreenConnect installers with fraudulent code-signing certificates. Extensive reconnaissance targeted financial platforms, payment systems, cryptocurrency wallets, and transportation-specific services including fuel card providers, fleet payment platforms, and load board operators. The activity strongly aligns with financially motivated crimes against the transportation industry, including freight diversion and cargo theft operations.
CVE-2026-39987 update: How attackers weaponized marimo to deploy a blockchain botnet via HuggingFace
Three days after disclosure of a critical pre-authorization remote code execution vulnerability in the marimo Python notebook platform, multiple threat actors deployed malware hosted on HuggingFace Spaces. A previously undocumented NKAbuse variant was delivered through a typosquatted HuggingFace Space, utilizing NKN blockchain for command and control. Between April 11-14, 2026, eleven unique source IPs across ten countries generated 662 exploit events. Attack patterns included reverse shell campaigns, credential extraction targeting AWS keys and API tokens, DNS exfiltration, and lateral movement to PostgreSQL and Redis databases via leaked credentials. The malware binary was disguised as a legitimate Kubernetes tool named kagent and implemented persistence through systemd services, crontab entries, and macOS LaunchAgents. This operation demonstrates threat actors specifically targeting AI/ML infrastructure and leveraging trusted platforms for malware distribution.
Silent Crypto Wallet Takeover Unlimited USDT Approval Exploitation via Trust Wallet QR Code Phishing
An active campaign targets Trust Wallet users through malicious QR codes distributed via Telegram, exploiting deep link mechanisms to redirect victims to Netlify-hosted phishing domains. The attack masquerades as a legitimate USDT transfer interface but covertly triggers an ERC-20 approve() transaction, granting unlimited token allowance to an attacker-controlled contract on BNB Smart Chain. This enables persistent fund drainage without further victim interaction. The modular drainer architecture uses config.js for control parameters and main.js for execution logic, with integrated Telegram bot infrastructure providing real-time transaction monitoring. Analysis confirms 52 transaction notifications indicating active exploitation. The campaign employs social engineering through a deceptive dollar-one illusion where victims believe they are initiating small transactions while actually granting unlimited wallet access. Multiple cloned phishing domains demonstrate scalable deployment within a Drainer-as-a-Servic
Fake YouTube copyright notices can steal your Google login
A sophisticated phishing campaign is targeting YouTube creators using convincing fake copyright strike notifications. The attack dynamically pulls real channel data including profile pictures, subscriber counts, and recent videos to create personalized scare pages. Victims are funneled through a Browser-in-the-Browser attack displaying a fake Google sign-in that captures credentials. The operation functions as phishing-as-a-service, with multiple attackers sharing infrastructure and rotating domains to evade detection. Successful attacks result in complete Google account takeover, allowing hijackers to rebrand channels and livestream cryptocurrency scams to existing audiences. The kit automatically exempts channels with over three million subscribers to avoid detection by security teams.
From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere
Multiple campaigns are distributing NWHStealer through diverse platforms including fake VPN downloads, hardware utilities, and gaming modifications. The infostealer collects browser data, saved passwords, and cryptocurrency wallet information. Distribution occurs via fake websites impersonating legitimate services like Proton VPN, code hosting platforms such as GitHub and GitLab, file hosting services including MediaFire and SourceForge, and links from YouTube videos. Two primary infection methods are analyzed: one using a free web hosting provider distributing malicious ZIP files with self-injection loaders, and another employing fake websites with DLL hijacking techniques that inject into the RegAsm process. The stealer targets over 25 cryptocurrency wallets and multiple browsers, exfiltrating data to command-and-control servers using AES-CBC encryption and maintaining persistence through scheduled tasks and UAC bypass techniques.
The n8n n8mare: How threat actors are misusing AI workflow automation
Investigation reveals widespread abuse of n8n, an AI workflow automation platform, in sophisticated phishing campaigns from October 2025 through March 2026. Attackers exploit the platform's webhook functionality to deliver malware and fingerprint devices while bypassing security filters through trusted infrastructure. Email volume containing n8n webhook URLs increased by 686% between January 2025 and March 2026. Observed campaigns utilize CAPTCHA-protected pages to deliver remote access tools including modified Datto RMM and ITarian Endpoint Management software. The webhooks mask malicious payload sources behind legitimate n8n domains. Additional abuse cases involve tracking pixels embedded in emails for device fingerprinting. These attacks demonstrate how legitimate productivity and automation platforms can be weaponized, requiring behavioral detection approaches rather than simple domain blocking to protect organizational workflows.
New ransomware targets Turkey via Adwind RAT
A threat cluster has been identified leveraging a customized Adwind (Java RAT) variant with polymorphic characteristics to deliver JanaWare ransomware. The campaign specifically targets Turkish users through geofencing mechanisms that check system locale and external IP geolocation. Active since at least 2020, the operation primarily affects home users and small to medium-sized businesses. Initial access occurs via phishing emails with malicious Java archives distributed through Google Drive links. The ransomware employs AES encryption and communicates over Tor networks, demanding modest ransoms between $200-$400. The malware uses multiple obfuscation techniques including Stringer and Allatori obfuscators, implements file pumping for polymorphism, and disables Windows security features before encryption. Victims are instructed to contact attackers through qTox or dedicated Tor onion sites.
A new Mac stealer targeting $10K+ crypto wallets
A sophisticated macOS stealer called notnullOSX emerged in March 2026, developed by threat actor alh1mik (formerly 0xFFF) who returned after a 2023 exit from underground forums. This Go-written modular stealer exclusively targets macOS users with cryptocurrency holdings exceeding $10,000. Distribution occurs through ClickFix social engineering and malicious DMG files disguised as legitimate applications like WallSpace. The malware employs a modular architecture with specialized components to exfiltrate iMessage history, Apple Notes, browser credentials, Safari cookies, crypto wallet files, SSH keys, and cloud provider credentials. By social-engineering victims into granting Full Disk Access, notnullOSX bypasses macOS TCC protections without triggering permission dialogs. The stealer maintains persistent WebSocket connections to Firebase infrastructure, functioning as both an infostealer and backdoor with remote module update capabilities.
Chasing an Angry Spark
In spring 2022, a highly sophisticated backdoor named AngrySpark was discovered on a single machine in the United Kingdom. The malware employed a three-stage architecture: a DLL masquerading as a Windows Task Scheduler component, a custom virtual machine interpreter running bytecode instructions, and a beacon that profiles systems while disguising C2 communications as PNG image requests. The malware featured VM-based obfuscation, dual encrypted C2 channels using RSA-4096 and XXTEA encryption, direct syscalls bypassing usermode hooks, hypervisor detection, and CET-aware anti-analysis capabilities. It operated for approximately one year with active maintenance visible through syscall table updates and configuration changes between May 2022 and January 2023. The infrastructure expired in mid-2023 and the operation ceased, with no additional samples or victims identified despite the significant engineering effort invested in its development.
108 Chrome Extensions Linked to Data Exfiltration and Session Theft via Shared C2 Infrastructure
A coordinated campaign of 108 malicious Chrome extensions operated through shared command-and-control infrastructure at cloudapi[.]stream has been identified, collectively accounting for approximately 20,000 installations. The campaign spans multiple threat categories: 54 extensions steal Google account identities via OAuth2, one extension actively exfiltrates Telegram Web sessions every 15 seconds, and 45 extensions contain a universal backdoor enabling arbitrary URL execution on browser startup. Published under five distinct publisher identities (Yana Project, GameGen, SideGames, Rodeo Games, and InterAlt), these extensions masquerade as legitimate tools including Telegram sidebar clients, slot games, YouTube and TikTok enhancers, and translation utilities. All extensions route stolen credentials, user identities, and browsing data to servers controlled by the same operator, with infrastructure confirming a Malware-as-a-Service business model.
59 Victims, Zero Authentication: A ClickFix Campaign Force-Installs a Chrome Extension Banking Stealer and Leaves the Entire C2 Wide Open
A Brazilian banking fraud operation leveraging ClickFix social engineering was discovered through a community tip, exposing a completely unauthenticated command-and-control infrastructure. The campaign deploys a malicious Chrome extension masquerading as a Banco Central do Brasil tool, force-installed via Chrome Cloud Management enrollment tokens. The extension achieves zero antivirus detections while targeting eight Brazilian financial institutions. At investigation time, 59 machines were compromised with seven active connections. The operator's C2 server exposed all endpoints without authentication, including admin panels, live victim screenshots, stolen credentials in cleartext, and intercepted Pix payment data. Attribution was established through WHOIS records revealing the operator's real name, CPF, and email address. The operation specifically targeted Northern Brazilian regional banks and credit cooperatives, with evidence of compromising a school fund account.
Pretexting-Based Targeted Intrusion: Analysis of Facebook Reconnaissance and Software Tampering Attacks
APT37 conducted a sophisticated social engineering campaign utilizing Facebook accounts claiming locations in Pyongyang and Pyongsong, North Korea, to conduct reconnaissance and build trust with targets. After establishing relationships through Facebook Messenger, the threat actor migrated conversations to Telegram and employed pretexting tactics, claiming to share encrypted PDF documents containing military weapons information. Victims were persuaded to install a tampered Wondershare PDFelement installer that executed embedded shellcode for initial compromise. The attack chain delivered follow-on commands through a JPG-disguised payload hosted on a compromised Japanese real estate website. The malware abused Zoho WorkDrive OAuth2 APIs as C2 channels, exfiltrating screenshots, documents, system information, and audio files. The campaign employed multiple evasion techniques including code cave injection, process hollowing into legitimate dism.exe, XOR encryption layers, and fileless in-memory execution.
Q1 2026 Malware Statistics Report for Linux SSH Servers
Analysis of attacks against Linux SSH servers during Q1 2026 reveals P2PInfect worm as the dominant threat, representing 70.3% of all attack sources. DDoS botnets including Mirai, XMRig, Prometei, and CoinMiner were identified as primary threats. A notable campaign involved installing V2Ray proxy tools on compromised systems, attributed to a suspected Chinese threat actor. Attackers employed SSH brute-force techniques to gain access, executed reconnaissance commands to assess system information, and deployed V2Ray for proxy node operations. The campaign targeted poorly secured SSH servers with weak credentials, emphasizing the need for strong password policies, access controls, and network monitoring to detect unusual outbound connections and proxy-related activities.
Q1 2026 Malware Statistics Report for Windows Database Servers
During the first quarter of 2026, Windows-based MS-SQL and MySQL database servers experienced consistent malicious attacks with a temporary decrease in February before rising again in March. The primary threat actor, Larva-26002, leveraged various utilities including BCP, curl, bitsadmin, and PowerShell to deploy a Go-based scanner called ICE Cloud, which contained Turkish language strings and C&C-based scanning capabilities. This tool attempted MS-SQL authentication using predefined credentials. Attack methods primarily consisted of brute force attacks, dictionary attacks, and exploitation of unpatched systems with misconfigured accounts stemming from inadequate account management practices.
Q1 2026 malware statistics report for Windows web servers
Analysis of Windows web server attacks during Q1 2026 reveals that Internet Information Services (IIS) and Apache Tomcat servers face persistent threats through web shell exploitation. The Larva-26001 threat actor has been targeting domestic IIS servers for several years, deploying privilege escalation tools including JuicyPotato, BadPotato, and exploiting CVE-2019-1458. Following privilege escalation, attackers utilize port-forwarding tools like HTran and PortTranC to redirect traffic to RDP port 3389, enabling remote control of compromised systems. Attack vectors include file upload vulnerabilities, Web Framework-WAS vulnerabilities, and unpatched RCE services. Additional malicious activities involve deployment of backdoors, CoinMiners, and proxy tools for internal network compromise.
March 2026 CVE Landscape: 31 High-Impact Vulnerabilities Identified, Interlock Ransomware Group Exploits Cisco FMC Zero-Day
In March 2026, 31 high-impact vulnerabilities were identified requiring prioritization for remediation, with 29 receiving Very Critical Risk Scores. Affected vendors included Cisco, Microsoft, Google, ConnectWise, and others, with Microsoft and Apple accounting for approximately 32% of vulnerabilities. Notably, the Interlock Ransomware Group exploited CVE-2026-20131, a zero-day deserialization vulnerability in Cisco Secure Firewall Management Center, as early as January 2026 to compromise enterprise networks. The group deployed custom remote access trojans and facilitated ransomware operations through crafted HTTP requests executing arbitrary Java code as root. Additional campaigns involved the DarkSword iOS exploit kit delivering GHOSTKNIFE, GHOSTSABER, and GHOSTBLADE payloads, and the Coruna exploit kit deploying PlasmaLoader malware. Nine vulnerabilities enabled remote code execution across multiple platforms. One vulnerability dated back nine years, emphasizing continued exploitation of legacy unpatched
Adobe Reader 0-day
On April 7, 2026, a security researcher described an Adobe Reader zero-day vulnerability that has been exploited since at least December 2025. The vulnerability allows threat actors to execute privileged Acrobat APIs via specially crafted malicious PDF files that execute obfuscated JavaScript when opened. Exploitation allows attackers to steal sensitive user and system data and to potentially launch additional attacks and remotely execute code. Recommendations: Reduce the risk by automatically scanning PDF email attachments, blocking suspicious files, training users to be wary of unsolicited attachments, and advising users to temporarily avoid using Adobe Reader to open PDFs. Reference: https://www.sophos.com/en-us/blog/adobe-reader-zero-day-vulnerability-in-active-exploitation
Polymarket Trader Funds at Risk: DPRK npm Package Steals Wallet Keys and Installs SSH Backdoor
On April 10, 2026, a malicious npm package named sleek-pretty@1.0.0 was published, targeting developers running automated trading bots on Polymarket, a prediction market platform with $477 million in open interest. The package executes four attack chains upon import: system fingerprinting, SSH backdoor installation on Linux hosts, filesystem exfiltration, and targeted theft of Polymarket CLOB API credentials and Ethereum/Polygon wallet private keys. The payload runs at require() time without install hooks and specifically hunts SDK source files like createClobClient.ts and clob.ts. An SSH public key is written to authorized_keys for persistent access. The attacker can drain USDC balances directly using stolen L1 private keys. Attribution points to DPRK's Famous Chollima (Lazarus Group) based on TTPs matching the TraderTraitor campaign and publisher email correlation with known DPRK infrastructure.
Live C2 Dump Recovering Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerShell Keylogger
On April 11, 2026, researchers analyzed a CHM file (api_reference.chm) tagged as Kimsuky that initiated a three-stage attack chain. The C2 server at check[.]nid-log[.]com had directory listing enabled, allowing recovery of complete source code for all payload stages: a 6,338-byte VBScript performing system reconnaissance and establishing persistence via scheduled task, a 449-byte VBScript bridge to PowerShell, and a 6,234-byte PowerShell keylogger with clipboard monitoring and timed exfiltration. The infrastructure included 79+ domains across 5 C2 IPs spanning Korean VPS providers. The server responded with "Million OK !!!!" signature, matching previously documented Kimsuky infrastructure while showing upgraded Apache/PHP stack. The operation targeted Korean Naver users through credential phishing and tax authority impersonation, with infrastructure linked to previously documented Kimsuky campaigns via shared DAOU Technology subnets.
Stealth Mango and Tangelo
This threat actor targets organizations in the satellite communications, telecommunications, geospatial-imaging, and defense secto…
1937CN
1937CN is a Chinese hacking group that has been active since at least 2013. The group is known for targeting Vietnamese organizati…
313 Team
313 Team is an Iraq-based threat actor that has conducted coordinated DDoS campaigns targeting multiple government servers in the …
APT-C-27
A threat actor which is ac tive since at least November 2014. This group launched long-term at tacks against organizations in the …
APT.3102
APT1
PLA Unit 61398 (Chinese: 61398部队, Pinyin: 61398 bùduì) is the Military Unit Cover Designator (MUCD)[1] of a People's Liberation Ar…
APT10
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in ass…
APT12
A group of China-based attackers, who conducted a number of spear phishing attacks in 2013.
APT14
PLA Navy Anchor Panda is an adversary that CrowdStrike has tracked extensively over the last year targeting both civilian and mili…
APT15
This threat actor uses phishing techniques to compromise the networks of foreign ministries of European countries for espionage pu…
APT16
Between November 26, 2015, and December 1, 2015, known and suspected China-based APT groups launched several spear-phishing attack…
APT17
FireEye described APT17 in a 2015 report as: 'APT17, also known as DeputyDog, is a China based threat group that FireEye Intellige…
APT18
Wekby was described by Palo Alto Networks in a 2015 report as: 'Wekby is a group that has been active for a number of years, targe…
APT19
Adversary group targeting financial, technology, non-profit organisations.
APT2
Putter Panda were the subject of an extensive report by CrowdStrike, which stated: 'The CrowdStrike Intelligence team has been tra…
APT20
We’ve uncovered some new data and likely attribution regarding a series of APT watering hole attacks this past summer. Watering ho…
APT21
APT22
Suckfly is a China-based threat group that has been active since at least 2014
APT23
TrendMicro described Tropic Trooper in a 2015 report as: 'Taiwan and the Philippines have become the targets of an ongoing campaig…
APT24
The Pitty Tiger group has been active since at least 2011. They have been seen using HeartBleed vulnerability in order to directly…
APT26
APT27
A China-based actor that targets foreign embassies to collect data on government, defence, and technology sectors.
APT28
The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the …
APT29
A 2015 report by F-Secure describe APT29 as: 'The Dukes are a well-resourced, highly dedicated and organized cyberespionage group …
APT3
Symantec described UPS in 2016 report as: 'Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage …
APT30
APT30 is a threat group suspected to be associated with the Chinese government. While Naikon shares some characteristics with APT3…
APT31
FireEye characterizes APT31 as an actor specialized on intellectual property theft, focusing on data and projects that make a part…
APT32
Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector com…
APT33
Our analysis reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013. We assess …
APT35
FireEye has identified APT35 operations dating back to 2014. APT35, also known as the Newscaster Team, is a threat group sponsored…
APT37
APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea.…
APT39
APT39 was created to bring together previous activities and methods used by this actor, and its activities largely align with a gr…
APT4
APT40
Leviathan is an espionage actor targeting organizations and high-value targets in defense and government. Active since at least 20…
APT41
APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially moti…
APT42
Iranian state-sponsored cyber espionage group tasked with conducting information collection and surveillance operations against in…
APT45
APT45 is a North Korean cyber threat actor that has been active since at least 2009. They have conducted espionage campaigns targe…
APT5
We have observed one APT group, which we call APT5, particularly focused on telecommunications and technology companies. More than…
APT6
The FBI issued a rare bulletin admitting that a group named Advanced Persistent Threat 6 (APT6) hacked into US government computer…
APT9
APT9 engages in cyber operations where the goal is data theft, usually focusing on the data and projects that make a particular or…
APTIran
APTIran has claimed responsibility for a large-scale campaign targeting Israeli critical infrastructure, asserting infiltration of…
Ababil of Minab
Ababil of Minab is an emerging pro-Iranian hacktivist group with a limited public profile and little verifiable prior activity in …
Altahrea Team
Altahrea Team is a pro-Iranian hacking group that has been active since at least 2020. The group has claimed responsibility for a …
Amaranth-Dragon
Amaranth-Dragon is a previously untracked threat actor assessed to be closely linked to the China-affiliated APT 41 ecosystem, exh…
Angry Likho
Angry Likho is an APT group that has been active since 2023, primarily targeting large organizations and government agencies in Ru…
Anonymous64
Anonymous 64 is a group accused by China's national security ministry of attempting to gain control of web portals, outdoor electr…
Antlion
Antlion is a Chinese state-backed advanced persistent threat (APT) group, who has been targeting financial institutions in Taiwan.…
Aoqin Dragon
SentinelLabs has uncovered a cluster of activity beginning at least as far back as 2013 and continuing to the present day, primari…
AppMilad
AppMilad is an Iranian hacking group that has been identified as the source of a spyware campaign called RatMilad. This spyware is…
AridViper
AridViper is a state-sponsored APT primarily targeting military personnel, journalists, and dissidents in the Middle East, with a …
Aslan Neferler Tim
Turkish nationalist hacktivist group that has been active for roughly one year. According to Domaintools, the group’s site has bee…
Avivore
The group’s existence came to light during Context’s investigation of a number of attacks against multinational enterprises that c…
Ayyıldız Tim
Ayyıldız (Crescent and Star) Tim is a nationalist hacking group founded in 2002. It performs defacements and DDoS attacks against …
AzzaSec
AzzaSec is a hacktivist group that originated in Italy. Known for their pro-Palestine stance, they have been involved in various c…
BANISHED KITTEN
BANISHED KITTEN is an Iranian state-nexus adversary active since at least 2008. While the adversary’s most prominent activity is t…
BIG PANDA
BRONZE EDGEWOOD
In early 2021 CTU researchers observed BRONZE EDGEWOOD exploiting the Microsoft Exchange Server of an organization in Southeast As…
BRONZE HIGHLAND
BRONZE HIGHLAND has been observed using spearphishing as an initial infection vector to deploy the MgBot remote access trojan agai…
BRONZE SPIRAL
In December 2020, the IT management software provider SolarWinds announced that an unidentified threat actor had exploited a vulne…
BRONZE SPRING
BRONZE SPRING is a threat group that CTU researchers assess with high confidence operates on behalf of China in the theft of intel…
BRONZE STARLIGHT
BRONZE STARLIGHT has been active since mid 2021 and targets organizations globally across a range of industry verticals. The group…
BRONZE VAPOR
BRONZE VAPOR is a targeted threat group assessed with moderate confidence to be of Chinese origin. Artefacts from tools associated…
BatShadow
BatShadow is a Vietnamese threat actor that targets job seekers and digital marketing professionals through social engineering cam…
Bearlyfy
Bearlyfy has been attributed to over 70 cyber attacks targeting Russian companies since its emergence in January 2025, employing a…
Beijing Group
BiBiGun
A pro-Hamas hacktivist group developed a wiper called BiBi-Linux to target and destroy data on Israeli systems. The malware impers…
Bignosa
Bignosa is a threat actor known for launching malware campaigns targeting Australian and US organizations using phishing emails wi…
BlackJack
Blackjack, a threat actor linked to Ukraine's security apparatus, has targeted critical Russian entities such as ISPs, utilities, …
BlackTech
BlackTech is a cyber espionage group operating against targets in East Asia, particularly Taiwan, and occasionally, Japan and Hong…
Blackatom
Recent campaigns suggest Hamas-linked actors may be advancing their TTPs to include intricate social engineering lures specially c…
Blackgear
BLACKGEAR is an espionage campaign which has targeted users in Taiwan for many years. Multiple papers and talks have been released…
Blackmeta
BLACKMETA is a pro-Palestinian hacktivist group that has claimed responsibility for a series of DDoS attacks and data breaches tar…
Blackwood
Blackwood is a China-aligned APT group that has been active since at least 2018. They primarily engage in cyberespionage operation…
BladedFeline
BladedFeline is an Iran-aligned APT group that has been active since at least 2017, targeting Iraqi and Kurdish government officia…
Blue Termite
Blue Termite is a group of suspected Chinese origin active in Japan.
Blue Tsunami
Blue Tsunami, also known as Black Cube, is a cyber mercenary group associated with the private intelligence firm Black Cube. They …
Bohrium
Bohrium is an Iranian threat actor that has been involved in spear-phishing operations targeting organizations in the US, Middle E…
Boulder Bear
First observed activity in December 2013.
BrazenBamboo
BrazenBamboo is a Chinese state-affiliated threat actor known for developing the LIGHTSPY, DEEPDATA, and DEEPPOST malware families…
Budminer
Based on the evidence we have presented Symantec attributed the activity involving theDripion malware to the Budminer advanced thr…
BuhTrap
Buhtrap has been active since 2014, however their first attacks against financial institutions were only detected in August 2015. …
CIRCUS SPIDER
According to Crowdstrike, the NetWalker ransomware is being developed and maintained by a Russian-speaking actor designated as CIR…
CL-STA-0048
CL-STA-0048 is a Chinese state-backed APT that targets strategic sectors in South Asia, particularly government and telecommunicat…
CL-STA-1087
CL-STA-1087 is a suspected state-sponsored espionage campaign operating out of China, targeting military organizations in Southeas…
Cadelle
Symantec telemetry identified Cadelle and Chafer activity dating from as far back as July 2014, however, it’s likely that activity…
Callisto
The Callisto Group is an advanced threat actor whose known targets include military personnel, government officials, think tanks, …
Camaro Dragon
In early 2023, the Check Point Incident Response Team (CPIRT) team investigated a malware incident at a European healthcare instit…
CardinalLizard
CardinalLizard, a cyber threat actor linked to China, has targeted entities in Asia since 2018. Their methods include spear-phishi…
Careto
This threat actor targets governments, diplomatic missions, private companies in the energy sector, and academics for espionage pu…
Carmine Tsunami
Carmine Tsunami is a threat actor linked to an Israel-based private sector offensive actor called QuaDream. QuaDream sells a platf…
CeranaKeeper
CeranaKeeper is a China-aligned APT that has been active since at least early 2022, primarily targeting governmental institutions …
Charming Kitten
Charming Kitten (aka Parastoo, aka Newscaster) is an group with a suspected nexus to Iran that targets organizations involved in g…
Chaya_004
Chaya_004 is a Chinese threat actor identified through malicious infrastructure, including a network of servers hosting Supershell…
Chernovite
Chernovite is a highly capable and sophisticated threat actor group that has developed a modular ICS malware framework called PIPE…
Cleaver
A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity again…
Clever Kitten
Confucious
Confucius is an APT organization funded by India. It has been carrying out cyber attacks since 2013. Its main targets are India's …
CopyKittens
CoralRaider
CoralRaider is a financially motivated threat actor of Vietnamese origin, targeting victims in Asian and Southeast Asian countries…
Corsair Jackal
Cotton Sandstorm
Cotton Sandstorm is an Iranian threat actor involved in hack-and-leak operations. They have targeted various organizations, includ…
Cuboid Sandstorm
Cuboid Sandstorm is an Iranian threat actor that targeted an Israel-based IT company in July 2021. They gained access to the compa…
Curious Gorge
Curious Gorge, a group TAG attributes to China's PLA SSF, has conducted campaigns against government and military organizations in…
Curly COMrades
Curly COMrades is a threat actor identified by Amazon Threat Intelligence and Bitdefender, believed to operate in support of Russi…
Cutting Kitten
One of the threat actors responsible for the denial of service attacks against U.S in 2012–2013. Three individuals associated with…
Cyber Alliance
The Ukrainian Cyber Alliance is a pro-Ukraine hacktivist group formed in 2016, primarily targeting Russian entities since the inva…
Cyber Av3ngers
The hacktivist group ‘Cyber Av3ngers’ has historically claimed attacks on Israel’s critical infrastructures. It has been launching…
Cyber Berkut
Cyber Islamic Resistance
Cyber Islamic Resistance is a hacktivist collective ideologically aligned with Iran, engaging in operations such as website deface…
Cyber Partisans
The Cyber Partisans, a hacktivist group based in Belarus, has been involved in various cyber-attacks targeting organizations and i…
Cyber Serp
UAC-0255 is a threat actor that conducted a phishing campaign impersonating CERT-UA to distribute the AGEWHEEZE RAT, targeting org…
Cyber Toufan
Cyber Toufan is a threat actor group that has gained prominence for its cyberattacks targeting Israeli organizations. The group's …
Cyber fighters of Izz Ad-Din Al Qassam
Cyber.Anarchy.Squad
Cyber Anarchy Squad is a pro-Ukrainian hacktivist group known for targeting Russian companies and infrastructure. They have carrie…
DAGGER PANDA
Operate since at least 2011, from several locations in China, with members in Korea and Japan as well. Possibly linked to Onion D…
DEV-0147
DEV-0147 is a China-based cyber espionage actor was observed compromising diplomatic targets in South America, a notable expansion…
DEV-0270
Microsoft threat intelligence teams have been tracking multiple ransomware campaigns and have tied these attacks to DEV-0270, also…
DEV-0586
MSTIC has not found any notable associations between this observed activity, tracked as DEV-0586, and other known activity groups.…
Dalbit
The group usually targets vulnerable servers to breach information including internal data from companies or encrypts files and de…
Dark Caracal
Lookout and Electronic Frontier Foundation (EFF) have discovered Dark Caracal, a persistent and prolific actor, who at the time of…
DarkHotel
Kaspersky described DarkHotel in a 2014 report as: '... DarkHotel drives its campaigns by spear-phishing targets with highly advan…
Deadeye Jackal
The Syrian Electronic Army (SEA) is a group of computer hackers which first surfaced online in 2011 to support the government of S…
Denim Tsunami
Denim Tsunami is a threat actor group that has been involved in targeted attacks against European and Central American customers. …
DiceyF
DiceyF is an advanced persistent threat group that has been targeting online casinos and other victims in Southeast Asia for an ex…
Domestic Kitten
An extensive surveillance operation targets specific groups of individuals with malicious mobile apps that collect sensitive infor…
DragonForce
DragonForce is a hacktivist group based in Malaysia that has been involved in cyberattacks targeting government institutions and c…
DragonOK
Threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tool…
DragonSpark
DragonSpark is a threat actor that has been conducting attacks primarily targeting organizations in East Asia. They utilize the op…
Dragonbridge
DRAGONBRIDGE is a Chinese state-sponsored threat actor known for engaging in information operations to promote the political inter…
DriftingCloud
DriftingCloud is a persistent threat actor known for targeting various industries and locations. They are skilled at developing or…
DustSquad
Prodaft researchers have published a report on Paperbug, a cyber-espionage campaign carried out by suspected Russian-speaking grou…
ELECTRIC PANDA
ELOQUENT PANDA
ELUSIVE COMET
ELUSIVE COMET is a threat actor responsible for significant cryptocurrency theft through sophisticated social engineering attacks,…
ENERGETIC BEAR
A Russian group that collects intelligence on the energy industry.
Earth Alux
Earth Alux is a China-linked APT group known for conducting cyberespionage attacks across various sectors, including government, t…
Earth Baxia
Earth Baxia is a threat actor opearting out of China, targeting government organizations in Taiwan and potentially across the APAC…
Earth Berberoka
According to TrendMicro, Earth Berberoka is a threat group originating from China that mainly focuses on targeting gambling websit…
Earth Freybug
Earth Freybug, identified as a subset of APT41, is a cyberthreat group active since at least 2012, engaging in espionage and finan…
Earth Krahang
Earth Krahang is an APT group targeting government organizations worldwide. They use spear-phishing emails, weak internet-facing s…
Earth Lamia
Earth Lamia is a China-nexus APT that targets organizations across multiple sectors, including finance, logistics, and government,…
Earth Lusca
Earth Lusca is a threat actor from China that targets organizations of interest to the Chinese government, including academic inst…
Earth Naga
Earth Naga is an APT group that has persistently targeted high-value organizations, including government agencies, telecommunicati…
Earth Wendigo
Earth Wendigo is a threat actor from China that has been targeting several organizations — including government organizations, res…
Edalat-e Ali
Edalat-e Ali is a hacktivist group known for disrupting Iranian state-run TV and radio transmissions during significant events, su…
Educated Manticore
Educated Manticore is an Iranian APT group aligned with the Islamic Revolutionary Guard Corps, primarily engaged in espionage targ…
Equation Group
The Equation Group is a highly sophisticated threat actor described by its discoverers at Kaspersky Labs as one of the most sophis…
Evasive Panda
Evasive Panda is an APT group that has been active since at least 2012, conducting cyberespionage targeting individuals, governmen…
EvilWeb
EvilWeb is a pro-Russian hacktivist group created in March 2024 that targets American and European entities using a hack-and-leak …
FIN1
FireEye first identified this activity during a recent investigation at an organization in the financial industry. They identified…
FIN13
Since 2017, Mandiant has been tracking FIN13, an industrious and versatile financially motivated threat actor conducting long-term…
FIN7
Groups targeting financial organizations or people with significant financial assets.
FOXY PANDA
Adversary group targeting telecommunication and technology organizations.
Femwar02
Femwar02 is a previously unknown pro-Russian ransomware threat actor that emerged in early 2026, linked to a major cyberattack on …
Ferocious Kitten
Ferocious Kitten is an APT group that has been active against Persian-speaking individuals since 2015 and appears to be based in I…
Flax Typhoon
Flax Typhoon is a Chinese state-sponsored threat actor that primarily targets organizations in Taiwan. They conduct espionage camp…
Flying Kitten
Activity: defense and aerospace sectors, also interested in targeting entities in the oil/gas industry.
FlyingYeti
FlyingYeti is a Russia-aligned threat actor targeting Ukrainian military entities. They conduct reconnaissance activities and laun…
Fox Kitten
PIONEER KITTEN is an Iran-based adversary that has been active since at least 2017 and has a suspected nexus to the Iranian govern…
FrostyNeighbor
FrostyNeighbor is a Belarus-aligned APT group known for conducting influence and disinformation campaigns, particularly targeting …
GALLIUM
GALLIUM, is a threat actor believed to be targeting telecommunication providers over the world, mostly South-East Asia, Europe and…
GCMAN
GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services.
GIBBERISH PANDA
GOBLIN PANDA
Goblin Panda is one of a handful of elite Chinese advanced persistent threat (APT) groups. Most Chinese APTs target the United Sta…
GREF
GREF is a China-aligned APT group that has been active since at least March 2017. They are known for using custom backdoors, loade…
GTG-1002
GTG-1002 is a Chinese state-sponsored APT that conducted a large-scale autonomous cyber espionage campaign targeting approximately…
Gamaredon Group
Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this…
GhostEmperor
GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They emp…
GhostRedirector
GhostRedirector is a China-aligned threat actor that has compromised at least 65 Windows servers across various sectors, primarily…
Ghostwriter
Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and p…
GoldFactory
GoldFactory is a threat actor group attributed to developing sophisticated mobile banking malware targeting victims primarily in t…
GopherWhisper
GopherWhisper is a China-aligned APT that routes C2 traffic through legitimate enterprise platforms like Slack, Discord, and Micro…
Gray Sandstorm
Gray Sandstorm is an Iran-linked threat actor that has been active since at least 2012. They have targeted defense technology comp…
Grayling
Grayling activity was first observed in early 2023, when a number of victims were identified with distinctive malicious DLL side-l…
GreedyBear
GreedyBear is a sophisticated threat actor responsible for over $1 million in cryptocurrency theft through a campaign involving 15…
GreenSpot
GreenSpot is an APT group believed to operate from Taiwan, active since at least 2007, primarily targeting government, academic, a…
Greenbug
Greenbug was discovered targeting a range of organizations in the Middle East including companies in the aviation, energy, governm…
Groundbait
Groundbait is a group targeting anti-government separatists in the self-declared Donetsk and Luhansk People’s Republics.
HAFNIUM
HAFNIUM primarily targets entities in the United States across a number of industry sectors, including infectious disease research…
HAZY TIGER
The Bitter threat group initially started using RAT tools in their campaigns, as the first Bitter versions, for Android released i…
HURRICANE PANDA
We have investigated their intrusions since 2013 and have been battling them nonstop over the last year at several large telecommu…
Handala
Handala is a pro-Palestinian hacktivist group that targets Israeli organizations, employing tactics such as phishing, data theft, …
Hellsing
This threat actor uses spear-phishing techniques to compromise diplomatic targets in Southeast Asia, India, and the United States.…
HenBox
This threat actor targets Uighurs—a minority ethnic group located primarily in northwestern China—and devices from Chinese mobile …
HiddenArt
It was observed that a mobile network threat actor designated as ‘HiddenArt’ actively sustains a capacity to remotely access the p…
Higaisa
The organization often uses important North Korean time nodes such as holidays and North Korea to conduct fishing activities. The …
HomeLand Justice
HomeLand Justice is an Iranian state-sponsored cyber threat group that has been active since at least May 2021. They have targeted…
Houken
Houken is a Chinese state-sponsored threat actor that exploits zero-day vulnerabilities in Ivanti Cloud Services Appliance devices…
HummingBad
This group created a malware that takes over Android devices and generates $300,000 per month in fraudulent ad revenue. The group…
Hunt3r Kill3rs
Hunt3r Kill3rs is a newly emerged threat group claiming expertise in cyber operations, including ICS breaches and web application …
IMPERSONATING PANDA
INDOHAXSEC TEAM
INDOHAXSEC TEAM is an Indonesian group that claims to have developed a web-based version of WannaCry, asserting the ability to enc…
INDRIK SPIDER
INDRIK SPIDER is a sophisticated eCrime group that has been operating Dridex since June 2014. In 2015 and 2016, Dridex was one of …
IRIDIUM
Resecurity’s research indicates that the attack on Parliament is a part of a multi-year cyberespionage campaign orchestrated by a …
IcePeony
IcePeony is a China-nexus APT group that has been active since at least 2023, targeting government agencies, academic institutions…
Inception Framework
This threat actor uses spear-phishing techniques to target private-sector energy, defense, aerospace, research, and media organiza…
IndigoZebra
IndigoZebra is a Chinese state-sponsored actor mentioned for the first time by Kaspersky in its APT Trends report Q2 2017, targeti…
Infrastructure Destruction Squad
Dark Engine has emerged as a significant threat actor targeting industrial control systems and SCADA systems in sectors such as me…
Infy
Infy is a group of suspected Iranian origin. Since early 2013, we have observed activity from a unique threat actor group, which w…
IronHusky
IronHusky is a Chinese-based threat actor first attributed in July 2017 targeting Russian and Mongolian governments, as well as av…