TaskJacker: Malicious VS Code Task File Cluster in PolinRider Campaign
A cluster within the PolinRider campaign that drops malicious VS Code task files into GitHub users' repositories. The tasks use 'runOn: folderOpen'…
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign
North Korean threat actors linked to the Contagious Interview campaign have published 108 unique malicious packages and browser extensions across npm, Packagist,…
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
Threat actors with ties to North Korea have been linked to a fresh set of malicious npm packages that masquerade as Rollup…
Armored Likho Targets Government and Power Sector with BusySnake Stealer
A previously undocumented threat actor, Armored Likho, has been attributed to cyber attacks targeting government agencies and the electric power sector across…
Armored Likho: Cyber Espionage Group Targeting Government and Power Sector
Armored Likho is a previously undocumented threat actor targeting government agencies and electric power sectors in Russia, Brazil, and Kazakhstan. They blend…
Eagle Werewolf: Threat Cluster Linked to Armored Likho
Eagle Werewolf is a threat cluster tracked by BI.ZONE, active since May 2023, targeting government and defense organizations, especially those involved in…
ToddyCat APT Group: Cyberespionage Operations Targeting Europe and Asia
ToddyCat is an advanced persistent threat (APT) group active since at least 2020, known for targeting organizations in Europe and Asia. The…
JADEPUFFER: AI-Agent-Driven Cyber Operator
An AI-agent-driven operator first documented by Sysdig. Deployed ENCFORGE ransomware against Langflow servers, using Docker socket for host breakout. Previously used throwaway…
MUT-1244: Campaign Using Fake PoC Repos to Steal Credentials
MUT-1244 is a campaign that used fake PoC repositories to steal SSH keys and cloud credentials from red teamers and researchers, similar…
FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations
The recently discovered financially-motivated FortiBleed campaign has been attributed to INC and Lynx ransomware operations, indicating that the verified, stolen credentials were…