Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new campaign involving a malicious program disguised as a Notepad++…
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
CL-STA-1114 — Attack group profile
CL-STA-1114 was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
Laundry Bear: Russia-Linked Threat Actor Targeting Webmail
Laundry Bear (also known as CL-STA-1114, TA488, Void Blizzard) is a Russia-linked threat actor that has targeted Zimbra mail servers using a…
Void Blizzard — Attack group profile
Void Blizzard was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs,…
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian state-sponsored espionage group exploited a zero-day vulnerability in Zimbra's webmail client to steal emails, passwords, and two-factor authentication recovery codes…
TA488 — Attack group profile
TA488 was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
China-Nexus JadeProx Deploys New TriBack Loader in Attacks on Government and Healthcare
Group-IB has uncovered a China-nexus cyber operation tracked as JadeProx, which has been targeting government, healthcare, and education organizations across Asia and…
JadeProx: China-Nexus Cyber Operation Targeting Government and Healthcare
JadeProx is a China-nexus cyber operation tracked by Group-IB, targeting government, healthcare, and education organizations across Asia and Latin America. It uses…
Water Curse: Threat Cluster Using GitHub Ghost Network
Water Curse is a threat cluster tracked by Trend Micro that operates a GitHub-based ghost network to redirect users to malware-laced payloads.…
Qilin Ransomware Exploits PAN-OS Authentication Bypass CVE-2026-0257 for Initial Access
Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability, CVE-2026-0257 (CVSS score: 7.8), as an entry point…