North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
Threat actors with ties to North Korea have been linked to a fresh set of malicious npm packages that masquerade as Rollup…
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
Armored Likho Targets Government and Power Sector with BusySnake Stealer
A previously undocumented threat actor, Armored Likho, has been attributed to cyber attacks targeting government agencies and the electric power sector across…
Armored Likho: Cyber Espionage Group Targeting Government and Power Sector
Armored Likho is a previously undocumented threat actor targeting government agencies and electric power sectors in Russia, Brazil, and Kazakhstan. They blend…
Eagle Werewolf: Threat Cluster Linked to Armored Likho
Eagle Werewolf is a threat cluster tracked by BI.ZONE, active since May 2023, targeting government and defense organizations, especially those involved in…
ToddyCat: APT Group Exploiting ESET Search-Order Flaw
ToddyCat is an advanced persistent threat group that exploited a search-order flaw in ESET's command-line scanner to load malicious DLLs. This was…
JADEPUFFER: AI-Agent-Driven Cyber Operator
An AI-agent-driven operator first documented by Sysdig. Deployed ENCFORGE ransomware against Langflow servers, using Docker socket for host breakout. Previously used throwaway…
MUT-1244: Campaign Using Fake PoC Repos to Steal Credentials
MUT-1244 is a campaign that used fake PoC repositories to steal SSH keys and cloud credentials from red teamers and researchers, similar…
FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations
The recently discovered financially-motivated FortiBleed campaign has been attributed to INC and Lynx ransomware operations, indicating that the verified, stolen credentials were…
INC Ransomware Group
A ransomware operation linked to the FortiBleed campaign, with an operator using FortiBleed infrastructure to access negotiation panels and deploy ransomware.
Lynx Ransomware Group
A ransomware operation linked to the FortiBleed campaign, with an operator using FortiBleed infrastructure to access negotiation panels and deploy ransomware.