DeepSeek: AI Model Used in Offensive Operations
DeepSeek is an AI model leveraged by threat actors as an offensive operator to automate hacking tasks.
Tag: threat actor
Agent IDE: Suspicious VS Code Extension by Threat Actor
Agent IDE is a Microsoft Visual Studio Code extension published in the official marketplace by a threat actor known as 'johnnysilverhe', who…
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate…
SuccessKey Threat Actor Behind ViteVenom and ChainVeil Campaigns
SuccessKey is the threat actor attributed to the ViteVenom and ChainVeil campaigns, which use blockchain-based C2 infrastructure to deliver remote access trojans…
TetrisPhantom: APAC Government Threat Actor
TetrisPhantom is a highly skilled and resourceful threat actor first documented by Kaspersky in October 2023. It targets government entities in the…
DoNot Team: Cyber Espionage Group Targeting Bangladesh
DoNot Team is a threat actor that conducted a targeted cyber espionage operation against Bangladesh's military and defence establishments using spear-phishing emails…
CyberAv3ngers: Threat Group Targeting Critical Infrastructure
CyberAv3ngers is a threat actor group associated with targeting operational technology and industrial control systems, including water systems. They have been linked…
Iran-Nexus Threat Actor
An Iran-linked threat actor group associated with the BLUERABBIT backdoor, targeting Israeli organizations. Attribution is based on intelligence from Google's Threat Intelligence…
Hyadina: Developer Behind GodDamn, Beast, and Monster Ransomware
Hyadina is the moniker assigned by Broadcom's Symantec to the threat actor responsible for developing the GodDamn, Beast, and Monster ransomware families.…
ProtonVPN IP Used in Initial Reconnaissance for Gitea Exploit
An IP address from ProtonVPN service (159.26.98[.]241) was observed in the initial reconnaissance phase of the attempted exploitation of CVE-2026-20896, though no…