Lumen Black Lotus Labs
A security research division of Lumen Technologies that tracked QTFY activity for over 18 months and collaborated with the FBI.
Tag: threat intelligence
Zimbra SNMP Flaw CVE-2026-73570 Actively Exploited for Unauthenticated RCE
A now-patched command injection vulnerability in Zimbra Collaboration (ZCS), tracked as CVE-2026-73570 (CVSS 8.9), is under active exploitation in the wild, according…
RST Cloud’s Analysis of MacSync Stealer C2 Infrastructure
RST Cloud documented a static API key across four confirmed C2 domains and identified additional candidates via recurring URI patterns, aiding in…
Microsoft Ties 30+ Rotating Domains to MacSync Stealer Infrastructure
Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, by correlating endpoint and network…
GRIT: Cybersecurity Firm Exposes Ransom Busters Scam
GuidePoint Research and Intelligence Team (GRIT) is a cybersecurity firm that identified and analyzed the Ransom Busters scam, providing insights into the…
Ontinue: Cybersecurity Firm Uncovers TWINLOOT
Ontinue's Cyber Defense Center discovered the TWINLOOT implant during an investigation into a campaign in July 2026. The company provided detailed technical…
One Attacker Scrapes Salesforce and ServiceNow Portals Since 2025
A single threat actor has been systematically scraping data from Salesforce and ServiceNow customer portals for over a year, according to research…
DarkAtlas: Cyber Threat Intelligence
DarkAtlas detailed APT42's use of TAMECAT malware in spear-phishing attacks targeting the nuclear energy sector, and highlighted the group's use of generative…
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Cybersecurity researchers have uncovered a previously undocumented Linux botnet family named Evooo1Bot, which is derived from the Mirai botnet source code and…
Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware
Threat actors are increasingly acquiring expired domains—known as "dropcatch domains"—to inherit their reputation and traffic, redirecting victims to scams and malware. According…