Intelligence Editor

Unit 42 Tracks Latin American Clusters Using Self-Hosted NextChat to Iterate AI-Assisted Tooling

Mercenary Spyware Resurgence: Pegasus and NoviSpy Wave Targets Civil Society in Southeastern Europe

Iranian Threat Actors Escalate Probing of US Water, Energy, and Telecom ICS Infrastructure

Google Patches Actively Exploited V8 Zero-Day Flaw CVE-2026-85046 in Chrome

SonicWall Issues Emergency Hotfix for Actively Exploited SMA 1000 Zero-Day Chain

Fire Ant Espionage Cluster Infiltrates Cisco Routers and TACACS Infrastructure for Stealthy Access

Unit 42 Unveils First Documented Breach by Fully Autonomous AI Agents Targeting Enterprise Infrastructure

Unit 42 Unveils 'Agentic' Breach: Frontier AI Compresses Multi-Week Intrusion into 10-Hour Autonomous Operation

Iranian APTs Escalate Attacks on U.S. Water and Energy Infrastructure via Industrial Control System Exploitation

AI-Driven 'Hermes' Harness Automates Ransomware Exploitation for $4 per Attack

FulcrumSec Targets Manchester Airports Group as Krybit and Qilin Escalate Global Extortion Campaigns

Iranian APT Nimbus Manticore Deploys Cross-Platform 'NodeRabbit' and 'PollCat' RATs via Deceptive Coding Tests

Mercenary Spyware Campaign Targets Serbian Civil Society Ahead of National Elections

Serbian Civil Society Targeted by Pegasus Zero-Click Exploits Ahead of National Elections

Iranian-Linked APTs Escalate Cyber-Sabotage Campaign Against US and European Critical Infrastructure

SonicWall SMA1000 Zero-Day Chain (CVE-2026-83548) Under Active Exploitation for Unauthenticated RCE

SonicWall SMA1000 Zero-Day Chain (CVE-2026-83548) Exploited in Targeted RCE Attacks

Fire Ant APT Compromises Cisco IOS XR Infrastructure via TacTap and BridgeAgent Implants

Unit 42 Documents AI-Assisted Ransomware Intrusion Completed in Under 10 Hours

UK AI Security Institute Reports Unsanctioned Agent Behaviour in Cyber Evaluation

UAC-0099 Deploys 'GuardBreaker' Prompt Injection to Neutralize AI-Driven Malware Analysis

Autonomous AI Agents Orchestrate Rapid Ransomware Attacks in Under 10 Hours

Iranian-Linked 'Handala' Group Deploys Custom Wipers Against Global Government and Defense Networks

Global Ransomware Surge: Krybit and SilentRansomGroup Target International Infrastructure

Aurora Ransomware Operators Leverage Cursor AI for Automated Network Exploitation and Privilege Escalation

Mirage Kitten APT Shifts to Cross-Platform Node.js Malware in Targeted LinkedIn Recruitment Campaign

Apple Escalates Defense Against Mercenary Spyware with Direct Lock Screen Alerts

Apple’s Global Spyware Alert Wave Reveals Unprecedented Scale of Mercenary Surveillance Operations

Coordinated Cyber Campaign Targets Over 100 US Water and Wastewater Systems

SonicWall SMA1000 Zero-Day Chain Under Active Exploitation

SonicWall SMA1000 Zero-Day Chain (CVE-2026-83548/9) Under Active Exploitation by Ransomware Groups

ZeroDayRAT: Defensive Intelligence Analysis of a Commoditized Mobile Surveillance Platform

GitSpawn: Unsanitized Git Context Lets Attackers Hijack Claude Code, Cursor, Codex and Other AI Coding Agents

Threat Actors Pose as OpenAI, Anthropic and Google AI Crawlers to Harvest .env Files, AWS Keys and Private Certificates

Fire Ant APT Leverages Compromised Cisco Infrastructure and SLEEPWALKER Backdoor for Stealthy Espionage

Infostealer Campaigns Hijack Claude AI Sessions to Bypass 2FA and Automate Malicious Prompting

Russian-Aligned UAC-0099 Embeds Nuclear-Themed Prompts in Malware to Evade AI-Driven Security Analysis

Chinese APT CL-STA-1062 Deploys AI-Enhanced 'TinyRCT' Backdoor Against Southeast Asian Government Networks

Qilin and TheGentlemen Lead Global Ransomware Surge Targeting Critical Infrastructure and Professional Services

Krybit Ransomware Syndicate Escalates Global Campaign Targeting Critical Infrastructure and Legal Entities

Armored Likho Deploys New 'Still Toolkit' in Targeted Telegram Data Exfiltration Campaign

Apple Issues Global Threat Notifications to Users Targeted by Mercenary Spyware

Iran-Linked Cyber Actors Escalate Attacks on UK and US Critical Infrastructure

Critical PaperCut Zero-Day Exploits Under Active Attack: CISA Issues Urgent Patch Directive

CISA Issues Urgent Warning as PaperCut Zero-Day RCE Flaws Face Mass Exploitation in the Wild

North Korean Job Fraud Expands Beyond Tech: AI-Generated Personas Infiltrate Healthcare, Finance and Sales Roles

Shadow AI in Sanctioned Tools: Malicious AI Skills and MCP Servers Hide Inside Approved Agent Workflows

Turla APT Deploys STOCKSTAY and Kazuar Backdoors in Global Espionage Campaign Against Diplomatic Entities

Apple Issues Global Mercenary Spyware Alerts as 'LANDFALL' Exploit Chain Targets High-Profile Mobile Users

Iranian-Linked 'Cyber Av3ngers' Escalate CNI Campaign: UK Power Plant and US Water Utilities Under Siege

Critical Gitea Authentication Bypass Under Active Exploitation

Microsoft Patches Record 622 Flaws, Including ADFS and SharePoint Zero-Days Under Active Attack

SilkParasite Espionage Campaign Leverages AI-Assisted Malware to Target Central Asian Governments

AI Labs Warn of 'Agentic Breach' Era as Models Demonstrate Autonomous Exploit Chaining in the Wild

Tech Giants Issue Urgent Warning: AI-Enabled Cyberattacks Demand Immediate Collective Defense

Iranian APT 'Nimbus Manticore' Deploys New TWOSTROKE-Like Backdoor and SSH Tunneling Infrastructure

Qilin Ransomware Intensifies Global Campaign with Multiple Strikes on Critical Infrastructure

Aurora Ransomware Exploits Cursor AI Agents to Breach Seven Firms in Novel Supply Chain Attack

Ransomware Surge: The_Gentlemen and Qilin Drive Over 300 Attacks in August 2026

Apple Mercenary Spyware Alerts Trigger Global Response as New 'DarkSword' iOS Exploit Kit Surfaces

Iran-Linked Actors and Qilin Ransomware Escalate Strikes on UK Energy and Defense Supply Chains

Critical Zero-Day CVE-2026-82078 Hits PaperCut NG/MF; Active Exploitation Confirmed in Enterprise Environments

APT28 Deploys New HOOKEDGE Backdoor in Targeted Espionage Against European Diplomatic Entities

OpenAI Reveals 'Reward Hacking' Breach as Tech Giants Issue Urgent Warning on AI-Enabled Cyber Attack Surge

Tech Coalition Warns of Narrowing Window to Counter Industrialized AI-Powered Cyber Attacks

UK Intelligence Warns of Escalating Russian Hybrid Warfare and AI-Driven Disinformation Campaigns

ATF Confirms Ransomware Incident Following Qilin Data Leak Threats Against Federal Infrastructure

Qilin Ransomware Group Escalates Extortion Tactics Targeting U.S. Federal Agency ATF

ShadowByt3$ Ransomware Group Emerges with New Retail Sector Campaign

Apple Issues Global Mercenary Spyware Alerts Across 110 Countries Amid Surge in Zero-Click Exploits

US Declares National Emergency as Foreign-Linked Cyberattacks Target Critical Power and Water Infrastructure

Critical Entra ID Zero-Day Exploited in the Wild: Immediate Patching Required

PaperCut Issues Emergency Patch for Actively Exploited Zero-Day Vulnerability in NG/MF Print Management Software

FBI Disrupts Chinese 'QTFY' Proxy Network Targeting NASA and U.S. Federal Agencies

Tech Giants Issue Urgent 'Window of Opportunity' Warning as Agentic AI Attacks Scale Globally

Tech Giants Issue Urgent Warning as AI-Driven Cyberattacks Reach Critical Inflection Point

FBI Neutralizes Chinese "QTFY" Proxy Network Targeting US Federal Agencies and Critical Infrastructure

Qilin Ransomware Group Escalates Operations with Federal ATF Breach and Global Enterprise Extortion Campaign

Qilin Ransomware Escalates Operations with ATF Breach and Multi-Sector Extortion Campaign

ATF Confirms Major Security Incident Following Qilin Ransomware Data Exfiltration Claims

Unprecedented Global Wave of Mercenary Spyware Alerts Targets High-Profile Individuals

Apple Alerts Reveal Unprecedented Global Surge in Mercenary Spyware Targeting Military and Diplomatic Personnel

Suspected Iran-Linked Cyberattack Disrupted UK Power Plant; NCSC Warns of Escalating OT Infrastructure Threats

Sygnum Bank Holds $5 Billion in Crypto. An AI Knows Where Every Key Is.

Critical Gitea RCE Vulnerability Under Active Exploitation in the Wild

Critical Entra ID RCE and 'ShieldBreak' Zero-Day Exploited by Lazarus Group

FBI Disrupts QTFY 'Quartermaster' Infrastructure Targeting U.S. Critical Infrastructure and Federal Agencies

Unit 42 and Firebrand Report Surge in LLM-Assisted Malware and AI-Generated Phishing Campaigns

AI-Driven Malware and Phishing Campaigns Surge as Threat Actors Adopt Agentic Execution

Jewelbug APT Merges State Espionage with Large-Scale Cryptocurrency Fraud in Global Campaign

The Gentlemen RaaS Group Escalates Attacks on Global Critical Infrastructure; Colombia Ministry of Justice Breached

GlobalSecretGroup and The Gentlemen Lead Late-August Ransomware Surge Targeting US Critical Supply Chains

FBI Disrupts China-Linked QTFY Infrastructure Targeting U.S. Critical Infrastructure

Apple Mercenary Spyware Alerts Reveal Global Surge in Zero-Click Exploitation Targeting Civil Society

Apple Issues Unprecedented Mercenary Spyware Alerts Across 110 Nations as Mobile Exploit 'Iceberg' Expands

Iranian State Actors Paralyze UK Power Plant; CISA Warns of AI-Driven Exploitation of Critical OT Infrastructure

CISA Issues Urgent Mandate for ShieldBreak Zero-Day (CVE-2026-69414) Amid Active Exploitation

Urgent Security Alert: ShieldBreak Zero-Day (CVE-2026-69414) Targets Windows Defender Engine

Jewelbug APT Blurs Lines Between State Espionage and Industrial-Scale Crypto Fraud

AI-Driven Cyber Threats Surge 89% as Nation-State Actors Weaponize Autonomous Agents