Research reports
1,224 reports from 387 publishers45 added in the past week
62 reports, newest added first
Added Tue 28 Jul
Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)
Executive Summary Multiple vendors have observed active exploitation of CVE-2025-55182, a critical remote code execution vulnerability in React Server Components and frameworks like Next.js. Multiple threat actors, including China-nexus and North Korea-nexus…
Vulnerabilities
AI Security Incident Case: JadePuffer Ransomware Leverages AI Agent to Automate Attacks
In early July 2026, security firm Sysdig publicly disclosed a new type of ransomware attack. After gaining initial access by exploiting a Langflow vulnerability (CVE-2025-3248), the JadePuffer ransomware leveraged a Large Language Model (LLM) agent to…
RansomwareVulnerabilitiesAI
China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182)
December 29, 2025: The blog post was updated to add options for AWS Network Firewall. December 12, 2025: The blog post was updated to clarify when customers need to update their ReactJS version. Within hours of the public disclosure of CVE-2025-55182…
Vulnerabilities
Added Sat 25 Jul
ta458 roundpress exploits
By Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team July 23, 2026 Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team This…
Vulnerabilities
TA488 Targets Zimbra Mailservers with Half-Click Exploits
By Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team July 23, 2026 Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team…
State-sponsoredVulnerabilities
Added Thu 23 Jul
Beyond the Archive: CVE-2025-8088 Stealer Targeting Ukraine
This report details a targeted cyber-espionage campaign conducted by the Russia-aligned threat actor group APT SHADOW-EARTH-066 (also tracked by CERT-UA as UAC-0226), delivering an updated variant of the GIFTEDCROOK information stealer against Ukrainian…
State-sponsoredInfostealersVulnerabilities
Added Tue 14 Jul
One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation
July 07, 2026 Greg Lesnewich, Mark Kelly, and the Proofpoint Threat Research Team Analyst note: Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have not been observed for long enough to receive a numerical TA…
Vulnerabilities
Added Fri 12 Jun
Alert: Exploitation of CVE-2026-34197 in Apache ActiveMQ
SLIME88 積極利用。我們的調查顯示，SLIME88 在利用該漏洞後部署了 SoxAgent RAT ，以入 侵 Linux 設備並建置 ORB 網路。我們目前以臨時名稱 GOBLIN14 追蹤該 ORB 網路。 SLIME88 最早的攻擊可以追溯到 4 月 7 日。 SLIME88 攻擊活動的受害者包括美國以及韓國、 印度、法國和美國的 IT 與製造業。 本文詳細說明攻擊手法與情況。 The following blog post is based on our 2026 April H2…
Vulnerabilities
Added Tue 9 Jun
Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO
This past March, FortiGuard Labs discovered a new Gafgyt botnet variant, C0XMO, that spreads by exploiting CVE-2021-27137. Our analysis revealed that, unlike earlier versions, this malware separates its lateral movement into a standalone Python script. This…
Vulnerabilities
Added Thu 4 Jun
U.S. Agencies Warn of Rising Iranian Cyber Attacks on Defense, OT Networks, and Critical Infrastructure
U.S. cybersecurity and intelligence agencies have issued a joint advisory warning of potential cyber attacks from Iranian state-sponsored or affiliated threat actors. "Over the past several months, there has been increasing activity from hacktivists and…
Vulnerabilities
Added Fri 22 May
Thus Spoke…The Gentlemen
On May 4th, 2026, The Gentlemen RaaS administrator acknowledged on underground forums that an internal backend database (Rocket) had been leaked. This leak exposed 9 accounts, including zeta88 (aka hastalamuerte), who runs the infrastructure, builds the…
Vulnerabilities
Added Thu 21 May
DragonBreath: Dragon in the Kernel
Dragoncore_k.sys & Zhengzhou 403 Network Technology Co., Ltd. 0-Day BYOVD Vulnerability | Shell Company Analysis | Dragon Breath APT-Q-27 | APT31 Personnel Nexus Field Value Report Date April 22, 2026 Authors Alex Necula, Ellis Stannard TLP Classification…
State-sponsoredVulnerabilities
Added Thu 14 May
Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment
CVE-2026-41940 is a high-severity unauthenticated authentication bypass vulnerability affecting cPanel & WHM. This product is widely used in Linux server operations and virtual hosting management. The vulnerability has a CVSS score as high as 9.8 (Critical).…
MalwareVulnerabilities
The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors
Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in recovered payloads, we believe the exploit chain to be called DarkSword.…
VulnerabilitiesMobile
Added Sat 9 May
Coruna: A Complete Technical Teardown of a State-Grade iOS/macOS Watering-Hole Exploit Chain
Author: @Nadsec | Date: March 2026 | Classification: Threat Intelligence - Public Abstract Coruna is a multi-stage, multi-platform exploit chain targeting Apple's Safari/WebKit engine and XNU kernel on ARM64 (arm64e) devices running iOS and macOS. Operated by…
VulnerabilitiesMobile
Added Sun 3 May
Nemty 1.6 Ransomware Released and Pushed via RIG Exploit Kit
The RIG exploit kit is now pushing a cocktail of malware that includes a new variant of the Nemty Ransomware. First spotted by exploit kit researcher mol69, a malvertising campaign is redirecting users to the RIG exploit kit to target enterprise users who are…
RansomwareMalwareVulnerabilities
Added Fri 1 May
Iranian APT group ‘MuddyWater’ Adds Exploits to Their Arsenal
In recent months, there has been considerable unrest in the Iranian cybersphere. Highly sensitive data about Iranian APT groups were leaked, exposing abilities, strategies, and attack tools. The main medium for this leak was a telegram channel. The first leak…
State-sponsoredVulnerabilities
Added Wed 29 Apr
Recent Cyber Attacks: Major Incidents & Key Trends
Recent cyberattacks reflect that threat actors are no longer relying on isolated exploits. They are combining several tactics, like automation and social engineering, to achieve maximum impact. Here are a few cybersecurity trends that define how cyber risk…
Vulnerabilities
Added Thu 23 Apr
CopyRh(ight)adamantys Campaign: Rhadamantys Exploits Intellectual Property Infringement Baits
Check Point Research is tracking an ongoing, large scale and sophisticated phishing campaign deploying the newest version of the Rhadamanthys stealer (0.7). We dubbed this campaign CopyRh(ight)adamantys. This campaign utilizes a copyright infringement theme…
Vulnerabilities
Can You Trust a File’s Digital Signature? New Zloader Campaign exploits Microsoft’s Signature Verification putting users at risk
Last seen in August 2021, Zloader, a banking malware designed to steal user credentials and private information, is back with a simple yet sophisticated infection chain. Previous Zloader campaigns, which were seen in 2020, used malicious documents, adult…
Vulnerabilities
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.