APT29 Watering Hole Campaign Targets Mobile Platforms with DarkSword
Researchers reveal a sophisticated watering hole campaign by suspected Russian threat actors using reverse proxies, JavaScript profiling, and mobile exploit chains.
Threat Intelligence
Threat actors, campaigns, TTPs and detection engineering.
Dissecting the XCPE Botnet: Android OEM Firmware Backdoors
Technical breakdown of the XCPE botnet, revealing how an Android OEM preloaded system-level backdoors to compromise over 1.3 million set-top boxes.
AI-Orchestrated Cyberattacks: Inside the CyberStrikeAI Campaign
Kaspersky researchers detail a malicious campaign targeting education sectors where attackers deployed CyberStrikeAI, an open-source framework using an LLM orchestrator for post-exploitation.
TraderTraitor Binance Breach: Staging and Multi-Chain Attack
FBI and TRM attribute the multi-billion-dollar Binance breach to North Korean group TraderTraitor. The attacker staged tests across multiple wallets before compromising production hot wallets.
Analyzing Q3 2026 Incident Response Trends and EDR Killers
An in-depth technical analysis of Q3 2026 incident response trends highlights rising ransomware demands, BYOVD EDR tampering, and persistence techniques.
NIK C2 Analysis: Inside the AI-Integrated Command Framework
Cisco Talos has uncovered NIK C2, an active Go-based C2 framework that uses victim OpenAI API keys for real-time data analysis while deploying screen-locking ransomware.