Researchers Uncover Aeternum C2 Infrastructure with Advanced Persistence and Network Evasion Features
For years, taking down a botnet meant finding its command-and-control (C2) server, seizing the domain, and watching the network go
Europol-led crackdown on The Com hackers leads to 30 arrests
A yearlong Europol-coordinated operation dubbed “Project Compass” has led to 30 arrests and 179 suspects being tied to “The Com,”
Vshell Gains Traction Among Threat Actors as an Alternative to Cobalt Strike
A Go-based command-and-control (C2) framework originally marketed within Chinese-speaking offensive security communities has been quietly expanding its reach, drawing growing
DoJ Seizes $61 Million in Tether Linked to Pig Butchering Crypto Scams
Ravie LakshmananFeb 27, 2026Financial Crime / Social Engineering The U.S. Department of Justice (DoJ) this week announced the seizure of
900+ Sangoma FreePBX Instances Compromised in Ongoing Web Shell Attacks
Ravie LakshmananFeb 27, 2026Network Security / Vulnerability The Shadowserver Foundation has revealed that over 900 Sangoma FreePBX instances still remain
CISA warns that RESURGE malware can be dormant on Ivanti devices
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released new details about RESURGE, a malicious implant used in zero-day
Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor
Ravie LakshmananFeb 27, 2026Malware / Linux Security Cybersecurity researchers have disclosed details of a malicious Go module that’s designed to
Critical Trend Micro Apex One Vulnerabilities Allows Malicious Code Execution
Trend Micro Apex One Vulnerabilities Trend Micro has released fixes for multiple Apex One vulnerabilities, ranging from High to Critical severity, including
ScarCruft Uses Zoho WorkDrive and USB Malware to Breach Air-Gapped Networks
Ravie LakshmananFeb 27, 2026Malware / Surveillance The North Korean threat actor known as ScarCruft has been attributed to a fresh
North Korean APT37 Hackers Leverages Novel Malware to Infect AirGapped Systems
North Korea-linked threat group APT37 has launched a sophisticated new campaign using a fresh set of custom malware tools specifically
Previously harmless Google API keys now expose Gemini AI data
Google API keys for services like Maps embedded in accessible client-side code could be used to authenticate to the Gemini AI assistant
PhishingLed Agent Tesla Campaign Uses Process Hollowing and AntiAnalysis to Evade Detection
A newly uncovered phishing campaign is delivering Agent Tesla, one of the most widely used credential-stealing malware families, through a