Cybercrime
-
Fake Next.js interview projects backdoor developer machines
Fake Next.js repositories and coding tests are being used to trigger remote code execution on developer machines. Malicious JavaScript runs when projects are opened or run then installs backdoors and exfiltrates data.
-
Suspected Chinese cyberespionage used Google Sheets API to hide C2 in campaign affecting 53 organisations
A suspected Chinese threat actor used Google Sheets API calls for command-and-control in a global campaign that affected 53 organisations in 42 countries since 2023. A technical analysis details the GRIDTIDE backdoor and mitigation steps.
-
U.S. sanctions Russian exploit broker for buying stolen zero day tools
Matrix LLC and its owner were sanctioned under the Protecting American Intellectual Property Act after purchasing stolen zero day exploits. The action freezes U.S. assets and follows the sentencing of a former defense contractor executive.
-
1Campaign cloaking service helps malicious Google Ads evade detection
1Campaign is a cloaking service that helps malicious Google Ads pass automated screening and remain online for years. One observed campaign filtered 99.4% of visitors while redirecting a small fraction to attacker-controlled pages.
-
ShinyHunters posts 12.4 million records alleged to be from CarGurus
A 6.1GB archive claiming 12.4 million CarGurus records was posted by ShinyHunters on February 21. A Have I Been Pwned breach listing says about 3.7 million records appear to be new.
-
Lazarus Group uses Medusa ransomware in Middle East attack
A technical report by Broadcom’s Symantec and Carbon Black Threat Hunter Team reported that the Lazarus Group used Medusa ransomware in a Middle East attack and attempted an unsuccessful strike against a U.S. healthcare organization.
-
UnsolicitedBooker uses LuciDoor and MarsSnake to target Central Asian telecoms
UnsolicitedBooker deployed LuciDoor and MarsSnake backdoors against telecom companies in Kyrgyzstan and Tajikistan using phishing and multiple loaders between September 2025 and January 2026.
-
AI-assisted actor exploits weak FortiGate management to compromise over 600 devices
A technical report by Amazon Integrated Security says a Russian-speaking actor used commercial generative AI to compromise more than 600 FortiGate firewalls across 55 plus countries by exploiting exposed management ports and weak credentials.
-
APT28 targets Western and Central Europe with document beacons and webhook exfiltration
APT28 ran Operation MacroMaze from September 2025 to January 2026 targeting Western and Central Europe, using spear-phishing documents that beacon to webhook hosts and exfiltrate command output through browser-based HTML forms.
-
Polish police dismantle Facebook phishing ring that seized more than 100,000 logins
Polish cybercrime officers dismantled a phishing ring that seized Facebook accounts and BLIK codes. Investigators identified 11 members, seized over 100,000 logins and passwords, and more than 400 charges have been filed.
