#threatintel

An international law enforcement operation seized more than 300 domains tied to the Tycoon2FA phishing platform that powered large-scale MFA-bypass attacks worldwide.

Source: Microsoft Threat Intelligence | Trend Micro

Iran-linked cyber operations are attempting to compromise Hikvision and Dahua internet-connected cameras across several Middle Eastern countries to gain real-time battlefield intelligence.

Source: Check Point Research

A sophisticated exploit toolkit named Coruna is targeting iPhones running iOS 13 through 17.2.1, chaining 23 vulnerabilities to enable espionage and financially motivated attacks.

Source: Google Threat Intelligence Group | The Register

Two serious vulnerabilities affecting Qualcomm chipsets and VMware Aria Operations are now being actively exploited, prompting their addition to CISA’s Known Exploited Vulnerabilities catalogue and raising risks for affected systems.

Source: Cybersecurity and Infrastructure Security Agency (CISA)

Hackers posing as Microsoft Teams installers were stopped after Microsoft revoked more than 200 fake digital certificates used to spread Rhysida ransomware, reports SecurityWeek.

Source: SecurityWeek

The Qilin ransomware gang is striking harder than ever, using cloud tools like Cyberduck to steal data and cripple systems across manufacturing and research sectors, with over 40 new victims each month.

Source: Cisco Talos

A dangerous malware campaign is spreading through fake GitHub repos and bogus Cloudflare pages, tricking users into pasting malicious PowerShell commands. Once run, CastleLoader pulls in info stealers and RATs like RedLine and HijackLoader — and hundreds of victims are already compromised.

Source: Prodaft

Hackers linked to North Korea hijacked cyber intelligence platforms to monitor their own exposure, quickly spinning up fresh infrastructure to keep luring victims while evading disruption.

Source: SentinelLabs