threat actor news
11 stories
N0n Ransomware Group Emerges, Quickly Targets Victims
A new ransomware operation, dubbed N0n, has reportedly emerged and is actively targeting organizations, according to recent observations. The group has quickly established an online presence, including a dark web leak site where it claims to be publishing data from compromised entities. This rapid operationalization suggests a prepared and potentially well-resourced threat actor.
Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
A new entity calling itself "Ransom Busters" has reportedly begun contacting victims of ransomware attacks, asserting that it has successfully breached the servers of various ransomware groups. Ransom Busters is subsequently offering to delete the data stolen by these ransomware groups for a fee, which reportedly ranges from $20,000 to $60,000. This development introduces a novel layer to the…
Cavern C2 Framework Evolves With DNS and Google Apps Script
New analysis indicates that the Cavern command-and-control (C2) framework, attributed to Iranian nation-state actors, has undergone significant evolution. Researchers have observed the integration of DNS and Google Apps Script into the framework's operational mechanisms. This development suggests an effort to improve the stealth and resilience of the C2 infrastructure, particularly in…
TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign
Reports indicate that the threat actor group identified as TeamPCP has been active since at least 2020, engaging in cybercriminal operations that predate their more widely recognized supply chain campaigns. Early activities attributed to the group reportedly involved exploiting vulnerabilities in internet-facing infrastructure, specifically mentioning Redis servers and AI platforms. These…
Chinese Hacker Uses DeepSeek AI to Orchestrate Vulnerability Exploits
A Chinese threat actor has reportedly leveraged large language models (LLMs), including DeepSeek AI's Hermes Agent, to automate and accelerate vulnerability exploitation campaigns against internet-exposed infrastructure in Asia. The actor, known by the aliases 'knaithe' and 'KnYuan' and believed to be based in Zhuhai, China, is described as an opportunistic exploit operator and binary security…
Fake 7-Zip Installers Hijack Devices for Proxy Network
A sophisticated operation has been discovered that utilizes fake software installers, specifically those mimicking the popular 7-Zip file archiver, to compromise user devices and enlist them into a large-scale proxy network. This campaign, attributed to a threat group identified as Lurking Lizard, has been active since at least August 2022 and has reportedly ensnared over 230,000 devices.
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
A Chinese-linked threat actor identified as UAT-7810 is reportedly expanding its network of compromised devices, known as the Operational Relay Box (ORB) network, by deploying new custom malware. Cisco Talos researchers have observed this actor compromising internet-facing networking devices to achieve this expansion.
UAT-7810 continues building ORB networks using new malware
Cisco Talos is tracking an advanced persistent threat (APT) actor known as UAT-7810, which is actively developing and deploying new malware to expand its "Operational Relay Box" (ORB) networks. These networks are believed to be used by secondary threat actors to conduct attacks against high-value targets. UAT-7810 was previously identified as the entity responsible for the LapDogs ORB network.
Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign
A newly identified threat actor, dubbed Armored Likho, has been observed conducting targeted phishing campaigns against government agencies and the electric power sector in Russia, Brazil, and Kazakhstan. This group, also referred to as Eagle Werewolf based on circumstantial evidence, employs a sophisticated toolkit that includes a previously undocumented information stealer named BusySnake…
Gamaredon Group Evolves Tactics With New Tools and Alliances
The Russia-aligned advanced persistent threat (APT) group Gamaredon, also known as UAC-0010, maintained a high operational tempo throughout 2025, primarily targeting governmental and military institutions in Ukraine. The group, which the Security Service of Ukraine (SSU) attributes to the 18th Center of Information Security of Russia's FSB, significantly evolved its tactics, tools, and…
Cloud Worm PCPJack Steals Credentials and Evicts TeamPCP Artifacts
A newly identified cloud worm, dubbed PCPJack, is actively targeting exposed cloud infrastructure to steal credentials and remove any artifacts associated with the threat actor group TeamPCP. SentinelLabs researchers discovered the framework, which operates as a credential theft toolset that propagates across cloud environments.