Follow on X RSS Feed

Delivering simplified cybersecurity alerts and information, ensuring you're always prepared to take immediate action.

Fileless EggStreme Malware Campaign Attributed to Chinese APT Against Military Organisations
Malware, EggStreme, Fileless Malware, DLL Sideloading, Espionage, APT

Fileless EggStreme Malware Campaign Attributed to Chinese APT Against Military Organisations

Threat Group – China-based APT actors Threat Type – Fileless malware and espionage backdoor Exploited Vulnerabilities – DLL sideloading, fileless memory injection (no CVEs assigned) Malware Used – EggStremeFuel, EggStremeLoader, EggStremeReflectiveLoader, EggStremeAgent, EggStremeKeylogger, EggStremeWizard Threat Score – 8.0 🔴 High Last Threat Observation – 11 September 2025 Overview A newly discovered espionage framework named EggStreme has
4 min read
MostereRAT Expands Post-Exploitation with Remote Access Software
MostereRAT, Remote Access Trojan, AnyDesk, TightVNC, Phishing

MostereRAT Expands Post-Exploitation with Remote Access Software

Threat Group – Unknown Threat Type – Remote Access Trojan with remote administration tool deployment Exploited Vulnerabilities – Phishing vectors, TightVNC privilege escalation CVE-2023-27830 Malware Used – MostereRAT Threat Score – 7.8 🔴 High Last Threat Observation – 9 September 2025 Overview A phishing campaign uncovered by Fortinet on 9 September 2025 is distributing MostereRAT, a
3 min read
Unknown Actors Launch High Severity NPM Supply Chain Malware Attack
SupplyChain, Malware, OpenSource, NPM, Phishing

Unknown Actors Launch High Severity NPM Supply Chain Malware Attack

Threat Group – Unknown criminal actors via phishing campaign Threat Type – Supply-Chain Attack / Malware Injection Exploited Vulnerabilities – Phishing via typosquatted domain, credential theft, token misuse Malware Used – Crypto-wallet address swap, WebSocket-based backdoor, Scavenger infostealer Threat Score – 7.5 🔴 High – Advanced targeted attack on trusted dev ecosystem; widespread impact and high stealth
3 min read
Plex users urged to reset passwords after database compromise
Breach, Article, news, Plex

Plex users urged to reset passwords after database compromise

Threat Group – Unknown threat actor Threat Type – Data Breach / Account Compromise Exploited Vulnerabilities – Unauthorised access to Plex authentication database Malware Used – None confirmed Threat Score – 🔴 7.5 High – Large-scale exposure of account credentials with password reuse risks Last Threat Observation – 8 September 2025 Overview On 8 September 2025, Plex confirmed
2 min read
Windows under threat from Rustonotto Rust backdoor and Python loader operated by APT37

Windows under threat from Rustonotto Rust backdoor and Python loader operated by APT37

Threat Group – APT37 (ScarCruft / Ruby Sleet / Velvet Chollima) Threat Type – Backdoor / Surveillance Exploited Vulnerabilities – Spear-phishing via malicious Windows shortcut (LNK) and CHM help file vectors Malware Used – Rustonotto (Rust-based backdoor), Chinotto (PowerShell), FadeStealer (Python-based stealer) Threat Score – 5.5 🟠 Elevated Justification – Combines multiple stages: stealthy Rust backdoor, multi-stage infection chain,
2 min read
Sindoor Dropper Phishing Exploits Linux Desktop Files for Persistent Remote Control
Phishing

Sindoor Dropper Phishing Exploits Linux Desktop Files for Persistent Remote Control

Threat Group: Transparent Tribe / APT36 / Mythic Leopard / G0134 Threat Type: Targeted phishing dropper, Linux desktop shortcut abuse, remote administration tool deployment, cyber espionage Exploited Vulnerabilities: No public CVE exploitation confirmed. Abuse of Linux .desktop launcher behaviour, user execution, weak attachment controls, and trusted cloud storage delivery. Malware Used: Sindoor Dropper
5 min read
Skype Delivered SCR and PIF Files Deploy GodRAT Malware in Financial Campaigns
Malware

Skype Delivered SCR and PIF Files Deploy GodRAT Malware in Financial Campaigns

Threat Group: Winnti (APT41) – suspected attribution based on code lineage and targeting Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: Social engineering via Skype delivering malicious .SCR and .PIF files containing steganographic shellcode in JPEGs and DLL sideloading Malware Used: GodRAT – evolution of Gh0st RAT and AwesomePuppet, featuring plugin-based architecture
4 min read
Microsoft 365 Exchange Online Direct Send exploited for internal phishing campaigns
Phishing

Microsoft 365 Exchange Online Direct Send exploited for internal phishing campaigns

Threat Group: Opportunistic and financially motivated actors targeting multiple sectors Threat Type: Phishing and email infrastructure abuse Exploited Vulnerabilities: Abuse of Microsoft 365 Exchange Online Direct Send feature; implicit trust of unauthenticated internal-looking emails; weak or unenforced SPF, DKIM, and DMARC Malware Used: None required for initial access; follow-on payloads
4 min read