#threatintel — Public Fediverse posts

🆕 Tracking ID search has a new start page listing the most widespread IDs, an AS number such as AS13335 now finds that network's scans from any search box, and scan times show in your own time zone

https://scanmalware.com/tracking-search

#ScanMalware #InfoSec #ThreatIntel

UAT-11985 is running AiTM phishing against Taiwan research affiliates using fake event invitations to relay Google logins since mid-2026. Session relay bypasses passwords and weak MFA, risking account takeover and research access. #AptCampaign #GoogleSecurity #Taiwan #ThreatIntel

https://cyberworldops.eu/en/uat-11985-relays-google-logins-through-fake-invitations-targeting

🆕 Pivot graph filters now hide everything they cut off and bring back the same graph when ticked again; ticking a filter always grows the graph from what is on screen, or says why it can't; and exports cover only what is shown, with the JSON listing which sites share values

https://scanmalware.com/graph

#ScanMalware #InfoSec #ThreatIntel

Langflow fixed CVE-2026-105740, a critical command injection enabling RCE with CVSS 9.9. Exploitation attempts have been observed, putting exposed AI workflow servers at immediate risk. Patch to 1.9.0 and review logs for compromise. #Langflow #RemoteCodeExecution #ThreatIntel

https://cyberworldops.eu/en/langflow-command-injection-draws-exploitation-attempts-as-version-190

🆕 Scan results now name the website builder a page was made with, including AI app builders such as Lovable, v0, Bolt and Base44, and list the project ID the builder leaves on the page as a tracking ID, so other sites built from the same project are one search away. Technology detection also recognises more of the technologies a page uses

https://scanmalware.com/search-advanced

#ScanMalware #InfoSec #ThreatIntel

This one slipped through the cracks this past Patch Tuesday because the CVE started with 2025: CVE-2025-61624 (5.4 medium) path traversal > aribtrary write/delete
https://fortiguard.fortinet.com/psirt/FG-IR-26-122

Unit 42's blog post states it was exploited in the wild: https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/

The attackers exploited another vulnerability, CVE-2025-61624, via FortiOS auto-script path traversal. This exploit facilitated the deployment of PEERSTITCH, a novel, memory-resident ARM64 malware.

#threatintel #eitw #CVE #fortinet #ioc

This one slipped through the cracks because the CVE started with 2025: CVE-2025-61624 (5.4 medium) path traversal > aribtrary write/delete
https://fortiguard.fortinet.com/psirt/FG-IR-26-122

But in Unit 42's blog post, it was exploited in the wild: https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/

The attackers exploited another vulnerability, CVE-2025-61624, via FortiOS auto-script path traversal. This exploit facilitated the deployment of PEERSTITCH, a novel, memory-resident ARM64 malware.

#threatintel #eitw #CVE #fortinet #ioc

📰 China-Linked Group Exploits BeyondTrust Zero-Day in Espionage Attacks

A China-linked group, Armory Castle, is actively exploiting a critical zero-day (CVE-2026-102764) in BeyondTrust Remote Support appliances to gain root access and steal credentials. Patching is urgent. #CyberSecurity #ThreatIntel #ZeroDay #CVE

🔗 https://cyber.netsecops.io/articles/china-linked-hackers-exploit-beyondtrust-zero-day-in-espionage-campaign/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

BeyondTrust Remote Support zero-day CVE-2026-102764 is being exploited by a suspected China-linked actor against hosted and self-hosted appliances. Compromise of these systems risks privileged remote session hijack and downstream enterprise access. Patch and hunt for post-exploitation activity now. #BeyondTrust #ZeroDay #ThreatIntel

https://cyberworldops.eu/en/beyondtrust-remote-support-zero-day-exploited-against-hosted-and-self

🆕 New detection for the operator panel of a malicious browser extension used by a banking trojan, and more precise detection of fake task-and-earn crypto apps

https://scanmalware.com/hunts

#ScanMalware #InfoSec #ThreatIntel

[PEAR] - Ransomware Victim: Solar Communications International - https://www.redpacketsecurity.com/pear-ransomware-victim-solar-communications-international/

#pear #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[PEAR] - Ransomware Victim: Macfarlan Capital Partners - https://www.redpacketsecurity.com/pear-ransomware-victim-macfarlan-capital-partners/

#pear #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[BRAVOX] - Ransomware Victim: Minkon - https://www.redpacketsecurity.com/bravox-ransomware-victim-minkon/

#bravox #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[PEAR] - Ransomware Victim: Caretaker Landscape and Tree Management - https://www.redpacketsecurity.com/pear-ransomware-victim-caretaker-landscape-and-tree-management/

#pear #dark_web #data_breach #OSINT #ransomware #threatintel #tor

🆕 The pivot graph now shows each site once, offers tree, radial, concentric, circle and grid layouts, and keeps large graphs readable

https://scanmalware.com/graph

#ScanMalware #InfoSec #ThreatIntel

🔴 New security advisory:

CVE-2026-111444 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-111444-wheels-sql-injection-leaks-database-data-poc

by Yazoul AI

#Cybersecurity #ZeroDay #ThreatIntel

[THE SEVEN DEADLY SINS] - Ransomware Victim: Globeia Inc[.] - https://www.redpacketsecurity.com/the-seven-deadly-sins-ransomware-victim-globeia-inc/

#the_seven_deadly_sins #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THE SEVEN DEADLY SINS] - Ransomware Victim: Verano Holdings - https://www.redpacketsecurity.com/the-seven-deadly-sins-ransomware-victim-verano-holdings/

#the_seven_deadly_sins #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: SBI Audiovisual Medinbox - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-sbi-audiovisual-medinbox/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: Inovar Packaging Group - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-inovar-packaging-group/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: Pantanal Agricola - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-pantanal-agricola/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THE SEVEN DEADLY SINS] - Ransomware Victim: Canva - https://www.redpacketsecurity.com/the-seven-deadly-sins-ransomware-victim-canva/

#the_seven_deadly_sins #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THE SEVEN DEADLY SINS] - Ransomware Victim: iHeartJane - https://www.redpacketsecurity.com/the-seven-deadly-sins-ransomware-victim-iheartjane/

#the_seven_deadly_sins #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: Suhai Segurana Pessoal - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-suhai-segurana-pessoal/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: Axle Logistics - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-axle-logistics/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[AURORA] - Ransomware Victim: Adams Warehouse & Delivery, Inc[.] - https://www.redpacketsecurity.com/aurora-ransomware-victim-adams-warehouse-delivery-inc/

#aurora #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: Universidade de Passo Fundo - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-universidade-de-passo-fundo/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: Taiwan Otsuka Pharmaceutical - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-taiwan-otsuka-pharmaceutical/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: Santa Barbara Endodontics - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-santa-barbara-endodontics/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: St Peters Anglican Primary School - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-st-peters-anglican-primary-school/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: ServiceMaster of Ottawa - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-servicemaster-of-ottawa/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: Netcore Unbxd - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-netcore-unbxd/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: Saga University - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-saga-university/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: North Bridge Venture Partners - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-north-bridge-venture-partners/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THE SEVEN DEADLY SINS] - Ransomware Victim: Hospital Sírio-Libanês - https://www.redpacketsecurity.com/the-seven-deadly-sins-ransomware-victim-hospital-sirio-libanes/

#the_seven_deadly_sins #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: Tulsat - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-tulsat/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THE SEVEN DEADLY SINS] - Ransomware Victim: Cradlewise Inc[.] - https://www.redpacketsecurity.com/the-seven-deadly-sins-ransomware-victim-cradlewise-inc/

#the_seven_deadly_sins #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: Skin Center - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-skin-center/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: Sladek Partners - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-sladek-partners/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: Petroleum Telcom Communications - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-petroleum-telcom-communications/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: JJS Justice - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-jjs-justice/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[STORM] - Ransomware Victim: R[.] A[.] Wood Associates - https://www.redpacketsecurity.com/storm-ransomware-victim-r-a-wood-associates/

#storm #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[THEGENTLEMEN] - Ransomware Victim: REGiO Nord - https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-regio-nord/

#thegentlemen #dark_web #data_breach #OSINT #ransomware #threatintel #tor

🆕 Improved Security Verdict and AI Security Verdict accuracy, and script analysis now covers more of the scripts a page loads

https://scanmalware.com/about#analysis-modules

#ScanMalware #InfoSec #ThreatIntel

🆕 Scan results now say when the scanned address returned something other than a web page, such as an API response, a PDF, an image, an archive or a program download, and the AI Security Verdict describes it as what it is

https://scanmalware.com/about#analysis-modules

#ScanMalware #InfoSec #ThreatIntel

🆕 New pivot graph: start from any public scan and see which other sites share its titles, favicons, tracking IDs, scripts and threat labels, drawn as a graph you can drag, expand, filter and view full screen. It opens two steps out, so sites one or two hops away show up at once, and a graph can be saved as an image or as JSON. Open it from the Pivot tab of a scan result

https://scanmalware.com/graph

#ScanMalware #InfoSec #ThreatIntel

CVE Alert: CVE-2026-111210 - n/a - bitcoinj - https://www.redpacketsecurity.com/cve-alert-cve-2026-111210-n-a-bitcoinj/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-111210 #n-a #bitcoinj

CVE Alert: CVE-2026-111356 - magicblack - MacCMS - https://www.redpacketsecurity.com/cve-alert-cve-2026-111356-magicblack-maccms/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-111356 #magicblack #maccms

CVE Alert: CVE-2026-111366 - cool-team-official - cool-admin-midway - https://www.redpacketsecurity.com/cve-alert-cve-2026-111366-cool-team-official-cool-admin-midway/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-111366 #cool-team-official #cool-admin-midway

CVE Alert: CVE-2026-111359 - crmeb - CRMEB - https://www.redpacketsecurity.com/cve-alert-cve-2026-111359-crmeb-crmeb/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-111359 #crmeb #