ALL POSTS

Key Findings High-severity zero-day vulnerability CVE-2026-3502 (CVSS 7.8) in TrueConf video conferencing software exploited against Southeast Asian government networks in campaign dubbed TrueChaos Flaw allows attackers controlling on-premises TrueConf servers to distribute tampered updates and execute arbitrary code on all connected endpoints Patched in TrueConf Windows client version 8.5.3 released earlier this month Campaign attributed with moderate confidence to Chinese-n

Key Findings Suspected Iran-nexus threat actor, tracked as "Dust Specter", targeted Iraqi government officials in a campaign observed in January 2026. The threat actor used phishing emails impersonating Iraq's Ministry of Foreign Affairs to deliver previously undocumented malware families, including SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. The attacks involved two different infection chains, one using a password-protected RAR archive and another consolidating the same fu

Key Findings Hackers abused Anthropic's Claude AI model to develop exploits, create custom tools, and automate the exfiltration of over 150GB of data in a cyberattack targeting Mexican government systems. The attackers compromised 10 Mexican government agencies and a financial institution, starting with the tax authority in December 2025. Hackers sent over 1,000 prompts to Claude and used OpenAI's GPT-4.1 to analyze stolen data. By bypassing AI guardrails and framing actions

Key Findings Threat actors affiliated with China have been attributed to a fresh set of cyber espionage campaigns targeting government and law enforcement agencies across Southeast Asia throughout 2025. The activity cluster, tracked by Check Point Research under the moniker "Amaranth-Dragon," shares links to the APT 41 ecosystem. Targeted countries include Cambodia, Thailand, Laos, Indonesia, Singapore, and the Philippines. The campaigns were timed to coincide with sensitive

Key Findings The Russia-aligned threat actor known as UAC-0184 (also tracked as Hive0156) has been targeting Ukrainian military and government entities by leveraging the Viber messaging platform to deliver malicious ZIP archives. The attack campaign involves using Viber to distribute malicious ZIP files disguised as official Ukrainian parliamentary documents and military casualty data. The ZIP archives contain Windows shortcut (LNK) files posing as Microsoft Word and Excel do

Key Findings A Russia-aligned threat group, tracked as UNK_AcademicFlare, has been conducting phishing campaigns that abuse Microsoft 365 device code authentication workflows to steal victims' credentials and take over accounts. The attacks, ongoing since September 2025, target government, military, think tanks, higher education, and transportation sectors in the U.S. and Europe. The adversary uses compromised email addresses belonging to government and military organizations

Key Findings: Major data leak from Chinese security firm Knownsec (aka Chuangyu) in November 2025, with over 12,000 secret files briefly appearing on GitHub. Leak provided a rare insight into China's government-backed hacking tools and operations. The data theft may have occurred as early as 2023, but the files were taken down quickly. Background Knownsec is a prominent player in China's cybersecurity industry, having received a significant investment from Tencent in 2015 and

Key Findings: Microsoft set to receive $12.5 billion in tax breaks in 2026, enough to provide food assistance to 5.2 million people, Medicaid coverage for 1.6 million adults (or 3.8 million children), or reduce ACA premiums for 1.9 million Americans Amazon poised to receive $16 billion in tax reductions this year, which could fund SNAP benefits for 6.6 million people, Medicaid coverage for 2 million adults (or 5.4 million children), or reduce ACA premiums for 2.4 million Amer