Category Archives: Threat Alerts
APT-C-13 Phishing Campaign: Multi-Stage LNK and Tor Tunneling Tactics
Security researchers have identified a complex APT-C-13 Phishing Campaign that utilizes recursive LNK decompression and Tor Hidden Services to create stealthy network backdoors. Continue reading
Microsoft Defender Zero-Days: Active Exploitation of RedSun and UnDefend Flaws
Security researchers and CSIRT-ITA warn of the active exploitation of two unpatched Microsoft Defender zero-days, codenamed RedSun and UnDefend, which allow attackers to bypass security updates and gain SYSTEM-level access. Continue reading
Trigona Exfiltration Tool: New Proprietary Malware Evades Security Defenses
Ransomware affiliates have transitioned to a custom Trigona exfiltration tool to bypass security systems and accelerate data theft through parallel streaming and connection rotation. Continue reading
LMDeploy SSRF Vulnerability: CVE-2026-33626 Under Active Exploitation
A high-severity LMDeploy SSRF vulnerability (CVE-2026-33626) is being actively exploited to bypass network segmentation and access sensitive internal metadata in cloud environments. Continue reading
Signal Phishing Campaign: Russian Intelligence Targets Encrypted Apps
A sophisticated Signal phishing campaign orchestrated by Russian intelligence services is targeting high-value government and military officials through social engineering tactics. Continue reading
ClickFix Social Engineering Campaign Exploits Native Windows Tools
The latest ClickFix social engineering campaign utilizes fake CAPTCHA pages to trick users into executing malicious code via native Windows utilities like cmdkey and regsvr32. Continue reading
Firestarter Stealth Backdoor Discovered in Cisco Networking Infrastructure
CISA warns of the Firestarter stealth backdoor, a sophisticated malware targeting Cisco Secure Firewall devices to maintain persistence within critical national infrastructure. Continue reading
UNC6692 Microsoft Teams Campaign Exploits IT Help Desk
Researchers have identified the UNC6692 Microsoft Teams campaign, a sophisticated social engineering threat where attackers impersonate IT staff to deploy SNOW malware via Quick Assist. Continue reading
Bitwarden CLI Compromise: Malicious npm Supply Chain Attack Discovered
A critical Bitwarden CLI compromise has been detected in the npm ecosystem, where attackers breached the CI/CD pipeline to inject credential-stealing code into version 2026.4.0. Continue reading