Threat Intelligence Center

Cybersecurity researchers have identified a sustained campaign by JadeProx, a China-nexus threat actor, deploying a previously undocumented malware loader named TriBack against government and healthcare organizations. The attack chain leverages multiple tools including AdaptixC2, Beagle, DonutLoader, and Nuclei to establish persistence and move laterally within networks.

Despite promises of stronger authentication, flawed passkey implementations are vulnerable to attacks that security teams thought were obsolete. CVE-2026-34348 demonstrates that improper passkey deployment allows attackers to circumvent authentication controls using techniques that predate modern passwordless systems.

Security researchers have identified msaRAT, a remote access trojan deployed by the Chaos ransomware group that leverages browser processes to establish covert command-and-control communications. This living-off-the-browser technique uses legitimate system components to evade detection, with delivery through malicious MSI installers like update_ms.msi and DLL injection via lib.dll.

TriWest Healthcare Alliance disclosed a breach affecting 11,848 Tricare beneficiaries on May 21, 2026, after discovering unauthorized network access on April 16. While most victims had names and Department of Defense Benefits Numbers exposed, only five individuals had Social Security numbers stolen.

The FBI has issued a warning regarding deepfake videos that impersonate Internet Crime Complaint Center (IC3) leadership in coordinated fraud schemes. Group-IB threat intelligence researchers have documented how threat actors are leveraging synthetic media to establish false credibility and manipulate victims into transferring funds or disclosing sensitive information.

Security researchers have identified ClickFake, a North Korean-attributed campaign targeting Web3 professionals and cryptocurrency workers. Linked to threat actors Famous Chollima and Wagemole, the campaign deploys multiple malware variants including ClickFix, GolangGhost, and PylangGhost to compromise targets in the cryptocurrency and blockchain sectors.