Threat Intelligence Center

Conceptual image showcasing cybersecurity threats: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking & more.

ThreatsDay aggregates 15 significant security threats impacting financial services, gaming, and IT services organizations. Key threats include CastleStealer and ClickLock Stealer stealing credentials, Remcos RAT enabling remote access, Spirals and Starland RAT variants, TELEPUZ and WLDR agent malware, and pepesoft.exe exploitation. Threat actor UAT-11795 remains active.

Conceptual image of cybersecurity breach: AsyncAPI npm Package compromised by Miasma Stealer Trojan, highlighting digital security risks.

Security researchers have identified a supply chain compromise targeting the AsyncAPI npm package, where threat actors injected Miasma stealer malware (Trojan:JS/MiasmStealer.SC) into the package to execute malicious payloads at import time.

Conceptual image illustrating cybersecurity risks in cyber insurance policies for regulated firms.

NotPetya, the 2017 state-sponsored wiper malware, fundamentally changed how cyber insurers underwrite coverage. Many policies now contain explicit exclusions for acts of war, state-sponsored attacks, and infrastructure targeting—precisely the attack vectors NotPetya exploited.

Conceptual image depicting SQL injection attack enabling persistence in tech sector, emphasizing cybersecurity and data protection.

Security researchers have documented a sophisticated attack chain where threat actors exploit SQL injection vulnerabilities to achieve persistent access in compromised environments. Following initial compromise, attackers deploy BadIIS alongside malicious IIS modules (HttpCgiModule.dll, HttpFastCgiModule.dll) to maintain backdoor access.

Conceptual image illustrating active exploitation of SonicWall SMA1000 Zero Days CVE-2026-15409 and CVE-2026-15410 in cybersecurity landscape.

Rapid7's managed detection and response team has confirmed active exploitation of two previously unknown vulnerabilities in SonicWall SMA1000 remote access appliances. CVE-2026-15409 and CVE-2026-15410 are being weaponized through Metasploit, making them accessible to threat actors without advanced technical skills.

Conceptual image illustrating undetected Microsoft Secure Boot vulnerability bypass in cybersecurity for a decade.

Security researchers have disclosed CVE-2015-5381, a vulnerability in Microsoft's Secure Boot mechanism that has persisted undetected for approximately ten years. This flaw allows attackers to bypass firmware-level security controls designed to prevent unauthorized code execution during system startup.

Conceptual image illustrating Microsoft Patch Tuesday July 2026 vulnerabilities, Snort detection rules, and cybersecurity measures for data protection.

Microsoft's July 2026 Patch Tuesday addresses 89 distinct vulnerabilities spanning Windows operating systems, Exchange Server, Office applications, and supporting infrastructure. This update includes multiple critical-severity remote code execution flaws that require immediate attention from IT teams managing enterprise deployments.

Threat Intelligence Center

ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking Plus 12 More Stories

AsyncAPI npm Package Compromised with Miasma Stealer Trojan

NotPetya Exclusions in Cyber Insurance Policies Leave Regulated Firms Exposed

SQL Injection Attacks Enable Persistence via BadIIS and XMRig in Tech Sector

SonicWall SMA1000 Zero Days CVE-2026-15409 and CVE-2026-15410 Under Active Exploit

Microsoft Secure Boot Vulnerability CVE-2015-5381 Bypassed for Decade Undetected

Microsoft Patch Tuesday July 2026 Vulnerabilities and Snort Detection Rules

More Articles …

About Us

Areas We Serve

Get the latest news!