Threat Intelligence Center

Security researchers have identified a campaign by suspected Chinese threat actor UNK_MassTraction targeting academic institutions through vulnerable Roundcube webmail servers. The threat group exploits CVE-2024-42009 and CVE-2025-49113 to deploy IceCube and VShell malware, establishing persistent access to university email systems and research networks.

Researchers have identified SkillCloak, a malware variant deployed by ClawHavoc that uses self-extracting packing to bypass static security scanners. The malware, associated with tools like SKILLDETONATE and omnicogg, specifically targets finance and software development organizations.

Criminal groups and ransomware operators have shifted focus to SaaS infrastructure as a primary attack vector. When organizations rely on single instances of cloud applications without failover mechanisms or architectural redundancy, they create exploitable chokepoints.

On June 30, 2026, Apple released security updates addressing 28 vulnerabilities across iOS, macOS, iPadOS, and Safari. The vulnerability set includes CVE-2026-39868 and CVE-2026-43676 among others, spanning multiple severity levels and attack surfaces.

A U.S. government agency became the subject of a significant ransomware extortion case when it paid $1 million to the Kairos ransomware group following a data theft incident. The case underscores the operational sophistication of threat actors including Black Basta, Conti, and the Silent Ransom Group, which have systematically targeted government entities and financial institutions.

Security researchers have identified a large-scale supply chain attack attributed to North Korean threat actors operating under the PolinRider campaign. The operation distributed 108 malicious npm packages and browser extensions designed to compromise developers in cryptocurrency and software development sectors.