Threat Intelligence Center

Security researchers have identified active exploitation campaigns targeting StoneFly Storage Concentrator devices across multiple critical infrastructure sectors including defense, energy, financial services, healthcare, and IT organizations. These attacks exploit vulnerabilities in storage infrastructure to gain persistent access to sensitive data and operational systems.

Webshells remain a persistent threat in post-compromise scenarios, with variants like ZypeerShell and Fortress Layer actively deployed against professional service organizations. These lightweight backdoors provide attackers with sustained command execution and lateral movement capabilities while evading traditional endpoint detection.

Huntress security researchers have identified Kali365, a coordinated device code phishing ecosystem operated by multiple threat actors including Storm-2372, Freedom365, and Octopi365. The campaign leverages EvilTokens and related tooling to conduct large-scale credential harvesting attacks against Microsoft account holders.

Turla has deployed STOCKSTAY, a sophisticated intelligence gathering malware framework targeting government, military, diplomatic, and educational institutions. The toolkit includes multiple specialized components—DIAMONDBACK, K1MORPHER, KAZUAR, and variants like STOCKSTAY.MARKETMAKER, STOCKSTAY.STOCKBROKER, STOCKSTAY.STOCKMARKET, and STOCKSTAY.

The Cybersecurity and Infrastructure Security Agency has set an urgent deadline for organizations to patch two critical Cisco vulnerabilities, CVE-2026-12569 and CVE-2026-20230, after confirming active exploitation in the wild. These flaws impact apparel, consumer products, engineering, footwear, manufacturing, and retail sectors.

Check Point Software researchers uncovered a coordinated attack campaign targeting cryptocurrency and online gambling platforms using a RUST-based clipboard hijacking malware. The threat actors executed an elaborate fake reputation-boosting scheme to gain trust before deploying the clipboard hijacker, which intercepts and modifies wallet addresses during transactions.