Threat Intelligence Center

Evooo1Bot, a Mirai-based botnet tracked by Fortinet since July, infects routers from NETGEAR, D-Link, Tenda, and others to convert them into SOCKS5 relay nodes.

Device code authentication was built for input-constrained devices, and attackers have learned to turn that convenience against users. This analysis walks through an AI-enabled device code phishing campaign, examining how the operation was assembled, how AI factored into it, and why the abuse of a legitimate sign-in flow makes this technique harder to spot than conventional credential phishing.

Automated notifications, password resets, and system alerts often go out from no-reply addresses that nobody verifies. A researcher registered the domain noreply.net and found companies sending him their secrets, because their outbound mail and reply paths pointed to a domain they did not control. Any address your systems generate is infrastructure someone else can own if you do not.

A maximum-severity flaw in SAP Commerce Cloud has moved from disclosure to real-world exploitation, putting deployments of the commerce platform at risk. The reporting tracks four identifiers: CVE-2026-22732, CVE-2026-34263, CVE-2026-44761 and CVE-2026-58231. Teams running SAP Commerce Cloud should confirm patch status and review logs for exploitation attempts.

Texas Hearing Institute notified 29,744 patients after the Interlock ransomware group stole 540 GB of files including Social Security numbers and diagnosis records.

The Akira ransomware group is abusing a legitimate Windows feature to neutralize endpoint detection and response. By modifying boot configuration with bcdedit and msconfig.exe, operators reboot hosts into Safe Mode, where most EDR agents and security services do not start, and then execute akira.exe.