Latest threat reports & articles

snyk_blog · tlp:amber · 4/29/2026, 12:00:00 AM

"A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages A new npm supply chain attack self-branded "Mini Shai-Hulud" compromised four SAP-ecosystem packages on April 29, 2026. Snyk has live advisories. Here's the technical breakdown, IOCs, and what to do. Bun-Based Stealer Hits SAP CAP npm Packages | Snyk You need to enable JavaScript to run this app. Skip to main content Platform Platform Snyk AI Security Platform Modern security in a sing…

chainalysis · tlp:amber · 4/28/2026, 11:00:38 PM

Australia’s Crypto Crossroads: Regulation is Here, Now Comes the Hard Part TL;DR Australian exchanges should not treat April 2027 as the first compliance date. AUSTRAC obligations and readiness expectations are already… The post Australia’s Crypto Crossroads: Regulation is Here, Now Comes the Hard Part appeared first on Chainalysis . Australia's Crypto Crossroads - Chainalysis Chainalysis Products Crypto Investigations Investigations Solutions Reactor Inves…

huggingface_blog · tlp:amber · 4/28/2026, 3:58:57 PM

Introducing NVIDIA Nemotron 3 Nano Omni: Long-Context Multimodal Intelligence for Documents, Audio and Video Agents Introducing NVIDIA Nemotron 3 Nano Omni: Long-Context Multimodal Intelligence for Documents, Audio and Video Agents Hugging Face Models Datasets Spaces Buckets new Docs Enterprise Pricing Log In Sign Up Back to Articles Introducing NVIDIA Nemotron 3 Nano Omni: Long-Context Multimodal Intelligence for Documents, Audio and Video Agents Enterprise + Article Publis…

talos · tlp:amber · 4/28/2026, 1:23:20 PM

Five defender priorities from the Talos Year in Review With attackers moving faster than ever, it’s easy to feel overwhelmed. This blog breaks down five practical priorities from the Cisco Talos 2025 Year in Review to help defenders focus and prioritize, amidst all the noise. A familiar theme in security right now is that the barrier to entry for attackers is at an all-time low. AI tools can spin up websites within minutes that can easily direct data to disposable exte…

checkpoint_research · tlp:amber · 4/28/2026, 1:03:01 PM

VECT: Ransomware by design, Wiper by accident Key Takeaways Background VECT Ransomware is a Ransomware-as-a-Service (RaaS) program that made its first appearance in December 2025 on a Russian-language cybercrime forum. After claiming their first two victims in January 2026, the group got back into the public eye due to an announcement of a partnership with TeamPCP, the actor behind several supply-chain attacks […] The post VECT: Ransomware by design, Wiper by accident …

cisa_alerts · tlp:amber · 4/28/2026, 12:00:00 PM

CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2024-1708 ConnectWise ScreenConnect Path Traversal Vulnerability CVE-2026-32202 Microsoft Windows Protection Mechanism Failure Vulnerability These types of vulnerabilities are frequent attack vectors for malic…

cisa_alerts · tlp:amber · 4/28/2026, 12:00:00 PM

NSA GRASSMARLIN View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to disclose sensitive information. The following versions of NSA GRASSMARLIN are affected: GRASSMARLIN vers:all/* CVSS Vendor Equipment Vulnerabilities v3 5.5 NSA NSA GRASSMARLIN Improper Restriction of XML External Entity Reference Background Critical Infrastructure Sectors: Information Technology Countries/Areas Deployed: Worldwide Company Headquarters Location: United S…

snyk_blog · tlp:amber · 4/27/2026, 11:00:00 PM

Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers Attackers exploited a GitHub Actions script injection vulnerability to publish a malicious version of the elementary-data Python CLI (v0.23.3), embedding a credential-stealing backdoor that targeted dbt profiles, cloud provider keys, and SSH secrets from data engineering environments. Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers | …

ars_security · tlp:amber · 4/27/2026, 9:04:03 PM

Open source package with 1 million monthly downloads stole user credentials If you're one of millions using element-data, it's time to check for compromise. Open source software with more than 1 million monthly downloads was compromised after a threat actor exploited a vulnerability in the developers’ account workflow that gave access to its signing keys and other sensitive information. On Friday, unknown attackers exploited the vulnerability to push a new version of elemen…

chainalysis · tlp:amber · 4/27/2026, 6:35:03 PM

OFAC Updates Central Bank of Iran Designation Following Record $344 Million Tether Seizure amid Strait of Hormuz Toll Controversy On April 24, 2026, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) updated its designation of… The post OFAC Updates Central Bank of Iran Designation Following Record $344 Million Tether Seizure amid Strait of Hormuz Toll Controversy appeared first on Chainalysis . OFAC Updates Central Bank of Iran Designation …

checkpoint_research · tlp:amber · 4/27/2026, 12:07:53 PM

27th April – Threat Intelligence Report For the latest discoveries in cyber research for the week of 27th April, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Vercel, a frontend cloud platform, has disclosed a security incident linked to a compromise at Context.ai, where stolen OAuth tokens enabled unauthorized access through a connected app. The company reported access to employee […] The post 27th April – Threat Intelligence Report appear…

huggingface_blog · tlp:amber · 4/27/2026, 12:00:00 AM

How to build scalable web apps with OpenAI's Privacy Filter How to build scalable web apps with OpenAI's Privacy Filter Hugging Face Models Datasets Spaces Buckets new Docs Enterprise Pricing Log In Sign Up Back to Articles How to build scalable web apps with OpenAI's Privacy Filter Published April 27, 2026 Update on GitHub Upvote 7 +1 yuvraj sharma ysharma Follow Freddy Boulton freddyaboulton Follow Abubakar Abid abidlabs Follow The model 1. Document Privacy Explorer 2.…

unit42 · tlp:amber · 4/24/2026, 8:30:19 PM

TGR-STA-1030: New Activity in Central and South America Unit 42 research reports that TGR-STA-1030 remains an active threat, particularly in Central and South America. The post TGR-STA-1030: New Activity in Central and South America appeared first on Unit 42 . TGR-STA-1030: New Activity in Central and South America Menu Tools ATOMs Security Consulting About Us Under Attack? Threat Research Center Insights General General TGR-STA-1030: New Activity in Central and South Ameri…

chainalysis · tlp:amber · 4/24/2026, 7:26:06 PM

U.S. Government Unveils Sweeping Enforcement Actions Against Southeast Asian Scam Centers and Crypto Fraud Networks TL;DR In a massive coordinated interagency effort, the Department of Justice (DOJ), the Department of the Treasury’s Office of Foreign… The post U.S. Government Unveils Sweeping Enforcement Actions Against Southeast Asian Scam Centers and Crypto Fraud Networks appeared first on Chainalysis . U.S. Crackdown on Southeast Asian Crypto Scam Centers Chainalys…

ars_security · tlp:amber · 4/24/2026, 7:00:39 PM

Why are top university websites serving porn? It comes down to shoddy housekeeping. Hundreds of subdomains from dozens of universities have been hijacked by scammers. Websites for some of the world’s most prestigious universities are serving explicit porn and malicious content after scammers exploited the shoddy record-keeping of the site administrators, a researcher found recently. The sites included berkeley.edu, columbia.edu, and washu.edu, the official domains for the U…

chainalysis · tlp:amber · 4/24/2026, 6:37:17 PM

EU’s 20th Russia Sanctions Package Signals a New Era of Crypto-Specific Enforcement TL;DR The EU’s 20th Russia sanctions package introduces a total sectoral ban on Russia-based crypto service providers and decentralized platforms,… The post EU’s 20th Russia Sanctions Package Signals a New Era of Crypto-Specific Enforcement appeared first on Chainalysis . EU's 20th Russia Sanctions Package Chainalysis Products Crypto Investigations Investigations Solutions R…

cisa_alerts · tlp:amber · 4/24/2026, 12:00:00 PM

CISA Adds Four Known Exploited Vulnerabilities to Catalog CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2024-7399 Samsung MagicINFO 9 Server Path Traversal Vulnerability CVE-2024-57726 SimpleHelp Missing Authorization Vulnerability CVE-2024-57728 SimpleHelp Path Traversal Vulnerability CVE-2025-29635 D-Link DIR-823X Command Injection Vuln…

eset · tlp:amber · 4/24/2026, 9:00:00 AM

The calm before the ransom: What you see is not all there is A breach claims the systems as well as the confidence that was, in retrospect, a major vulnerability The calm before the ransomware storm: What you see is not all there is Award-winning news, views, and insight from the ESET security community English Español Deutsch Português Français TIPS & ADVICE BUSINESS SECURITY ESET RESEARCH About ESET Research Blogposts Podcasts White papers Threat reports WeLiveScience…

huggingface_blog · tlp:amber · 4/24/2026, 12:00:00 AM

DeepSeek-V4: a million-token context that agents can actually use DeepSeek-V4: a million-token context that agents can actually use Hugging Face Models Datasets Spaces Buckets new Docs Enterprise Pricing Log In Sign Up Back to Articles DeepSeek-V4: a million-token context that agents can actually use Published April 24, 2026 Update on GitHub Upvote 43 +37 ben burtenshaw burtenshaw Follow The KV cache problem for agents Hybrid attention: CSA and HCA What changes for agents In…

sentinelone · tlp:amber · 4/23/2026, 10:00:45 PM

fast16 | Mystery Shadow Brokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet A previously unknown 2005 cyber sabotage framework patches high-precision calculation software in memory to silently corrupt results. Update | 07 May 2026 Executive Summary SentinelLABS has uncovered a previously undocumented cyber sabotage framework whose core components date back to 2005, tracked as fast16. fast16.sys selectively targets high-precision calculation sof…

unit42 · tlp:amber · 4/23/2026, 8:45:50 PM

Frontier AI and the Future of Defense: Your Top Questions Answered What are the next steps for security leaders in this new age of frontier AI? We answer the top 10 questions customers are asking. The post Frontier AI and the Future of Defense: Your Top Questions Answered appeared first on Unit 42 . Frontier AI and the Future of Defense: Your Top Questions Answered Menu Tools ATOMs Security Consulting About Us Under Attack? Threat Research Center Insights General General Fr…

ars_security · tlp:amber · 4/23/2026, 8:41:23 PM

In a first, a ransomware family is confirmed to be quantum-safe Technically speaking, there's no practical benefit to use PQC. So why is it being used? A relatively new ransomware family is using a novel approach to hype the strength of the encryption used to scramble files—making, or at least claiming, that it is protected against attacks by quantum computers. Kyber, as the ransomware is called, has been around since at least last September and quickly attracted attention …

chainalysis · tlp:amber · 4/23/2026, 7:00:11 PM

Inside the KelpDAO Bridge Exploit: How ~$292 Million in rsETH Was Released Against a Non-Existent Burn TL;DR On April 18, 2026, attackers linked to North Korea’s Lazarus Group stole ~$292 million (116,500 rsETH) from KelpDAO’s LayerZero… The post Inside the KelpDAO Bridge Exploit: How ~$292 Million in rsETH Was Released Against a Non-Existent Burn appeared first on Chainalysis . Inside the KelpDAO Bridge Exploit Chainalysis Products Crypto Investigations Investigation…

talos · tlp:amber · 4/23/2026, 6:00:22 PM

It pays to be a forever student In this newsletter, Joe discusses why understanding other disciplines can often flow back into the macro and micro of cybersecurity, especially in a world of AI. Welcome to this week’s edition of the Threat Source newsletter. If I haven’t said it in a newsletter before, I'll say it now: If you want to be good at cybersecurity, be a forever student. Cultivating and feeding your desire to know how th…

talos · tlp:amber · 4/23/2026, 3:10:57 PM

UAT-4356's Targeting of Cisco Firepower Devices Cisco Talos is aware of UAT-4356's continued active targeting of Cisco Firepower devices’ Firepower eXtensible Operating System (FXOS). UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices. Cisco Talos is aware of UAT-4356 's continued active targeting of Cisco Firepower devices’ Firepower eXtensible Operating System (FXOS). UAT-4356 exploite…

mandiant · tlp:amber · 4/23/2026, 2:00:00 PM

Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite Written by: JP Glab, Tufail Ahmed, Josh Kelley, Muhammad Umair Introduction Google Threat Intelligence Group (GTIG) identified a multistage intrusion campaign by a newly tracked threat group, UNC6692, that leveraged persistent social engineering, a custom modular malware suite, and deft pivoting inside the victim’s environment to achieve deep network penetration. As with many other intrus…

trail_of_bits · tlp:amber · 4/23/2026, 12:00:00 PM

Trailmark turns code into graphs We’re open-sourcing Trailmark , a library that parses source code into a queryable call graph of functions, classes, call relationships, and semantic metadata, then exposes that graph through a Python API that Claude skills can call directly. Install it now: uv pip install trailmark “Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win.” John Lambert’s widely cited observation abo…

cisa_alerts · tlp:amber · 4/23/2026, 12:00:00 PM

Intrado 911 Emergency Gateway (EGW) (Update A) View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to read, modify, or delete files. The following versions of Intrado 911 Emergency Gateway (EGW) are affected: Emergency Gateway 7.x (CVE-2026-6074) Emergency Gateway 6.x (CVE-2026-6074) Emergency Gateway 5.x (CVE-2026-6074) CVSS Vendor Equipment Vulnerabilities v3 9.8 Intrado Intrado 911 Emergency Gateway (EGW) Path Traversal: '.../...//' Bac…

cisa_alerts · tlp:amber · 4/23/2026, 12:00:00 PM

Defending Against China-Nexus Covert Networks of Compromised Devices Defending against china-nexus covert networks of compromised devices executive summary Defending against China-nexus covert networks of compromised devices Explaining the widespread shift in tactics, techniques and procedures (TTPs) towards networks of compromised infrastructure, and how to defend against it Summary With support from the UK Cyber League , this advisory has been jointly released …

cisa_alerts · tlp:amber · 4/23/2026, 12:00:00 PM

Milesight Cameras View CSAF Summary Successful exploitation of these vulnerabilities could crash the device being accessed or allow remote code execution. The following versions of Milesight Cameras are affected: MS-Cxx63-PD <=51.7.0.77-r12 (CVE-2026-28747, CVE-2026-27785, CVE-2026-32644, CVE-2026-32649, CVE-2026-20766) MS-Cxx64-xPD <=51.7.0.77-r12 (CVE-2026-28747, CVE-2026-27785, CVE-2026-32644, CVE-2026-32649, CVE-2026-20766) MS-Cxx73-xPD <=51.7.0.77-r12 (CVE-2026…

chainalysis · tlp:amber · 4/23/2026, 11:55:32 AM

$30 Billion and Counting: How Tokenized RWAs Are Becoming a Mainstream Investment for Institutional Capital This blog is a preview of our forthcoming report, “The New Rails: How Digital Assets Are Reshaping the Foundations of… The post $30 Billion and Counting: How Tokenized RWAs Are Becoming a Mainstream Investment for Institutional Capital appeared first on Chainalysis . Tokenized RWAs and On-Chain Commodities Chainalysis Products Crypto Investigations Investigation…

unit42 · tlp:amber · 4/23/2026, 10:00:31 AM

Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System Unit 42 reveals how multi-agent AI systems can autonomously attack cloud environments. Learn critical insights and vital lessons for proactive security. The post Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System appeared first on Unit 42 . Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System …

eset · tlp:amber · 4/23/2026, 8:59:18 AM

GopherWhisper: A burrow full of malware ESET Research has discovered a new China-aligned APT group that we’ve named GopherWhisper, which targets Mongolian governmental institutions GopherWhisper: A burrow full of malware Award-winning news, views, and insight from the ESET security community English Español Deutsch Português Français TIPS & ADVICE BUSINESS SECURITY ESET RESEARCH About ESET Research Blogposts Podcasts White papers Threat reports WeLiveScience FEATURED Uk…

huggingface_blog · tlp:amber · 4/23/2026, 12:00:00 AM

How to Use Transformers.js in a Chrome Extension How to Use Transformers.js in a Chrome Extension Hugging Face Models Datasets Spaces Buckets new Docs Enterprise Pricing Log In Sign Up Back to Articles How to Use Transformers.js in a Chrome Extension Published April 23, 2026 Update on GitHub Upvote 32 +26 Nico Martin nico-martin Follow Who this is for What we will build 1) Chrome extension architecture (MV3) 1.1 Runtime contexts and entry points 1.2 What runs where 1.3 Messa…

ars_security · tlp:amber · 4/22/2026, 10:07:54 PM

Crypto scam lures ships into Strait of Hormuz, falsely promising safe passage Ship attacked by Iran after possibly falling for safe passage crypto scam. Crypto scammers are targeting the thousands of ships stranded near the Strait of Hormuz—and at least one ship that faced Iranian gunfire may have been tricked into believing it had paid Iran for safe passage. The first warning of such a crypto scam came from the Greek maritime risk management company MARISKS on April 20, ac…

sentinelone · tlp:amber · 4/22/2026, 10:00:15 PM

LABScon25 Replay | Are Your Chinese Cameras Spying For You Or On You? Marc Rogers and Silas Cutler expose how cheap smart home devices conceal a shadow supply chain of shell companies, firmware flaws, and foreign data routing. In this LABScon 25 presentation, Marc Rogers and Silas Cutler explore the complex, “shadow” supply chain of ultra-cheap Chinese smart home devices, specifically focusing on video doorbells and security cameras widely sold on mainstream onl…

ars_security · tlp:amber · 4/22/2026, 7:32:56 PM

Microsoft issues emergency update for macOS and Linux ASP.NET threat When authentication fails, things can go very, very wrong. Microsoft released an emergency patch for its ASP.NET Core to fix a high-severity vulnerability that allows unauthenticated attackers to gain SYSTEM privileges on devices that use the Web development framework to run Linux or macOS apps. The software maker said Tuesday evening that the vulnerability, tracked as CVE-2026-40372, affects versions 10.0…

talos · tlp:amber · 4/22/2026, 10:00:34 AM

IR Trends Q1 2026: Phishing reemerges as top initial access vector, as attacks targeting public administration persist Phishing reemerged as the most observed means of gaining initial access, accounting for over a third of the engagements where initial access could be determined. Phishing has not been the top vertical for initial access since Q2 2025. Phishing reemerged as the most observed means of gaining initial access, accounting for over a third of the engagements wher…