US indicts Black Kingdom ransomware operator: technical analysis of ProxyLogon exploitation and law enforcement response
The U.S. Department of Justice unsealed charges against Yemeni national Rami Khaled Ahmed (36) for deploying Black Kingdom ransomware via ProxyLogon exploits (CVE-2021-26855) against 1,500+ systems, including U.S....
Sophisticated npm malware campaign exploits Cross-Ecosystem typosquatting
A coordinated malware operation targeting npm employs cross-ecosystem typosquatting to mimic popular libraries from Python, Java, C++, and .NET ecosystems. Attackers uploaded packages like beautifulsoup4 (masquerading as Python’s...
Dismantling “764”: inside the takedown of a sophisticated child exploitation network
In a significant development for cybersecurity and child protection efforts, law enforcement agencies have successfully apprehended two key figures allegedly behind “764,” a highly organized online child exploitation...
Hijacking Trust: how Gmail and Google APIs are being weaponized for stealthy C2 channels
In the ever-evolving landscape of cybersecurity, attackers are increasingly exploiting trusted services to establish covert command-and-control (C2) channels. By leveraging platforms like Gmail and Google Drive, threat actors...
Kintetsu World Express ransomware attack: technical overview and response
Kintetsu World Express (KWE), a major Japanese global logistics provider, has confirmed a significant ransomware attack that began impacting its operations in late April 2025. The incident has...
JFL Hospital targeted in ransomware attack amid wave of cyber incidents in US Virgin Islands
Governor Juan F. Luis Hospital & Medical Center (JFL) in the US Virgin Islands has become the latest government entity to suffer a cybersecurity breach, confirming a ransomware...
SuperCard X: exposing a MaaS for NFC Relay fraud operation
The Cleafy Threat Intelligence team has uncovered SuperCard X, a sophisticated Android malware campaign leveraging NFC-relay attacks to authorize fraudulent POS and ATM transactions. This Malware-as-a-Service (MaaS) operation1...
MITRE Signals Critical Risk to CVE Program as Federal Funding Expires
The cybersecurity world faces a significant challenge as the Common Vulnerabilities and Exposures (CVE) program, a cornerstone of global vulnerability management, risks disruption due to expiring federal funding....