CyberXero Uses AI Agent Swarms to Scale WordPress Intrusions and Target Ukrainian Energy
A Russian-speaking initial-access broker known as CyberXero used dozens of AI agents alongside PentAGI and Cobalt Strike to automate web attacks and conduct targeted reconnaissance. Exposed operator files...
Fired IT Admin Gets 32 Months for Bitcoin Extortion Plot That Nearly Crippled a New Jersey Company’s Network
Daniel Rhyne, a former core infrastructure engineer, has been sentenced to 32 months in federal prison for planting a hidden virtual machine, deleting domain administrator accounts, and demanding...
Undercover Blockchain Probe Maps Lazarus-Linked Laundering After $1.5B Bybit Theft
Blockchain investigator ZachXBT says an undercover operation exposed a Chinese laundering network handling funds linked to North Korea's $1.5 billion Bybit theft. Private chats were correlated with public...
Attackers Abuse SQL Server as a Covert Command and Exfiltration Channel
Investigators found attackers using Microsoft SQL Server functionality to execute Windows commands and return stolen files through query output. An exposed staging server also leaked the intruders' toolkit...
Inside the Supply Chain Playbook Turning Trusted Software Updates Into Credential Thieves
A new ReversingLabs report ties together the S1ngularity, Shai-Hulud, and TeamPCP/Trivy supply chain incidents, showing how stolen maintainer tokens and compromised CI pipelines let attackers push credential-stealing code...
Suspected ShinyHunters Member Detained as FBI Data-Theft Inquiry Expands
A suspected ShinyHunters member has reportedly been detained in Jordan and is cooperating with investigators seeking other people linked to the group. The development follows unverified claims of...
PaperPhone Bot Network Masks Automated Scraping Behind 75,000 IP Addresses
Researchers identified a coordinated headless-browser network using 75,000 IP addresses and fabricated mobile identities to disguise large-scale scraping. Contradictory browser fingerprints and synchronized traffic exposed the supposedly diverse...
ShinyHunters Evades WAF Rules to Reopen Critical PeopleSoft Attack Path
ShinyHunters has resumed mass exploitation of a critical Oracle PeopleSoft flaw by encoding part of the attack path to slip past some WAF rules. Compromised servers received web...