Stryker ‘Handala’ incident: global Microsoft environment disruption and reported remote device wipes
Disruptive Iran-nexus hacktivist operation claims large-scale data destruction as Stryker restores services and CISA investigates.
Tags /
#Incident Response
173 reports
Hudson Rock ties Polyfill.io supply-chain compromise to DPRK operator via Lumma Stealer telemetry
Infostealer logs from 2024 allegedly expose Funnull backend access and a separate Gate.us compliance infiltration.
Storm-2561 pushes fake VPN installers via SEO poisoning to steal enterprise credentials
A credential theft operation uses lookalike VPN download sites and GitHub-hosted ZIPs to drop signed malware that harvests VPN logins and configuration data.
BadPaw and MeowMeow: steganographic .NET malware hits Ukrainian targets
A ClearSky report details a new loader and backdoor pair, and Scythe shows how to operationalise it as continuous adversary emulation.
UAT-9244 hits South American telcos with TernDoor, PeerTime and BruteEntry
Cisco Talos links the activity cluster to China-nexus tooling, including CrowDoor variants and ORB-style proxy infrastructure
BadAudio and APT24: “good enough” OPSEC powering a multi-vector espionage chain
Reverse engineering shows pragmatic obfuscation, hardcoded crypto, and cloud-native infrastructure supporting scalable intrusion delivery.
Iran crisis cyber risk rises as defacements and disruptive activity reported
Iran • hacktivists • IRGC • MOIS • DDoS • wipers • ransomware • critical infrastructure
OpenClaw “ClawJacked” chain: malicious websites can hijack local AI agents via localhost WebSockets
Cross-origin browser-to-localhost access, missing loopback throttling, and implicit device trust combine into a silent takeover path from a single web visit.
DPRK FAMOUS CHOLLIMA OPSEC failure exposes npm publisher IPs through public disposable inboxes
Affected ecosystem: npm registry and developer tooling supply chain Primary issue: OPSEC leakage from disposable email inbox exposure combined with npm publish notification metadata Exploitation…
Akamai SIRT Identifies Zerobot Botnet Exploiting n8n and Tenda Vulnerabilities
Akamai SIRT identifies Mirai variant campaign actively targeting critical RCE flaws in automation platforms and routers
AirSnitch: Client isolation in Wi-Fi is not delivering the security most defenders expect
NDSS 2026 research shows practical injection and machine-in-the-middle paths across WPA2/WPA3, guest SSIDs, and enterprise multi-AP deployments
Vshell (VShell): a Mandarin-language C2 framework surfacing alongside Cobalt Strike on exposed infrastructure
Censys has reported on Vshell (often stylised “VShell”) , a Go-based command-and-control (C2) platform used for post-compromise host management, pivoting, and proxying , and increasingly visible…