Trending Topics
Fake VPN installers spread via SEO poisoning. ClickFix abuses WorkFlowy app via WebDAV. Iran war lures used by Charming Kitten and others. Top CVEs of the week.
Charming Kitten
Charming Kitten is an Iranian espionage group linked to the IRGC Intelligence Organization (IRGC-IO). Also tracked as APT35, APT42, TA453, Mint Sandstorm, CharmingCypress, and Educated Manticore depending on the reporting vendor.
Surge In Cyber Threats - Middle East Activities
Iran's IRGC- and MOIS-aligned APTs, including APT34 (OilRig) and MuddyWater, run synchronized espionage, DDoS, and ICS/OT intrusions alongside hacktivist proxies during the Israel-Iran conflict, with confirmed access claims against Gulf energy and water utilities.
Trending Topics
LummaStealer resurges via CastleLoader and ClickFix lures. State and criminal groups use AI to speed up attacks. Attackers abuse Net Monitor and SimpleHelp RMM tools for ransomware access. Scattered Spider (Muddled Libra, UNC3944) creates a rogue VM to exfiltrate Snowflake data.
Trending Topics
FortiWeb zero-day CVE-2025-64446 lets attackers create admin accounts. Charming Kitten (APT42, Mint Sandstorm) runs SpearSpecter against senior officials via WhatsApp rapport-building. Dragon Breath (APT-Q-27) deploys RONINGLOADER to disable AV tools.
Trending Topics
SmudgedSerpent targets U.S. Iran policy experts, tied to Charming Kitten and MuddyWater. Scattered Spider (UNC3944), LAPSUS$, and ShinyHunters (UNC6040) merge into a cybercrime alliance. NGate enables NFC-relay ATM theft. APT-C-60 refines VHDX phishing.
Trending Topics
Fake AI browser extensions steal Chrome data. XiebroC2 exploits weak MS-SQL credentials. Charming Kitten (APT35, Mint Sandstorm) spoofs video conferencing platforms for phishing.
Trending Topics
Typosquatted PyPI package "psslib" forces Windows shutdowns. Havoc framework abuses Windows Task Scheduler for persistence. Charming Kitten (Educated Manticore, Mint Sandstorm) targets Israeli researchers via fake login portals.