Topic
Linking campaign identities via shared code, infrastructure, publishing artifacts and signing patterns without establishing a single operator.
Microsoft Defender Experts says fake Kaspersky, Razer and Calibre download sites all funnel to one delivery host that rebuilds the installer per request, which leaves hash blocking almost nothing durable to match.
Reality
GreyNoise reports the WordPress intrusion and the Zyxel switch harvest as separate operations run from shared scanning infrastructure by a suspected Chinese-speaking actor it tracks as Kapibala.
Reality
The device code phishing cluster Microsoft disclosed in February 2025 is now assessed as an initial access arm of Midnight Blizzard. The sign-in flow the campaign abused works as designed, so the remedy is configuration.
Reality
The joint research argues that constant reorganization under the GRIB and NIA is a control mechanism rather than administrative noise, and that treating Lazarus as one actor hides the revenue mandate driving most of the intrusions.
Reality
CrowdStrike says the crew queried instance metadata for temporary credentials, enumerated every secret in the cloud credential manager, then used Foundry's cast to derive the Ethereum address behind a stolen private key.
Reality
Google places the spree with a single operator in South Africa, which makes one arrest plausible, while Palo Alto Networks counts three core members. Either way, the packages moved because almost nobody checks what they ingest.
Reality
The Ray, Docker and Redis endpoints hijacked in ShadowRay 2.0 were worked by operators Oligo now ties to TA-NATALSTATUS activity from 2020, which makes the AI-cluster worm a tooling upgrade on an old farm.
Reality
The August 26 advisory, written with the NSA and Cyber National Mission Force, describes QTFY running its own scanning, proxying and botnet platforms since 2018. Commodity indicator feeds will not find it.
Reality
Tenable and SentinelOne agree 79% on which edge vendors are being exploited, and barely at all on which CVEs. That asymmetry is the finding, and it reorders the patch queue.
Reality
Socket says 40 of the 77 extensions it tracked are confirmed credential and wallet stealers, and nine of them were repurposed from sports-score shells under the same add-on IDs.
Reality