Malicious Screen Connect deployments observed
Categories: Threat Research Tags: advisory, connectwise, ScreenConnect
Sophos Threat Research 15
Covers: Vulnerabilities & PatchingDetection & ResponseIdentity & Access ManagementZero-Days & Exploits
ARTEX: Attackers apply agentic AI
An agentic AI pentesting framework is being used in the wild by threat actors Categories: Threat Research Tags: Agentic AI, Attack Tools, AI
N-able issues advisory on critical vulnerabilities
Categories: Threat Research Tags: advisory, N-able
Malicious Claude Code extension distributed through Cursor marketplace
Categories: Threat Research Tags: advisory, Cursor
AI used in Aur0ra ransomware testing and execution
The GOLD OGRE threat group has used AI extensively to develop tools and to orchestrate and execute ransomware operations Categories: Threat Research Tags: AI, ransomware, Aur0ra
Node2Shell (CVE-2026-111497) in active exploitation
Categories: Threat Research Tags: advisory, vulnerability, Node2Shell, Brotli
Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Categories: Threat Research Tags: advisory, vulnerability, php
BRONZE SANDCASTLE deploys modified Meterpreter shells
The China-based threat group uses DLL sideloading in these attacks Categories: Threat Research Tags: BRONZE SANDCASTLE, Meterpreter, Sandboxie
Graph reconnaissance and Service Now user enumeration in a modern identity intrusion
No novelty required to be effective Categories: Threat Research, X-ops, Sophos SecOps Tags: incident response
Connect Wise Cloud Backup application abused in cross-tenant token sweep
Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants Categories: Threat Research Tags: connectwise
building intent-based access control without reading minds
This article was first published on LinkedIn . Categories: AI Research, Threat Research Tags: AI, AI RESEARCH, Threat Research
Citrix Net Scaler vulnerability (CVE-2026-88779) in active exploitation
Categories: Threat Research Tags: advisory, vulnerability, Citrix
Terminal Fix and Lorem Ipsum Loader enable covert tunneling
The activity is linked to a broader campaign that previously used a different delivery mechanism Categories: Threat Research Tags: TerminalFix, clickfix, Lorem Ipsum Loader
Citrix Net Scaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation
Categories: Threat Research Tags: advisory, vulnerability, Citrix
Kiteworks recommends server shutdown pending possible attack
Categories: Threat Research Tags: advisory, Kiteworks