Threats on Zero Day Room: Ransomware groups and campaigns, Business email compromise, Supply chain attacks, Phishing and credential theft, Info stealers and Cloud account compromise.
Anibal Alexander Canelon Aguirre, the first cybercriminal on the FBI's Top 10 Most Wanted list, is in U.S. custody to face charges for masterminding the Ploutus ATM malware scheme that funded the Tren de Aragua terrorist group.
MI5 has issued a public Espionage Alert naming the China General Technology Research Institute as a front for China's Ministry of State Security.
A China-aligned espionage group, tracked as TA419, has been running credential phishing campaigns since July 2026.
An international police operation dismantled the KillSec ransomware group, seizing servers and arresting key suspects including a 16-year-old.
An Iranian-Turkish dual national was extradited from Montenegro to face U.S. Charges for leading a global cyber espionage campaign that stole 31 terabytes of academic data, causing billions in damages.
A 16-year-old Romanian national was arrested in Alicante, Spain, as the suspected administrator of the KillSec ransomware group, part of a multinational operation.
Two former US Air Force members stationed at Dover Air Force Base have been sentenced to a combined 189 months in prison for a business email compromise scheme.
Microsoft has publicly detailed the NeedyMantis malware framework, discovered during analysis of the May 2026 Daemon Tools supply chain attack.
Bitget confirmed a $387.5 million crypto theft by suspected North Korean hackers, exploiting a backend wallet system.
Cloudflare fixed a cross-tenant data leakage flaw in its Containers service.
Cofense has expanded its AI-driven Phishing Defense Platform with a new Competency Dashboard in its Command Center.
Kaspersky researchers detail a 2026 attack where threat actors used a malicious Group Policy Object named PAYLOAD to disrupt a manufacturing firm.
Researchers used an AI model to build an exploit for an unpatched library flaw, chaining it with an OpenAI sign-in token vulnerability to access internal systems.
A Black Kite study reveals manufacturing accounted for 22% of all ransomware victims from April 2025 to March 2026.
A threat actor posing as a bug bounty hunter used an LLM to create the PhantomRaven info-stealer.
Microsoft details two campaigns: one blasting CEO-impersonation invoice scams and another using passkey-themed social engineering to hijack Microsoft cloud accounts.
A phishing campaign exploiting Microsoft 365's Direct Send feature sent nearly 30,000 emails, primarily during US Eastern business hours, to bypass email security gateways.
Threat actors are exploiting Google Play's Early Access program to distribute thousands of deceptive apps.
GitGuardian's Honeytoken service uses decoy credentials deployed via MDM to detect credential harvesting in real time.
Four espionage groups, including APT31, used the new BlueMoon exploit kit in late August and early September 2026.
Researchers from Calif built a zero-click worm, WeWorm, exploiting a memory corruption flaw in WeChat's VoIP stack.
Google's Threat Intelligence Group reports that both criminal and state-backed hackers are using AI to automate attacks.
Google's threat intelligence group reports threat actors are using AI agents to automate cyberattack tasks.
North Korea's Lazarus cyber umbrella operates as six distinct clusters focused on espionage, financial theft, and sanctions evasion.
A new post-exploitation toolkit called PEEP injects a malicious extension into Chrome and Edge browsers.
Berlin investigates a new data leak after hackers published stolen login credentials.
Attackers stole an API key from AI safety research group METR and used it for three weeks, consuming model credits valued at approximately $600,000.
A North Korean toolkit named 'Ted' has been found compiled into trojanized HAProxy load balancers at two South Korean firms.
Microsoft has alerted of a phishing campaign using invisible Unicode tag characters to split financial keywords and evade email filters.
The Outsider phishing-as-a-service kit operated by ChenLun has generated over 700 new pages since a June law enforcement takedown.
Group-IB researchers detail the BraZetsu malware framework, used by the Exilware group to compromise Windows hosts and sell access on an underground marketplace.
A pro-Ukraine ransomware group named VantaCore is using custom malware to extort millions from Russian organizations.