🕵️ Unidentified threat actor

The items that name it 5

• Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated Oct 20)
  advisory2026-10-20It is written here as Unidentified threat actor: first observed exploiting CVE-2026-0257 to access GlobalProtect; no post-access behavior or lateral movement identified at the time of the original brief.
• VEEAM UNDER FIRE: Understanding CVE-2026–44963 & Ransomware Group Exploit Claims
  writeup2026-08-20It is written here as Unidentified threat actor (Exploit forum seller).

  Advertised around late June 2026 on the Exploit forum an alleged unauthenticated SYSTEM-level RCE for Veeam Backup & Replication 12.x claimed to bypass the June 2026 patch for CVE-2026-44963, affecting all 12.x builds including patched 12.3.2.4854, with PoC, source code, documentation, and scanner o

• AI Security Briefing
  writeup2026-07-18It is written here as Unidentified threat actor (IPI Payment Scam / Open-Agent-Utilities campaign).

  Operates fraudulent website impersonating API documentation for a fake Python library 'requests-secure-v2', using SEO poisoning and indirect prompt injection (IPI) to trick AI agents into sending cryptocurrency payments for a fake API license key. Linked to GitHub repository 'Open-Agent-Utilities' a

• The OpenSourceMalware Show #9
  talk2026-06-18It is written here as Unidentified threat actor (Mastra npm org compromise).

  Hijacked the entire Mastra npm organization (116 packages) after a maintainer was compromised via a ClickFix-style social engineering/spear phishing attack (compromised LinkedIn account reached out, victim clicked a suspicious link on a call). Attribution unconfirmed; hosts express skepticism of any

• Threats Plague Educational Organizations
  writeup2025-11-13It is written here as Unidentified threat actor (RDP brute force against school district).

  RDP brute force against school district