In addition to espionage threat actors, financially motivated cybercriminals have been exploiting the WinRAR vulnerability CVE-2025-8088. The highly effective ecrime actor, typically seen distributing Koi Stealer/Koi Loader (TA4561), was observed doing so in Fall 2025. Details. ⤵️

Alongside this activity recently highlighted by Google (cloud.google.com/blog/topics/...), Proofpoint threat researchers have observed additional exploitation of WinRAR vulnerability CVE-2025-8088 by state‑aligned groups linked to China and the DPRK.

As the security landscape evolves and expands, Proofpoint observed many threat actors disappear from email threat data in 2025. But TA584 maintained operational consistency, w/ recent shifts demonstrating its attempt to infect a broader range of targets. www.proofpoint.com/us/blog/thre...

Cloud threat researchers at Proofpoint have identified a peak in an ongoing brute force campaign targeting ‘Azure Active Directory Powershell.’ Behind the campaign—which has impacted over 100,000 users in over 3,000 tenants—is a cluster tracked as #UNK_BareZilla.

Use of the social engineering tactic, device code phishing, increased significantly in December 2025. Proofpoint observed this technique used at scale across both financially motivated and state-aligned threat clusters.

Looking for expert insights on the latest cyberattacks, emerging trends, and actionable defense strategies? Join @selenalarson.bsky.social & Sarah Sabotka for our new monthly videocast, Intercepted. The first #livestream will happen on Jan 21 at 10 AM ET. Info: www.proofpoint.com/us/resources...

Proofpoint Discarded is a wrap for 2025! 🎬 Our last episode of the year offers grounded, experience-driven perspectives on what really mattered in 2025. Stream now for an end-of-year look at how the cyber threat landscape evolved—and what defenders need to know as we enter 2026. 🎧: brnw.ch/21wYKI6

New research from Proofpoint ‼️ Threat actors are using #phishing tactics to trick users into giving access to #M365 accounts. ⚠️ Successful compromise leads to #accounttakeover, #dataexfiltration, and more. Blog: brnw.ch/21wYtcM Here’s what you need to know. 🧵⤵️

Iran's cyber operations are now a formidable challenge for organizations. Our observations of #UNK_SmudgedSerpent, a newly identified cluster linked to Iran, exemplify the evolving complexity and resourcefulness of the country's modern threat ops. Saher Naumaan shared her insights. brnw.ch/21wYrCZ

WHAT 👏 A 👏 YEAR! Our Discarded podcast increased its listenership by 188% in 2025, and that's all because of 𝘺𝘰𝘶. 🎙️ Here, @selenalarson.bsky.social shares her gratitude and a look at what’s to come in the new year. Stay tuned for more threat insight and behind-the-scenes analysis in 2026! 🎊

New Discarded podcast ‼️ Join our ho-ho-hosts for a fun, insightful and very festive episode that highlights the seasonal threats that might be landing under your digital tree this year. ⛄ Stream now to explore how cybercriminals use seasonal themes to trick consumers & enterprises. brnw.ch/21wYf9o

This time of year, threat actors are attempting to send you gifts you’d rather not receive. 🎁 Proofpoint is seeing an increase in holiday-themed threats. Main #phishing lure themes include party invitations, holiday vouchers, end-of-year bonuses, and holiday travel.

Proofpoint's Emerging Threats "rule magician," Tony Robinson, is featured on this latest Discarded #podcast episode. 🪄 Listen as he shares the story behind his open-source tool, IoT Hunter, and explains how, through automation, it helps defenders cover hundreds of CVEs. brnw.ch/21wXDRr

Proofpoint is proud to have assisted law enforcement in the #OperationEndgame investigation that led to the November 13, 2025 disruption of #Rhadamanthys and #VenomRAT, both malicious infrastructure used by multiple cybercriminals. Rhadamanthys: brnw.ch/21wXsCc VenomRAT: brnw.ch/21wXsCd

Proofpoint researchers say with high confidence that cybercriminals are working with organized crime groups to commit physical cargo theft. 🚚 @bloomberg.com spoke with our #ecrime experts who warned, "It is a full-scale supply chain threat." Read the article: www.bloomberg.com/news/article....

New research from @ThreatInsight 🚨 Deviations in typical activities by known Iranian-linked threat actors has resulted in Proofpoint threat researchers naming a new temporary threat actor cluster, UNK_SmudgedSerpent. Blog: www.proofpoint.com/us/blog/thre...

From Old West train robbers 🚂 to 1960s mobsters 💰, #cargotheft is an age-old problem. Today, cargo theft is commonly conducted digitally by hacking the #supplychain to exploit gaps and steal #freight remotely. 🧵⤵️

Proofpoint threat researchers have designed an open-source tool—named PDF Object Hashing—to track and detect the unique characteristics of PDFs used by threat actors... similar to a digital fingerprint. 🫆 We use this tool internally to help track multiple threat actors with high confidence.

With the goal of better understanding cloud account takeover (#ATO) attacks, we developed a tool that automates the creation of malicious internal apps within a #compromised #cloud environment. Here, we detail our findings and security implications. ⤵️ brnw.ch/21wWOgL

Since 14 October, we’ve tracked a high volume XWorm campaign targeting Germany. The activity is attributed to TA584, a sophisticated #cybercrime group tracked since 2020. Messages are sent from hundreds of compromised sender accounts impersonating ELSTER and contain malicious URLs.

TA585 is the identifier of the most recent threat actor named by Proofpoint. The sophisticated cybercriminal, notably, appears to own its entire attack chain with multiple delivery techniques. Learn about TA585 and one of its favored payloads, MonsterV2: brnw.ch/21wWAAU.

Researchers at Proofpoint have uncovered a recent brute force campaign, tracked as UNK_CustomCloak, targeting the first-party app, Windows Live Custom Domains. Activity was observed from September 20-30th, affecting nearly half a million users in over 4,000 tenants.

Proofpoint threat researchers have published new research identifying a new cyber-espionage campaign by #TA415 (#APT41), a China-aligned threat actor, exploiting growing uncertainty in U.S.-China economic relations. Blog: www.proofpoint.com/us/blog/thre....

Threat actors continue to abuse GitHub to deliver malware, this time: #LummaStealer. We identified GitHub notification emails that kick off the attack chain. Messages are sent when the threat actor, using an actor-controlled account, comments on existing GitHub issues. 🧵

Threat actors are exploiting #Microsoft365 Direct Send to make their phishing campaigns appear to originate from inside an organization. On this episode of DISCARDED, you'll hear why legacy features like Direct Send are a prime target for cybercriminals. Stream now on our website: brnw.ch/21wVja5

Something #spicy is coming to the next Only Malware in the Building podcast—dropping September 2. 🌶️ Bookmark the show page and reserve your seat at the table 🪑 alongside Selena Larson, Dave Bittner and Keith Mularski. 🔥 You won't want to miss it! thecyberwire.com/podcasts/onl... #podcast #hotones

You asked, we answered. AI tools are significantly lowering the barrier to entry for cybercriminals. We have observed threat actor campaigns leveraging the AI-generated website builder Lovable to create and host cred phishing, malware, and fraud websites. Learn more in our blog: brnw.ch/21wV3Zo

Proofpoint identified a unique attack chain leveraging GitHub notifications to deliver #Rhadamanthys. We first spotted this post by ANY.RUN about ClickFix delivering Rhadamanthys and began investigating. infosec.exchange/@anyrun_app/...

Threat researchers from Proofpoint have found a way to sidestep FIDO-based #authentication, a discovery that could expose targets to credential phishing attacks, account takeover (#ATO), and adversary-in-the-middle (AiTM) threats. #FIDO #MFA All the details in our blog: brnw.ch/21wURuW.

In a new technical blog, Proofpoint threat researchers detailed their observations of threat actors impersonating well-known enterprises with fake #Microsoft #OAuth applications that redirect to malicious URLs, enabling credential phishing. brnw.ch/21wUA69

Each threat actor has its own tactics, techniques, and procedures (TTPs). On this DISCARDED episode, we discuss the chaotic brilliance of mid-tier eCrime actors, why shared commodity tooling can make attribution difficult, why TA582 is so interesting, and much more. Stream here 👉 brnw.ch/21wUw3L

🚨 Job seekers, watch out! 🚨 Proofpoint found threat actors targeting job seekers to distribute remote management tools that can lead to data or financial theft, or potentially to install follow-on malware like ransomware.

Threat researchers at Proofpoint released new details on a widespread Request for Quote (RFQ) scam that involves leveraging common Net financing options to steal a variety of high-value electronics and goods. Blog: brnw.ch/21wUkQ8 #shipment #RFQ #finance #scam

NEW ‼️ Researchers at @Proofpoint revealed an increase in China-aligned cyber #espionage targeting Taiwan’s #semiconductor industry—a sector critical to the global tech #supplychain. At least 3️⃣ distinct China-aligned threat actors are behind the efforts. brnw.ch/21wUctY

Confirm before you click! 🖱️ Learn about an interesting phishing campaign involving the “unsubscribe” link often included in marketing emails. 🔍 ⤵️

#Espionage 🤝 #Cybercrime TA829 🤝 UNK_GreenSec Proofpoint researchers published new insights on an intriguing overlap between 2 threat actor clusters—TA829 and UNK_GreenSec—in a campaign that blurs the lines between espionage and cybercriminal activity. brnw.ch/21wTN5x

In a new blog, Proofpoint threat research engineers disclosed their detailed discovery of Amatera Stealer, a newly rebranded and upgraded malware-as-a-service (MaaS) version of the ACR Stealer. Read the blog: brnw.ch/21wTvpI. #securityengineering #detectionengineering #securitycontrols

New ecrime insights: TA4557, known for distributing More_eggs malware, notably expanded to an international audience in recent campaigns. Per our data, the recruiter-focused TA was seen targeting orgs in France, England & Ireland, in addition to typical North America-targeted threats.

Researchers at Proofpoint expose threat actors’ attempt to hijack thousands of EntraID user accounts across almost 100 cloud tenants by leveraging TeamFiltration, a red teaming framework used by network defenders. brnw.ch/21wTk3G

We recently discovered an infostealer in our data that we originally dubbed "Aurotun," named for a misspelling of "autorun" in its strings. After collab w/ @intel471.bsky.social, @malwareindepth.com & others, we believe this malware is actually MonsterV2, a newer version of an existing infostealer.

Just published: A two-part blog series in collaboration with @threatray.bsky.social, which aims to substantiate the claim that #TA397 (Bitter) is an espionage-focused, state-backed threat actor with interests aligned to the Indian state. Part 1: brnw.ch/21wT9A5 Part 2: brnw.ch/21wT9Ad.

Today, Proofpoint joins the cybersecurity community and the U.S. and international law enforcement in celebrating the disruption of #DanaBot, a malware-as-a-service used by sophisticated cybercriminals since 2018. brnw.ch/21wSRiZ

State-sponsored threat actors often leverage techniques first developed and deployed by cybercriminal actors. One example is #ClickFix, a highly effective #socialengineering technique. Listen as our experts share how modern #espionage and #cybercrime are increasingly blurring lines. brnw.ch/21wSNbN

A new blog by Proofpoint researchers reveals Feb 2025 activity by TA406, a North Korean-aligned advanced persistent threat. #TA406 targeted government entities in Ukraine with phishing campaigns to deliver malware and harvest credentials. Read the details: brnw.ch/21wSCmF. #Konni

🚨 New threat research from @proofpoint.com 🚨 We have observed a notable increase in high-volume Japanese language campaigns targeting organizations in #Japan to deliver a phishing kit that Proofpoint researchers refer to as #CoGUI. Blog: brnw.ch/21wSrLN

Happening now at the #RSAC Moscone briefing stage: Daniel Blackford, Director of Threat Research for Proofpoint, is presenting his expert insights on the behaviors and activity of today’s financially motivated and nation-state attackers.

State sponsored threat actors in North Korea, Iran and Russia have been experimenting with a highly successful #socialengineering technique called #ClickFix. See our latest threat research blog for full details: brnw.ch/21wS4gL.

With +2M customers around the world, Proofpoint has unmatched visibility into the cyberthreat landscape. We monitor and track threat actors and their tactics, techniques and procedures, and surface these insights to customers and the community for awareness. Here’s an example ⤵️

Here's interesting cyber criminal activity to sink your teeth 🦷 into: Proofpoint researchers identified a campaign targeting dentists to deliver Braodo, a Python-based info stealer. Messages claimed to be asking for help from a dentist (the sender wants porcelain teeth) and included a Dropbox URL.

Proofpoint also recently observed this activity delivering GootLoader. Google Ads for a fake document creation app (lawliner[.]com) led to a malicious document creation website, on which users are directed to enter their email address.