🧵 ICYMI: We just dropped our 2025 Malicious Infrastructure Review! Some of the highlights below👇 #Infosec #CyberThreats 1/6 www.recordedfuture.com/research/202...

-Iran internet outage not caused by strikes -Russia expands internet blackout to Sankt Petersburg -Oracle out-of-band security update -Himmelblau vulnerability gives root -Claudy Day vulnerabilities -Leak in German uni campuses platform -Langflow attacks started within a day

Noticed Microsoft Defender tagging #TheVoidStealer as #WallStealer thanks to some recent abuse_ch uploads. Here’s the threat actor nikoniko (aka “TheVoidStl”) discussing the removal of multiple detections, including WallStealer.

1/ Today, Insikt Group is publishing on GrayCharlie, a threat actor active since mid-2023 that overlaps with SmartApeSG. GrayCharlie compromises WordPress sites and turns them into malware delivery hubs: www.recordedfuture.com/research/gra...

Today the NCSC has issued a warning highlighting Pro-Russian Hacktivist groups are targeting sectors across the UK. All organisations are urged to act now by reviewing and implementing our free guidance to protect against DoS attacks.

Predator spyware demonstrates troubleshooting, research-dodging capabilities cyberscoop.com/predator-spy...

NoName057(16) and DDoSia Project Analysis: Russia’s Most Persistent Hacktivist Operation socradar.io/blog/noname0... New SOCRadar Whitepaper Reveals the Inner Workings of DDoSia and Pro-Russian Cyber Aggression

Recorded Future’s Insikt Group identified multiple credential-harvesting campaigns conducted by BlueDelta, a Russian state-sponsored threat group associated with the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). www.recordedfuture.com/research/gru...

Today, we released new @RecordedFuture research detailing BlueDelta’s expanded credential-harvesting activity observed between February and September 2025. #BlueDelta #APT28 #FANCYBEAR #ForestBlizzard #FROZENLAKE #ITG05 #PawnStorm #Sednit #Sofacy #TA422 (1/5) www.recordedfuture.com/research/gru...

Recorded Future’s Insikt Group identified a sustained credential-harvesting campaign targeting users of UKR.NET. The activity is attributed to the Russian state-sponsored threat group | www.recordedfuture.com/research/blu...

In their latest for Binding Hook, @nca-uk.bsky.social’s William Lyne and @rusi.bsky.social's @jamiemaccoll.bsky.social look at the challenges facing UK law enforcement as cybercriminals become more diverse at home and abroad: bindinghook.com/local-hacker...

Justice Department Announces Actions to Combat Two Russian State-Sponsored Cyber Criminal Hacking Groups (U.S. Department of Justice): www.justice.gov/opa/pr/justi...

1/ @whoisnt.bsky.social, Marius, and I just published a report on #GrayBravo (formerly TAG-150), a highly adaptive, sophisticated threat actor that we first identified in Sept 2025. It uses a multi-layered infrastructure and responds quickly to exposure: www.recordedfuture.com/research/gra...

Recorded Future’s Insikt Group uncovered four GrayBravo activity clusters. TAG-160 impersonates logistics firms, while TAG-161 impersonates Booking.com, employing ClickFix to deliver CastleLoader and Matanbuchus. www.recordedfuture.com/research/gra...

"There is a lack of consensus regarding the current state of AI malware maturity." So we put together #AIM3 to help #malware researchers describe the maturity level of an #AI_Malware Threat. www.recordedfuture.com/blog/ai-malw...

⚠️ New victims of Predator #spyware identified, with malicious TikTok links revealing new targets, and evidence showing 🇪🇬Egypt & 🇸🇦Saudi clients still active. ➡️ Ad-based infections confirmed. ➡️ Leaked files & investigation expose post-sanctions Intellexa operations. www.haaretz.com/israel-news/...

And check out the companion blog post by @amnestyuk.bsky.social tech with a detailed peek into Intellexa's setup based on leaked materials 👀 Giveaway: Intellexa can observe all of what their gov clients are doing with their hacking tech and more securitylab.amnesty.org/latest/2025/...

1/ Today we release a new report exposing previously undisclosed entities connected to the wider #Intellexa ecosystem as well as newly identified activity clusters in Iraq and indications of activity in Pakistan: www.recordedfuture.com/research/int...

Cyber Monday Deal 
Get 6 months of Modat Magnify Pro for just €5 total (save €355).  Use code: MODAT2025CYBERMONDAY   
Try the platform. Run advanced queries. Find what others miss. 
 magnify.modat.io 
#CyberMonday #Cybersecurity #OSINT

1/ United States, Australia, and United Kingdom sanction Russian threat activity enabler Media Land (Yalishanda) and follow up on recent designations targeting Aeza. ofac.treasury.gov/recent-actio...

Great read from @lawrencesec.bsky.social & @whoisnt.bsky.social !

Recorded Future just published Dark Covenant 3.0, revealing how global crackdowns and shifting Russian enforcement are reshaping the cybercriminal underground, exposing ties to state actors and turning cybercrime into a geopolitical tool: www.recordedfuture.com/research/dar...

Great work by my colleague, @lawrencesec.bsky.social ! He dives deep into the systemic flaw where "neutral" internet governance lets sanctioned ISPs evade restrictions and continue supporting #cyberattacks and #disinformation. A must-read on the infrastructure gap. 👇

Recorded Future just published a report diving into the Beijing Institute of Electronics Technology and Application (BIETA), which is almost certainly a front for China’s MSS, developing technologies to support intelligence and military missions. Full report: www.recordedfuture.com/research/bie...

👋 Don't miss the first Colloquium session tomorrow! 📌 Mythical Beasts and Where to Find Them: Diving into the Depths of the Global Spyware Market 💡 Jen Roberts (@cyberstatecraft.bsky.social) & @julianferdinand.bsky.social (Recorded Future) 🗓️ October 2, 2025 🕓 16:00 – 17:00 CET

Recorded Future's Insikt Group reports CopyCop, also tracked as Storm 1516, expanding in 2025, adding at least 200 new fictional media websites targeting the United States, France and Canada and using self-hosted LLMs. www.recordedfuture.com/research/cop...

I'm excited to speak at #VB2025 later this week! I'll be diving into TAG-124, a group whose services are leveraged by a wide range of actors, from cybercriminals to state-sponsored groups. Hit me up if you are in town! www.virusbulletin.com/conference/v...

The UK has sanctioned Aeza International, citing its involvement in destabilising Ukraine by providing internet services to Russian disinformation campaigns. This follows OFAC sanctions in July. www.gov.uk/government/n...

Really excited to present at #LABScon25 on ChamelGang‘s most recent campaign targeting the Taliban, a collaborative research project with @milenkowski.bsky.social (SentinelLABS) and @azaka.fun (TeamT5)! www.labscon.io/speakers/jul...

Great blog post from @briankrebs.infosec.exchange.ap.brid.gy on #StarkIndustries. Makes a great point by highlighting it's links to MIRHosting. Where there are Dutch prefixes under these providers, there is usually always MIRHosting upstream.

Insikt Group identifies a new threat actor, TAG-150, active since at least March 2025. Its multi-layered infrastructure is used to deploy likely self-developed malware families, including CastleLoader, CastleBot, and the newly documented CastleRAT. www.recordedfuture.com/research/fro...

Recorded Future has spotted two influence operations around the recent India-Pakistan military conflict from May. The networks are tracked as networks as Hidden Charkha (pro-India) and Khyber Defender (pro-Pakistan). www.recordedfuture.com/research/inf...

A significant amount of #CastleLoader C2 infrastructure identified by @julianferdinand.bsky.social was tied to #ThreatActivityEnabler 🇬🇧 FEMO IT SOLUTIONS #AS214351 utilising 🇩🇪 aurologic GmbH #AS30823 as their sole upstream provider. One to watch out for!

Another great report from the team on TAG-150, a sophisticated and rapidly evolving threat actor. 🕵️ Our report documents #CastleRAT for the first time, a new Remote Access Trojan, alongside the previously observed #CastleLoader.

Recorded Future: Stark Industries, along with its CEO and owner, was formally sanctioned by the Council of the European Union on May 20, 2025, for enabling Russian state-sponsored cyber operations | www.recordedfuture.com/research/one...

This report on Stark Industries is a fantastic case study in the cat-and-mouse game between hosting providers and law enforcement. The new "Threat Activity Enabler" (TAE) terminology is spot-on and highlights the critical role these providers play in the cybercrime ecosystem.

Highly recommend this report on TAG-144. It breaks down the group's operations into five distinct clusters and reveals some serious tradecraft! From using compromised government emails to hiding payloads in JPGs. A deep dive into a very sophisticated threat.

1/ Today, we release a first-of-its-kind analysis of a set of Lumma affiliates within a vast info-stealing ecosystem, showing their interconnectedness and resilience even after a major law enforcement takedown attempts earlier this year: www.recordedfuture.com/research/beh...

Recorded Future's Insikt Group has identified new infrastructure associated with Candiru, which includes components likely used in the deployment & C2 of Candiru’s DevilsTongue spyware, as well as higher-tier infrastructure used by the spyware operators. www.recordedfuture.com/research/tra...

New active infrastructure for Candiru spyware linked to Hungary and Saudi Arabia identified therecord.media/candiru-spyw...

1/ We've just released a new report uncovering new infrastructure tied to multiple activity clusters linked to the Israeli spyware vendor #Candiru across several countries. Full report: www.recordedfuture.com/research/tra...

NoName057(16) is back online and launching new #DDoSia attacks just 6 days after #OperationEastwood. Their new targets? Primarily German and Italian government and municipal websites. Their rapid resurgence highlights their persistence. #Cybersecurity #NoName057

🚨 Our latest Insikt Group report, “Anatomy of DDoSia: NoName057(16)'s DDoS Infrastructure and Targeting”, is now live, providing an in-depth analysis of the pro-Russian hacktivist group’s DDoS campaigns. Get the full details here: www.recordedfuture.com/research/ana... #DDoS #DDoSia #NoName05716 🧵

🚨 More hiring at Recorded Future’s Insikt Group New role: Senior Threat Intelligence Analyst – Russia APT Focus 📍 Arlington VA, Boston MA, UK, or Remote 🎯 Track Russian state activity 🧠 Lead investigations and guide intel coverage Apply: grnh.se/cpizn7d62us

🚨 We’re hiring at Recorded Future’s Insikt Group Two senior analyst roles are open right now. Both focus on tracking nation-state threats. 🧵

The UK NCSC has published two new malware reports, both PDFs: -UMBRELLA STAND-Malware targeting Fortinet devices: www.ncsc.gov.uk/static-asset... -SHOE RACK-A post-exploitation tool for remote shell access & TCP tunnelling through a victim device: www.ncsc.gov.uk/static-asset...

Recorded Future's Insikt Group identified new infrastructure associated with GrayAlpha, a threat actor overlapping with the group commonly known as FIN7, & identified a new custom PowerShell loader dubbed PowerNet that decompresses & executes NetSupport RAT. www.recordedfuture.com/research/gra...

🇨🇳 🤖 New Insikt Group report! This research details how the People’s Liberation Army is rapidly experimenting with generative AI to augment — and potentially transform — its military intelligence capabilities. Blog: www.recordedfuture.com/research/art...

A threat actor is hacking Langflow AI servers to deploy Flodrix, a DDoS botnet malware strain www.trendmicro.com/en_us/resear...