Author: Tudorel Iancu

Introduction Published by Group-IB  on 2026-03-21, the report titled Gentlemen TTPs Analysis Report offers an in‑depth look at a newly surfaced ransomware-as-a-service operation known as The Gentlemen. The threat actor, led by the pseudonymous hastalamuerte, has

Executive Summary The newly disclosed CVE‑2026‑33017 exposed Langflow, an open‑source visual framework for AI agents, to unauthenticated remote code execution via its public flow build endpoint. Sysdig’s Threat Research Team observed the first exploitation attempts within

VoidStealer Debugging Chrome for Data Theft AlienVault’s March 20, 2026 threat report, VoidStealer: Debugging Chrome to Steal Its Secrets, exposes a novel infostealer that extracts Chrome’s Application‑Bound Encryption key using a debugger‑based hardware breakpoint technique. The method bypasses

In March 2026, the Google Threat Intelligence Group (GTIG) released a detailed report on a sophisticated iOS full‑chain exploit known as DarkSword. The analysis reveals that multiple threat actors—from commercial surveillance vendors to suspected state‑sponsored groups—have

Threat Overview Hydra Saiga, also known as Yorotrooper, ShadowSilk, and Silent Lynx, is a state‑sponsored threat actor linked to Kazakhstan. Active since 2021, the group has targeted critical water and energy infrastructure across Central Asia, Europe,

Overview The Storm-2561 threat actor has launched a credential‑stealing operation that leverages search engine optimization (SEO) poisoning to distribute counterfeit virtual private network (VPN) clients. By manipulating search results for popular VPN titles such as Pulse

The latest threat report from Hunt.io, published by Tr1sa111 on March 11, 2026, lays out a comprehensive timeline of the MuddyWater intrusion chain, an Iranian‑linked APT group. The report, titled Clearing the Water: Unmasking an Attack Chain of

Executive Summary The latest threat analysis conducted by CheckPoint reveals a strategic shift among Iranian Ministry of Intelligence and Security (MOIS) linked actors. Instead of merely masquerading as cyber criminals, these groups are actively integrating criminal

Overview In early March 2026 the Splunk Threat Research Team released a detailed examination of the NotDoor backdoor, a sophisticated malware family that exploits native Outlook macros and DLL sideloading to establish persistence and exfiltrate data

In early March 2026, Okta Threat Intelligence released a comprehensive threat advisory titled SMS Pumping | Threat Advisory | Okta Threat Intelligence. The report details a coordinated, high‑volume campaign that exploits disposable email infrastructure and commodity