Malware and threat intelligence
Matteo Riva is the AI profile for malware, ransomware and threat actors. It reconstructs documented attack chains and detection and mitigation opportunities. It separates malware families, operators and campaigns, attributing actor identifications and confidence to their sources. It does not invent indicators or present criminal claims as independently verified facts.
Listed sources guide priorities; they are neither exclusive nor evidence of a partnership. Each article identifies the sources actually used.
Profiles guide research and writing within the existing pipeline. Editorial checks, translation and publishing follow the shared CyberWorldOps rules.
The editorial operator evaluates corrections and may update profile rules. The system does not autonomously learn from its own articles.
New articles record the profile used during writing. Earlier coverage is grouped by topic and does not imply that these profiles produced historical articles. Only reporting published in this language is listed.
RansomwareAnalysis of Clop ransomware's exploitation of CVE-2026-12569 in PTC Windchill, using a JSP web shell to steal engineering data and credentials from PLM servers.
MalwareMicrosoft reveals 31 domains linked to MacSync Stealer, a macOS infostealer that steals credentials, keys, and data via social engineering and HTTP uploads.
RansomwareCISA and FBI report Medusa ransomware has over 500 victims, with attacks on healthcare and critical infrastructure, exploiting vulnerabilities rapidly.
RansomwareSwiss prosecutors demand a 12-year prison term for a Ukrainian developer accused of leading ransomware attacks causing CHF 130M in damages.
APTExplore how the Iranian Cavern framework uses DNS, Google Apps Script, and Microsoft 365 calendars for command-and-control in cyber attacks.
APTMustang Panda's CoolClient adds kernel rootkit for evasion, targeting Asian governments. Analysis of msagent.sys and infection methods.
APTJewelbug, a Chinese APT group, blends state-sponsored cyberespionage with cryptocurrency theft using advanced tools and infrastructure.
MalwareA Trivy supply chain compromise triggered an attack on 2,500+ organizations, exposing secrets and targeting CI/CD environments.
APTDiscover PATCHCORD cyberespionage campaign: backdoors in browsers, Google Sheets C2, targeting telecoms. Fake tools and AI-assisted code development.
RansomwareCISA advisory on Gunra ransomware group exploiting exposed firewalls and VPNs. Derived from Conti, it uses double extortion and targets multiple sectors.
MalwareEvooo1Bot, a new Mirai variant, exploits router vulnerabilities to create encrypted proxies for attackers, posing global cybersecurity risks.
MalwareLearn how criminals reuse expired domains for malware and scams, exploiting inherited trust and traffic.