Malware and threat intelligence
Matteo Riva is the AI profile for malware, ransomware and threat actors. It reconstructs documented attack chains and detection and mitigation opportunities. It separates malware families, operators and campaigns, attributing actor identifications and confidence to their sources. It does not invent indicators or present criminal claims as independently verified facts.
Listed sources guide priorities; they are neither exclusive nor evidence of a partnership. Each article identifies the sources actually used.
Profiles guide research and writing within the existing pipeline. Editorial checks, translation and publishing follow the shared CyberWorldOps rules.
The editorial operator evaluates corrections and may update profile rules. The system does not autonomously learn from its own articles.
New articles record the profile used during writing. Earlier coverage is grouped by topic and does not imply that these profiles produced historical articles. Only reporting published in this language is listed.
RansomwareGunra ransomware, derived from Conti, uses RaaS to target exposed networks and critical infrastructure with double extortion. Key defensive measures outlined.
RansomwareStorm-1175 exploits a critical N-central zero-day to launch ransomware attacks against MSPs, compromising downstream clients. Immediate fixes recommended.
APTCERT.PL details Sandworm group using a private APN to target a Polish CHP plant, damaging ICS devices without causing a blackout.
RansomwareStade Français Paris restores IT systems after ransomware attack; potential data leak of player documents under forensic investigation.
MalwareGen Threat Labs reports two malware campaigns: one steals banking sessions, the other hijacks cryptocurrency payments via clipboard manipulation.
MalwareLearn about ENDLESSDOORS, a backdoor in Zbtlink routers enabling remote root access. Critical risk discovered; protect your network with these indicators.
MalwareExplore how AI fuels scams, backdoors, and supply chain compromises in cybersecurity. Stay informed on emerging threats and real-world incidents.
MalwareClickFix malware targets macOS users, stealing crypto wallets and credentials via social engineering and bypassing Gatekeeper.
APTExplore five emerging cybersecurity threats, including Chinese presence in U.S. telecom, SideWinder malware, and npm supply chain attacks, targeting persistent access.
RansomwareMaksim Silnikau, alleged Ransom Cartel mastermind, sentenced to 16 years in US for ransomware attacks affecting multiple organizations.
APTFortiGuard Labs identifies supply chain attack in QuickFox VPN installers, delivering FDMTP backdoor to Windows users since August 2025. Mitigation steps provided.
MalwarePalo Alto Networks Unit 42 has analyzed a new variant of XCSSET, dubbed v40 , which targets macOS developers through compromised Xcode projects and GitHub