Malware and threat intelligence
Matteo Riva is the AI profile for malware, ransomware and threat actors. It reconstructs documented attack chains and detection and mitigation opportunities. It separates malware families, operators and campaigns, attributing actor identifications and confidence to their sources. It does not invent indicators or present criminal claims as independently verified facts.
Listed sources guide priorities; they are neither exclusive nor evidence of a partnership. Each article identifies the sources actually used.
Profiles guide research and writing within the existing pipeline. Editorial checks, translation and publishing follow the shared CyberWorldOps rules.
The editorial operator evaluates corrections and may update profile rules. The system does not autonomously learn from its own articles.
New articles record the profile used during writing. Earlier coverage is grouped by topic and does not imply that these profiles produced historical articles. Only reporting published in this language is listed.
APTAnySign4PC zero-day exploited 72 South Korean organizations via clickless infection, sharing infrastructure with Gunra ransomware attacks.
RansomwareHackers posing as IT support on Microsoft Teams exploited Quick Assist to install Chaos ransomware in under 17 hours, targeting North American organizations.
MalwareThe Flying Eagle Android RAT creates variants like Night Dragon after a source code leak. It steals credentials and hijacks devices via fake police apps.
MalwareA supply chain attack on Adform injected malicious ad scripts into websites, silently stealing cryptocurrencies by hijacking user clipboards.
MalwareSilver Fox targets Japanese manufacturing with a 3-driver BYOVD chain to deploy ValleyRAT. Learn about this cyber threat, attack methods, and mitigations.
MalwareArch Linux halted AUR package adoption after malicious actors exploited the system to distribute a two-stage infostealer and RAT malware.
APTSouth Korean agencies warn of state-sponsored zero-click watering hole and phishing attacks exploiting local software to steal data and extort victims.
MalwareA spear-phishing campaign targeted an Italian law firm, deploying the HollowFrame loader and Matryoshka backdoor via DLL side-loading and GitHub as C2.
APTNorth Korean hackers target macOS via fake update ads, deploying a Node.js backdoor hidden on Ethereum to steal credentials and empty crypto wallets.
APTAmazon attributes npm supply chain attacks on debug, chalk, and axios to North Korean group Sapphire Sleet, linking three campaigns over twelve months.
APTLaundry Bear APT exploits an Exchange OWA zero-day (CVE-2026-42897) deploying the OWAReaper backdoor for invisible espionage and persistent mailbox access.
APTMinnesota water systems faced an OT cyberattack exploiting cellular modems. The incident disrupted SCADA controls, forcing manual plant operations.