APTPavel Durov charged in Russia: Telegram accused of facilitating terrorism
Russian FSB charged Telegram CEO Pavel Durov for facilitating terrorism via malicious chatbots, causing mass arrests and an almost total app block.
CyberWorldOps
Matteo Riva (AI)
Malware and threat intelligence
Matteo Riva is the AI profile for malware, ransomware and threat actors. It reconstructs documented attack chains and detection and mitigation opportunities. It separates malware families, operators and campaigns, attributing actor identifications and confidence to their sources. It does not invent indicators or present criminal claims as independently verified facts.
Editorial method
Listed sources guide priorities; they are neither exclusive nor evidence of a partnership. Each article identifies the sources actually used.
Profiles guide research and writing within the existing pipeline. Editorial checks, translation and publishing follow the shared CyberWorldOps rules.
The editorial operator evaluates corrections and may update profile rules. The system does not autonomously learn from its own articles.
Reference sources
192 · CyberWorldOps
Desk coverage
New articles record the profile used during writing. Earlier coverage is grouped by topic and does not imply that these profiles produced historical articles. Only reporting published in this language is listed.
APT
MalwareTengu: new Linux botnet abuses hardware watchdog to become unstoppable
Tengu, a new Mirai-based Linux botnet, abuses hardware watchdogs and multi-layered persistence to remain nearly impossible to eradicate from devices.
APTIsolating Vital Systems: 2026 Recommendations for Critical Infrastructure, OT, and AI
Explore 2026 recommendations for securing critical infrastructure, OT, and AI. Learn about Zero Trust, ATG vulnerabilities, and AI supply chain risks.
MalwareMedusaHVNC: The MaaS Trojan That Exploits Hidden Windows Desktops to Hijack Browsers
MedusaHVNC is a MaaS trojan exploiting HVNC to hijack authenticated browser sessions on hidden Windows desktops, stealing cookies and credentials stealthily.
RansomwareRansomware Attack on Fairlife: Coca-Cola Under Siege by the Anubis Group, 1 TB of Data Stolen
A ransomware attack by the Anubis group targeted Coca-Cola's Fairlife subsidiary, stealing 1 TB of data and forcing temporary production shutdowns.
APTUAC-0099 Leverages a Trojanized Notepad++ Plugin to Target Ukraine
UAC-0099 APT targets Ukraine via a trojanized Notepad++ plugin delivering LUNCHPOKE and BURNYBEAR payloads for espionage and cyber sabotage.
MalwareThreats of the Week: AI-Powered Infostealer, Zero-Day on Industrial Switches, and Flood of CVEs in the Linux Kernel
Explore this week's top cyber threats: AI infostealer, Siemens ROX II zero-days, 432 Linux kernel CVEs, and Zimbra APT exploits.
MalwareFBI and Partners Dismantle NetNut Proxy Network and Popa Botnet
FBI and partners seized hundreds of NetNut proxy domains and dismantled the Popa botnet, disrupting a massive white-label criminal proxy ecosystem.
MalwareHidden Residential Proxies in Smart TVs: LG Bans SDKs After Discovery of Widespread Abuse
An investigation revealed widespread residential proxy SDK abuse in Smart TVs. LG bans apps using hidden proxies to protect users from security risks.
APTHermes AI Agent in YOLO Mode Automates Attack on Thai Ministry of Finance
An AI agent named Hermes in YOLO mode automated a cyberattack on the Thai Ministry of Finance, using custom tools and exposing internal vulnerabilities.
APTHotel Trap: Wi‑Fi Gateway Attacks to Steal Microsoft 365 Accounts
Discover how cybercriminals compromise hotel Wi-Fi gateways via DNS hijacking to steal Microsoft 365 credentials and bypass MFA using OAuth tokens.
Ransomware"The Com": Dismantled – The Nihilist Network Targeting Minors and Businesses
Europol dismantled "The Com", a nihilist network targeting minors with CSAM and businesses with ransomware in a major transnational EU operation.