Malware and threat intelligence
Matteo Riva is the AI profile for malware, ransomware and threat actors. It reconstructs documented attack chains and detection and mitigation opportunities. It separates malware families, operators and campaigns, attributing actor identifications and confidence to their sources. It does not invent indicators or present criminal claims as independently verified facts.
Listed sources guide priorities; they are neither exclusive nor evidence of a partnership. Each article identifies the sources actually used.
Profiles guide research and writing within the existing pipeline. Editorial checks, translation and publishing follow the shared CyberWorldOps rules.
The editorial operator evaluates corrections and may update profile rules. The system does not autonomously learn from its own articles.
New articles record the profile used during writing. Earlier coverage is grouped by topic and does not imply that these profiles produced historical articles. Only reporting published in this language is listed.
MalwareMantax Otax Android malware encrypts files on Android 9 or older, steals SMS, screen data, and harasses victims. Distributed via APKs outside Google Play.
MalwareU.S. authorities seize Telegram channels and crypto wallets, freeze $52.8M in USDT, and sanction Xinbi Guarantee, a marketplace enabling pig-butchering scams.
APTFour espionage groups use BlueMoon exploit kit chaining Chrome V8 flaws and Windows ALPC bug to escape sandbox and deploy payloads.
MalwareHackers compromise F5 BIG-IP APM with fileless Linux rootkit injecting a memory-resident web shell, evading file scans. Vector unknown.
MalwarePEEP is a post-exploitation framework that turns Chrome and Edge into persistent backdoors to steal cookies, monitor browsing, and run OS commands.
MalwareElastic links four persistent Windows executables to REVSTEALER that steal crypto wallets, hijack clipboards, proxy traffic, and mine coins.
MalwareCitizen Lab confirmed Pegasus zero-click iPhone infection via iMessage against Serbian student amid wider surveillance of activists with NoviSpy.
MalwareBraZetsu malware catalogs infected PCs and sells access via Infected Marketplace, enabling fraud, data theft and corporate intrusions.
MalwareOver 5,400 WordPress and PrestaShop sites spread ClickFix malware via BNB Smart Chain EtherHiding, fake CAPTCHAs and WebRTC stagers.
MalwareMicrosoft tracked a million-message phishing campaign using invisible Unicode Tags to hide loan lures and bypass email filters.
APTRapid7 found trojanized HAProxy 2.8.12 in South Korea deploying the ted backdoor to hijack traffic, hide C2, execute commands and steal credentials.
MalwareCitizen Lab confirmed Pegasus zero-click iMessage compromise of Serbian student activist's iPhone, amid 14 spyware targets and NoviSpy Android cases.