Xan-RAT A Closer Look at Its Capabilities and Inner Workings
Blog Xan-RAT: A Closer Look at Its Capabilities and Inner Workings Xan-RAT, also known as Cold Xan RAT, is a Quasar-based remote access trojan with capabilities for remote control, credential theft, surveillance, and data collection. Its source code is publicly available, making it possible to examine how these capabilities are implemented and how the malware […]
The Load Balancer as a Backdoor: Investigating DPRK-Linked Tradecraft Inside HAProxy
Blog The Load Balancer as a Backdoor: Investigating DPRK-Linked Tradecraft Inside HAProxy Executive Summary A Linux espionage toolkit identified in two South Korean organizations has revealed an unusual approach to maintaining access within enterprise infrastructure: embedding a backdoor directly into a legitimate HAProxy load balancer. The implant, known as ted, allowed the compromised service to […]
760,000 Leaked Logins and Five Spy Campaigns: Inside Pakistan’s Worst Cyber Year Yet
Blog 760,000 Leaked Logins and Five Spy Campaigns: Inside Pakistan’s Worst Cyber Year Yet Pakistan’s government portals, universities, and hospitals spent 2026 under near-constant pressure from state-backed spies on one side and profit-driven criminals on the other. ThreatMon tracked all of it for its Pakistan Cyber Threat Landscape Report 2026, and the numbers underneath the […]
Berlin Government Allegedly Hit by Rhysida Ransomware
Blog Berlin Government Allegedly Hit by Rhysida Ransomware: 5.79 TB of Data Claimed Stolen TL;DR / Key Findings Threat Actor: Rhysida ransomware group Target Platform/Sector: Public sector and administrative infrastructure of the Berlin State Government Activity Window: August 28, 2026 Alleged Victims & Records: Berlin State Administration (~1.44 million files scanned and classified) Total Disclosed […]
Iran-Linked Cyberattack Disrupts UK Power Generation Facility
Blog Iran-Linked Cyberattack Disrupts UK Power Generation Facility TL;DR / Key Findings Incident: A cyber incident affected a small power generation facility in the United Kingdom in July 2026, with the facility reportedly remaining unavailable for approximately four days. Impact: No consumer outages were reported and the wider UK electricity system was not affected. Attribution: […]
The Top 10 Vulnerabilities Threat Actors Exploited Most in 2026
Blog The Top 10 Vulnerabilities Threat Actors Exploited Most in 2026 Every year, a large share of breaches starts with an attacker exploiting a vulnerability in software the target is running, and it is now one of the most common ways into a network. What follows depends on where the flaw sits. A vulnerable VPN […]
The Rise and Fall of BreachForums: A Cybercrime Empire Collapses
Blog The Rise and Fall of BreachForums: A Cybercrime Empire Collapses Quick Summary: BreachForums emerged in March 2022 as RaidForums’ successor and became the world’s dominant stolen data marketplace. Founded by Conor Fitzpatrick (pompompurin), it attracted major threat actors including ShinyHunters and IntelBroker. The platform collapsed between 2023-2026 through cascading administrator arrests, FBI seizures, a […]
TheHatman Claims 3.6M Records Linked to Azure Environments Across Nine Organizations
Blog TheHatman Claims 3.6M Records Linked to Azure Environments Across Nine Organizations TL;DR Threat actor: TheHatman (underground cybercrime forum listing) Platform targeted: Microsoft Azure tenant environments / Entra ID Activity window: August 1, 2026 (campaign start) – August 12, 2026 (most recent observed activity) Claimed victims & record counts: McDonald’s (~1.7M records), Vodafone (~425,000 records), […]
The Rise of Ransomware in July 2026: What Companies Need to Know
Blog The Rise of Ransomware in July 2026: What Companies Need to Know Ransomware did not slow down in July 2026. If anything, the threat landscape became more fragmented, more targeted, and harder to predict. ThreatMon’s latest ransomware research identified activity linked to six distinct ransomware groups, affecting organizations across multiple countries and industries. The […]
Understanding The Agentic Crime Ecosystem
Blog Understanding The Agentic Crime Ecosystem Artificial intelligence is changing cybersecurity in more ways than one. While organizations continue adopting AI assistants to improve productivity, attackers are beginning to use the same technologies to automate reconnaissance, exploit vulnerabilities, and adapt during live operations. The shift is significant because AI is no longer limited to generating […]