Viva Aerobus-Linked Attacker Infrastructure and Post-Exploitation Findings
Reports Reports This report is about ‘Blackhatsect0r & DXQRTXX’. Download Report During threat-hunting activities conducted by the ThreatMon Threat Intelligence Team, an exposed attacker-controlled staging/loot server was identified. The server contained tooling prepared to access Microsoft SQL Server environments, execute Windows commands and encoded PowerShell through xp_cmdshell, upload and retrieve files, perform credential harvesting, collect […]
Blackhatsect0r & DXQRTXX Global Operations
Analysis of a publicly accessible server exposed a significant portion of the infrastructure associated with threat actors operating under the identities Blackhatsect0r and DXQRTXX.
Pakistan Cyber Threat Landscape Report 2026
Pakistan’s cyber threat landscape throughout 2026 was characterized by a convergence of nation-state cyber espionage, financially motivated cybercrime, hacktivist activity, and large-scale credential exposure.
Middle East Cyber Threat Landscape Report 2026
The cyber threat landscape in the Middle East during the 2026 period exhibited a complex structure shaped by a combination of financially motivated ransomware operations, data breaches, hacktivist activities, and state-sponsored cyber espionage operations.
Inside the Global FortiGate Access Campaign Report
The FortiGate credential leak is not a one-off exploit but a full credential operation. The actor scanned internet-facing Fortinet FortiGate and SSL VPN devices, combined leaked password lists with weak legacy hash storage, and built a validated dataset enriched with domain, sector, country, and port data, clearly prepared for Initial Access rather than left as a raw dump.
FIFA World Cup 2026 Threat Assessment Report
ThreatMon identified more than 21,600 FIFA-themed domains, observed credential exposure affecting FIFA-associated authentication services, and documented underground marketplaces advertising ticket fraud, automated ticket-acquisition tools, and alleged FIFA-related datasets.
GitHub Internal Source Code Exposure
Reports Reports This article is about ‘GitHub Internal Source Code Exposure ‘. Download Report On 19 May 2026, a threat actor operating under the handle TeamPCP, listed as [Co-Owner] on the Breached cybercrime forum, published a sale advertisement offering approximately 4,000 private source code repositories belonging to a major developer platform, including the target’s main […]
The Cyber Front of Iran–Israel
Reports Reports This article is about ‘The Cyber Front of Iran–Israel’. Download Report The current escalation between Iran and Israel marks a significant shift from prolonged shadow confrontation to overt military exchange. What was historically characterized by proxy warfare, covert action, sabotage, and cyber operations has transitioned into direct kinetic engagement, increasing the risk of […]
ThreatMon Global Cyber Threat Landscape Report
Reports Reports This report is about ‘ThreatMon Global Cyber Threat Landscape Report. Download Report The 2025 cyber threat landscape was defined by the convergence of geopolitical conflict, economic instability, and rapid technological advancement, resulting in a more aggressive, complex, and interconnected threat environment. State-sponsored cyber operations increased significantly as global political tensions intensified, with cyber […]
Grok Prompt Manipulation Digital Exploitation and Platform Responsibility
Reports Reports This report is about ‘Grok Prompt Manipulation’. Download Report Recent incidents involving Grok, the AI model integrated into X (formerly Twitter), reveal systemic risks that go far beyond isolated misuse. User-triggered prompts—especially those involving real people’s images—have led to non-consensual, sexualized, and exploitative outputs in public spaces, exposing serious gaps in AI safety […]