Author: DarkOwl Content Team

April 23, 2026

Cybersecurity might as well have its own language. There are so many acronyms, terms, sayings that cybersecurity professionals and threat actors both use that unless you are deeply knowledgeable, have experience in the security field or have a keen interest, one may not know. Understanding what these acronyms and terms mean is the first step to developing a thorough understanding of cybersecurity and in turn better protecting yourself, clients, and employees. 

In this blog series, we aim to explain and simplify some of the most commonly used terms. Previously, we have covered bullet proof hosting, CVEs, APIs, brute force attacks, zero-day exploits, doxing, data harvesting, IoCs, credential stuffing, and ransomware as a service. In this edition, we dive into push bombing.

Push Bombing 101 

Push bombing, also known as “MFA Fatigue” or “MFA Spamming,” is a deceptive social engineering tactic in which an attacker repeatedly triggers MFA push notifications to the victims device. Multi-factor authentication (MFA) has long been considered a cornerstone of modern cybersecurity. By requiring users to verify their identity through an additional factor—like a push notification to a mobile device—organizations have significantly reduced the risk of account compromise. Multifactor authentication is not invincible. As always, attackers adapt. Attackers increasingly exploit user behavior instead of cryptographic weaknesses. And this is where push bombing comes into the scene.

The goal is simple: flood a target with repeated MFA push notifications in the hope that they will eventually “approve” one. At a high level, push bombing is a shortcut. Instead of breaking through authentication controls, attackers pressure users into opening the door for them.

The process usually begins after an attacker has already obtained a user’s valid credentials, often through phishing, credential stuffing, or darknet data leaks. Once the attacker attempts to log in, the system sends a push notification to the legitimate user’s mobile app. When the user denies the request, the attacker immediately triggers another, and another—sometimes hundreds of times in a row, often in the middle of the night when the victim is less likely to be alert. Attackers often combine push bombing with chat-based impersonation, fake IT support calls, and SMS messages – creating a sense of urgency and legitimacy.

Push Bombing in the Wild

The Cybersecurity and Infrastructure Security Agency has published guidance highlighting this growing tactic.

Early warning indicators include:

• Multiple MFA prompts within short time periods
• Authentication approvals outside normal working hours
• Users reporting repeated push requests they did not initiate

When a user comments, “I keep getting login prompts even though I’m not trying to sign in” that’s not a help desk or internal IT nuisance. It’s an intrusion attempt in progress.

Push bombing is actively used in real-world attacks and breaches by threat actors targeting organizations of all sizes, often as the final step in an account takeover chain. Consequences of a successful push bombing attack extend way beyond the single compromised account. Once inside, attackers can:

• Launch impersonation or fraud campaigns
• Access sensitive corporate systems
• Move laterally across networks
• Steal data or deploy ransomware

Uber

In 2022, a threat actor associated with the Lapsus$ group gained access to Uber’s internal systems. After obtaining a contractor’s password, the attacker sent a barrage of MFA requests. When the contractor initially ignored them, the attacker contacted them on WhatsApp, pretending to be from Uber IT, and told them they needed to approve the request to stop the notifications. The contractor complied, giving the attacker full access to the corporate environment.

Cisco

Also in 2022, Cisco fell victim to a series of sophisticated push bombing attacks. After compromising a user’s personal Google account to find stored credentials, the attackers moved to the corporate network. They used a combination of voice phishing (vishing) and MFA fatigue to trick the employee into granting access, eventually allowing the attackers to move laterally through the network.

Protection and Mitigation

What makes push bombing especially dangerous is its simplicity. It doesn’t require sophisticated malware or zero-day exploits—just stolen credentials and persistence.

Of course DarkOwl will always recommend using MFA, but let’s go one step further: choose a phishing-resistant MFA. Not all MFA is equal. SMS codes and push prompts can be bypassed (push fatigue, SIM swaps). Where available, use FIDO2 keys, WebAuthn, and passkeys, particularly for privileged and external-facing accounts for phishing-resistant authentication. Never approve a push you didn’t initiate; report repeated prompts to IT. Ask your org to move critical apps to phishing-resistant MFA.

Push bombing is the second stage of a compromise; the first stage is the loss of credentials. Awareness of when your employees’ or customers’ credentials have been leaked on the darknet can help you stay ahead of these attacks.

Leveraging a continuously updated darknet data index enables organizations to detect security gaps before a threat actor begins a push bombing campaign. By monitoring for leaked usernames and passwords associated with your domain, you can proactively force password resets and invalidate sessions, neutralizing the attacker’s ability to even trigger that first notification.

---

Curious to learn more about dark web monitoring? Contact us.

April 21, 2026

The team is excited to share the new capabilities, platform improvements, and notable darknet intelligence collected across January, February, and March. 

Q1 was a big quarter for the DarkOwl platform. We’ve been laser-focused on one goal: helping analysts work faster and smarter — surfacing the right intelligence at the right moment, without ever breaking their flow. Here’s a look at what’s new. 

Introducing Vendor Context in Market Research 

It’s never been faster to assess vendor scale, longevity, and risk — all without leaving the market listing result you’re already looking at. Vendor Context delivers an instant, comprehensive snapshot of any known vendor — directly within a Market Research listing. With a single click, analysts can see: 

• Total markets and listings the vendor has appeared in 
• First and last observed activity dates 
• Top markets where the vendor is most active 
• Primary shipping sources 
• The vendor’s five most recent listings across all markets 

Vendor Context expands on DarkOwl’s market dataset and features, providing a purpose-built, structured investigative capability specifically designed for darknet marketplace analysis. Markets are among the most operationally significant environments on the dark web—serving as hubs for the sale of drugs, weapons, stolen data, counterfeit goods, and as nexus points for the criminal networks. DarkOwl’s enhanced market holdings now include more than 431,000 listings which extract vendor identity, product description, category, price, accepted payment methods, shipment origin/destination, reviews, and more. 

Breaking the Language Barrier 

A substantial portion of threat actor activity, forum discussions, marketplace listings, and leaked data originates from Russian, Chinese, Arabic, Farsi, and other non-English-speaking communities. Global threat intelligence means working across dozens of languages. We’ve made that dramatically easier with Translation for search results. Instantly translate any text from search or alert results inline, now covering all 52 languages supported by Vision UI. No external tools, no copy-pasting — just highlight, click, and read. And because we know it matters for sensitive environments: translation runs entirely within the DarkOwl platform, with no data leaving our closed environment. 

Deeper Intelligence and Streamlined Analyst Workflows 

• Expanded Site Lexicon and Context — Data Sharing and File Repository are now recognized site categories, with full Site Context enabled across results — making it easier to identify and investigate these areas of the darknet. Key press releases, law enforcement actions, and major news coverage are now linked directly within a new media reporting field in Site Context. 
• Export by Date Range — Generate time-based reports from Case Findings to share only the most relevant data or align exports with reporting or investigative timeframes.  
• Save as Finding Snippet — Highlight any text in a result, click “Save as Finding Snippet,” and the Add Finding panel opens automatically. Analysts can save both the original and translated text as separate snippets within the same Finding — ideal for reporting, collaboration, and evidence tracking. 
• Additional UX improvements — A Case Overview redesign to ensure critical alerts are now front and center; easier navigation in Actor Explore; additional fields on results from Paste sites. 

Vision API Updates 

For teams building on the DarkOwl API, Q1 brought expanded data access and improved developer experience: 

• Paste-specific fields now available in Search API: author, postDate, expires, and key 
• Media Reporting in Context API for sites  
• Updated API documentation for a smoother integration experience 

Collection Stats 

Our data collection team continues to astonish us with the quantity of data made available across all DarkOwl  products. Let’s highlight just some of that growth year over year:

• 21% increase in credit card numbers
• 20.5% increase in email addresses
• 9% increase in IPs

Notable Content Collected 

Our collection and research teams had a busy quarter. Here’s a snapshot of some of the most significant data leaks and original research that happened in Q1. 

Original Research

Dark Web Reactions to the Israel–Iran Conflict 

In March 2026, our team published an in-depth analysis of how dark web and adjacent communities responded to the escalating conflict between Iran, Israel, and the United States. Hacktivist groups launched over 149 DDoS attacks against 110 organizations—107 of them in the Middle East—within days of the strikes. Jihadist communities on Telegram and Rocket.Chat used the conflict to amplify recruitment narratives, including a call for “global cyber jihad” from a group claiming al-Qaeda ties. Iranian-aligned militia channels circulated target lists and operational claims, while a notable crossover emerged between extremist ideological communities as groups linked to Nihilistic Violent Extremism blurred traditional political lines. DarkOwl continues to monitor these ecosystems as the conflict evolves. 

Leaks of Interest  

BreachForums 2026 

Posted on January 9, 2026, this leak exposed personal data for approximately 324,000 BreachForums users. The exposed data includes usernames, email addresses, and IP addresses for a large population of actors who may participate in buying and selling stolen data. The data came from a database backup dated August 11, 2025, inadvertently left in a publicly accessible directory during a site restoration. A 4,400-word manifesto attributed to a threat actor using the pseudonym “James” accompanied the data, framing the leak as deliberate retaliation against the forum’s users following attacks on French infrastructure.  

Harvard University 

Posted on ShinyHunters on February 4, 2026, this dataset purports to contain 1 million records from Harvard’s Alumni Affairs and Development systems. The breach originated from a vishing campaign in November 2025 where attackers impersonated support staff and bypassed Multi-Factor Authentication in real time. Researchers describe the exposed data as a “map of influence”—including private home addresses and mobile numbers for prominent individuals alongside sensitive donor contracts and internal strategy documents. The combination of donor financial data, direct contact information, and internal strategy documents creates a rich target for spear-phishing, fraud, and reputational exploitation across a high-profile institution’s network. For security teams evaluating their own exposure, this is immediately relevant to how they think about vishing defenses and privileged access to constituent or membership systems. 

LexisNexis 

Posted to DarkForums on March 3, 2026 by threat actor FulcrumSec, this breach exploited an unpatched React application on LexisNexis AWS infrastructure via a React2Shell vulnerability combined with a weak RDS master password. The actor claims to have exfiltrated over 2GB of data including plaintext credentials and contact details for 118 U.S. government employees—including federal judges and DOJ attorneys. LexisNexis characterizes the data as largely pre-2020 legacy records. FulcrumSec frames the attack as separate from a 2024 breach that prompted a class-action lawsuit and states it was not geopolitically motivated, but intended to highlight a “sustained pattern of negligence.” For organizations that rely on LexisNexis—law firms, financial institutions, government agencies—exposure of the underlying records is a direct concern. The inclusion of federal judiciary and DOJ contact information in a publicly accessible darknet post significantly elevates risk.  

---

Curious how these features and data can make your job easier? Get in touch! 

April 16, 2026

A previously unknown group calling itself Harakat Ashab al-Yamin al-Islamia (Ashab al-Yamin) has recently emerged, claiming responsibility for a series of attacks across Europe and quickly attracting attention from analysts and media outlets. Reporting by CBS News, citing researchers from Tech Against Terrorism and others, has highlighted the group’s sudden appearance and raised questions about whether it represents a genuine operational network or a rapidly assembled media construct linked to broader geopolitical dynamics.

The group’s presence appears largely confined to Telegram, where it publishes a mix of attack claims, propaganda, and geopolitical commentary. Its Telegram footprint is fragmented, with limited persistent content and much of its activity preserved through secondary or supporter accounts.

Rather than evaluating Ashab al-Yamin as a standalone entity, a closer examination of its Telegram activity suggests a different framing. Patterns of shared content, cross-channel distribution, and overlapping narratives indicate that the group operates within a broader, loosely connected ecosystem of Iranian-aligned channels. This ecosystem overlaps with networks commonly associated with the “Islamic Resistance,” where claims, media, and messaging circulate across multiple accounts rather than originating from a single source.

This raises a central question: is Ashab al-Yamin a distinct organization, or a visible node within a broader networked ecosystem? Let’s dive in.

Telegram Activity and Content Patterns

As of early April 2026, the group’s primary Telegram channel, Harakat Ashab al-Yamin al-Islamia, appears to have been removed or banned from the platform. The most recent identifiable content, dated April 4, included a video claiming responsibility for an attack targeting a building associated with Christians for Israel in Nijkerk, Netherlands. No clear successor channel has been identified at the time of writing, further reinforcing the group’s fragmented and unstable presence across Telegram, where continuity appears dependent on redistribution rather than sustained ownership of a single channel.

As a result, much of the group’s observable activity is derived from secondary or supporter channels, such as صفي الدين, which continues to circulate attack claims, propaganda, and related content attributed to the group.

Initial review of these channels suggests they do not function solely as claim-of-responsibility outlets. Instead, they operate as hybrid media nodes, combining attack claims, geopolitical commentary, and propagandistic amplification of broader regional narratives.

For example, content includes battlefield or intelligence-style analysis, such as satellite imagery purportedly showing damage to U.S.-linked air facilities in Bahrain and Kuwait following Iranian strikes. The accompanying text describes specific targets such as hangars, fuel storage, and drone infrastructure.

Figure 1: Satellite imagery / strike analysis post

This style of posting is consistent with content observed across pro-Iranian Telegram channels, where content blends battlefield updates, geopolitical commentary, and narrative amplification alongside claims of responsibility for attacks in Europe.

Figure 2: London ambulance attack claim video

One such example includes a video documenting an arson attack in London targeting ambulances associated with a Jewish community organization. The accompanying Arabic-language caption frames the incident as an operation carried out by Ashab al-Yamin, referencing a synagogue in the British capital and linking the action to broader anti-Israel narratives.

More recent content attributed to the group includes claims related to an attack targeting a commercial center in Amsterdam. One such post states:

Figure 3: Amsterdam attack video from Ashab al-Yamin

حركة أصحاب اليمين الإسلامية تتبنى استهداف المركز التجاري العالمي في أمستردام، وتدعو شعوب أوروبا إلى الابتعاد عن المصالح الأمريكية والصهيونية فوراً.

Translation: “The Islamic Movement of Companions of the Rights claims responsibility for targeting the World Trade Center in Amsterdam and calls on the peoples of Europe to immediately distance themselves from American and Zionist interests.”

The limited availability of such claims on the group’s official channel, combined with their continued circulation across secondary and affiliated channels, complicates efforts to assess a single point of origin. Instead, messaging is distributed across multiple accounts, where content persists through redistribution rather than consistent publication from a single source.

Content Origination and Cross-Channel Linkages

One particularly notable detail is the presence of Sabereen News branding within video content that was previously reposted by Ashab al-Yamin’s official Telegram channel.

Figure 4: Ashab al-Yamin post showing Sabereen News watermark; London attack

Sabereen News is a Telegram-based media outlet widely associated with Iranian-aligned networks, with multiple analyses pointing to links with Iran’s Islamic Revolutionary Guard Corps–Qods Force (IRGC-QF) and Iran-backed militia groups. Research by the Washington Institute for Near East Policy notes “strong indicators” of IRGC-QF connections and highlights that the channel first appeared on Telegram in January 2020. More recent reporting from Iran International similarly reflects its position within IRGC-linked messaging networks.

The visible Sabereen News watermark within the footage of the London ambulance attack suggests that the video was either sourced from, or circulated through, an Iranian-aligned media channel prior to being reposted by Ashab al-Yamin. Rather than serving as definitive proof of origin, this overlap indicates participation in a shared media pipeline where content is reused and redistributed across channels.

This interpretation is further supported by activity observed on Sabereen News channel, which regularly publishes operational updates, threat messaging, and geopolitical narratives aligned with Iranian interests.

Figure 5: Sabereen News missile / strike-related footage

Additional Sabereen content illustrates this narrative.

Figures 6 & 7: Sabereen News corporate targeting / company list

In this example, Sabereen News publishes a list of Western companies, including technology firms, financial institutions, and defense-related entities, framing them as potential targets linked to broader geopolitical events. While this is not a direct claim of responsibility, it reflects a broader pattern of signaling and narrative shaping seen across affiliated channels.

Additional recent content from Sabereen News further illustrates its role as a central distribution node within this ecosystem. In some cases, this aggregation extends beyond Iranian-aligned actors.

For example, Sabereen News has been observed resharing content attributed to Sunni jihadist groups, including material linked to Ajnad Bayt al-Maqdis. The original post appears to have been published by a Telegram account operating under the name “hamid alqawsi,” before being redistributed through Sabereen. The group’s recent pledge of allegiance to al-Qaeda, dated February 2026, coincides with broader regional escalation reinforcing patterns of opportunistic emergence tied to major geopolitical events. This further illustrates how content moves across distinct networks through centralized amplification channels.

Figures 8 & 9: Original Telegram post from “hamid_alqawsi” account and subsequent repost by Sabereen News

In a separate example, the channel reposts video footage attributed to Hezbollah depicting a missile strike on the Israeli town of Kiryat Shmona. While not directly linked to Ashab al-Yamin, this type of cross-group content aggregation highlights how Sabereen functions as a broader amplification hub, circulating material from multiple actors and reinforcing shared narratives across the network. Channels such as Sabereen News therefore remain key points of observation for tracking how new identities emerge and reappear within this network.

Figure 10: Sabereen News Telegram post reposting Hezbollah-attributed missile strike footage targeting Israel

An earlier Telegram channel, Haraka Ashab Al Yamin, identified as one of the first to publish content associated with the Amsterdam attack, appears to have been removed or banned from the platform, further complicating efforts to trace content back to a single point of origin.

Across posts, several additional patterns emerge that reinforce this ambiguity. The language is primarily Arabic, with no observable use of Farsi despite speculation of Iranian association, and messaging consistently incorporates anti-Israel and anti-Western themes aligned with broader regional narratives. Taken together, these characteristics further complicate attribution and raise questions about the group’s structure, consistency, and underlying coordination, which become more apparent when examining its claims and media output more closely.

Indicators of Authenticity vs Narrative Construction

The available Telegram content presents a mixed picture of Ashab al-Yamin’s credibility as an operational group. While the channel attempts to project visibility through attack claims and messaging, it lacks several features typically associated with more established militant organizations.

Unlike known Iranian-aligned and PMF-affiliated groups, Ashab al-Yamin does not consistently produce formalized statements, leadership messaging, or a clearly defined media structure. Its presence appears limited in scale, with no clear evidence of sustained or centralized coordination.

At the same time, the quality and style of its media output vary noticeably, with some videos appearing more refined and others more rudimentary. This inconsistency likely reflects contributions from multiple actors rather than a single coordinated media wing. This aligns with assessments from analysts cited in CBS News, who note that such output may be designed to generate psychological impact rather than demonstrate operational sophistication.

The group’s messaging also closely tracks ongoing geopolitical developments, suggesting a degree of responsiveness and an understanding of how to maximize visibility within a rapidly evolving information environment. Taken together, these patterns support the interpretation put forward by the Foundation for Defense of Democracies: that Ashab al-Yamin may function less as a centralized organization and more as a front identity used to claim attacks carried out by loosely connected or externally recruited individuals. This ambiguity becomes more meaningful when placed alongside the wider ecosystem in which the group operates.

More broadly, this model reflects a pattern observed across comparable ecosystems, where decentralization, narrative amplification, and perceived reach are often prioritized over formal organizational structure. In such contexts, visibility and attribution can be strategically leveraged to amplify perceived impact without requiring sustained operational capability.

PMF and Iranian-Aligned Telegram Ecosystem

Rather than viewing Ashab al-Yamin in isolation, its activity is more clearly understood when placed alongside a broader cluster of Telegram channels linked to the “Islamic Resistance” ecosystem.

This ecosystem includes a mix of militia-linked channels, media outlets, and amplifier accounts. Channels such as:

· شباب الإسلام

· أصحاب الكهف

· جيش الغضب

· صفي الدين

· التعبئة الشعبية للمقاومة الإسلامية في العراق ( بسيج العراق)

· القدرات العسكرية الإيرانية

These channels regularly publish claims, updates, and propaganda tied to attacks against U.S. and allied targets, while also forwarding and resharing content from one another. These channels function as an interconnected network, regularly cross-posting and reinforcing shared narratives.

Figure 11: Safee al-Deen / ecosystem connections post

Posts such as the above highlight explicit relationships between multiple groups operating under the umbrella of the “Islamic Resistance,” including Ashab al-Kahf and Jaysh al-Ghadab.

Ashab al-Kahf is an Iraqi militia group aligned with the Islamic Resistance in Iraq, known for claiming attacks against U.S. military and allied targets in the region. Its Telegram presence reflects a structured communication style, including consistent branding, formalized statements, and clearly framed claims of responsibility.

Figure 12: Ashab al-Kahf Telegram profile / branding insignia

Jaysh al-Ghadab similarly operates within this ecosystem, publishing claims and messaging tied to attacks and broader resistance narratives. Like Ashab al-Kahf, its content reflects a more established and consistent media presence, with recognizable visual identity and integration into a wider network of affiliated channels.

Figure 13: Jaysh al-Ghadab Telegram profile / branding insignia

While these groups exhibit more structured branding and communication styles, they operate within the same broader environment as Ashab al-Yamin. Figures 14 and 15 illustrate formalized statements published by Ashab al-Kahf and Jaysh al-Ghadab, both of which were subsequently forwarded by the Shabab al-Islam channel. This pattern highlights how official statements originating from more established actors are redistributed across affiliated channels, reinforcing shared narratives, and expanding reach.

Figures 14 & 15: PMF formal statement example

Both statements follow a consistent format typical of PMF-aligned media output, including religious framing, attribution of attacks against U.S. and Israeli interests, and references to specific operations. For example, one statement claims responsibility for a drone attack targeting Israeli-affiliated infrastructure in Jordan, while emphasizing civilian evacuation warnings and framing the operation within a broader resistance narrative. The second statement similarly adopts formalized language, invoking religious justification, and positioning the attack within the context of ongoing regional conflict. This contrast becomes more apparent when comparing how similar attack-related content appears across different channels within the network.

Figure 16: London ambulance attack claim Ashab al-Yamin TG channel

Figure 17: London ambulance attack claim: Safee al-Deen TG channel

Figures 16 and 17 show the same London ambulance attack being circulated through Ashab al-Yamin and Safee al-Deen channels, illustrating how identical content is redistributed across different nodes within the network, often with variations in framing and presentation.

These examples illustrate how similar content is circulated, reframed, and redistributed across different channels, reinforcing visibility and narrative consistency.

A Networked Playbook

The emergence of Ashab al-Yamin aligns with a broader pattern seen across similar ecosystems: the rapid creation of new identities designed to claim responsibility, amplify narratives, and generate strategic effects. Recent analysis by Militant Wire similarly suggests that the group may function less as a traditional organization and more as an “astroturfed” identity embedded within existing Iranian-aligned networks, leveraging low-cost, high-visibility activity to maximize perceived impact.

Rather than representing the development of a traditional, hierarchical organization, this model prioritizes speed, flexibility, and visibility. New entities can quickly establish a presence, insert themselves into ongoing events, and reinforce narratives already circulating across interconnected channels. As noted in reporting by CBS News, even relatively unsophisticated or ambiguous content can achieve outsized strategic effects. This aligns with analysis from the Foundation for Defense of Democracies, which notes that such models can rely on low-cost, deniable actors and coordinated messaging without requiring a formal organizational structure. Recent research by the Global Network on Extremism and Technology similarly highlights how digital actors across different ideological and operational backgrounds can converge within shared wartime ecosystems, forming loose networks that amplify common narratives and targets.

These dynamics are not limited to militant media channels. Similar patterns can be observed among pro-Iranian hacktivist groups, which use Telegram to promote alleged data breaches and advertise them on darknet marketplaces. For example, “APT Iran” has claimed to possess stolen data from Lockheed Martin, promoting it through Telegram and advertising it on a Russian-language darknet marketplace known as “Threat Market.”

The listing advertises an estimated value of approximately $374 million, with an exclusive buyout price nearing $600 million, alongside tiered pricing for partial data access. While these figures remain unverified, their scale reflects a broader pattern of inflated valuation and narrative amplification, where the perceived significance of a breach is emphasized as much as the underlying data itself.

Figures 18 & 19: APT Iran Telegram post referencing Lockheed; Lockheed leak posted on Threat Market

More recent activity suggests increasing instability and responsiveness to external pressure. Following attention surrounding the alleged Lockheed Martin leak, the actor associated with “APT Iran” appears to have changed its Telegram identity to “Brona

Blanco had begun posting images of purported source code tied to the breach. Concurrent messaging in Farsi references potential law enforcement scrutiny, including warnings about FBI targeting of infrastructure linked to Threat Market and the implementation of contingency measures such as a “dead man’s switch.”

Figure 20: APT Iran Telegram post referencing the FBI targeting Threat Market

Figure 21: APT Iran/Brona Blanco Telegram post referencing Lockheed Martin Source Code

While these claims remain unverified, this shift in tone and behavior reinforces a consistent pattern observed across these actors: rapid escalation in claims, reactive messaging driven by perceived pressure, and an emphasis on perceived impact over independently verifiable outcomes.

This same dynamic is evident in recent claims by a group calling itself “Ababil of Minab,” which has claimed responsibility for a cyber incident targeting Los Angeles Metro infrastructure. As reported by Dark Web Informer, the group used Telegram to publicize the claim, asserting large-scale data exfiltration and system disruption while providing limited verifiable evidence. While attribution remains unclear, the group’s messaging style and distribution patterns reflect characteristics observed across other Iranian-aligned or Iran-affiliated cyber personas.

Figure 22: “Ababil of Minab” Telegram posts claiming responsibility for a cyber intrusion targeting LA Metro

As with other actors in this ecosystem, the framing of the operation emphasizes scale and impact, including claims of hundreds of terabytes of data being wiped and additional sensitive data extracted. This reflects a recurring dynamic in which perceived significance is amplified through messaging rather than confirmed technical outcomes. This interpretation is consistent with emerging reporting on Iran-linked hybrid activity, where analysts have noted coordination across pro-Iranian online ecosystems and raised questions about the authenticity of some groups operating within them.

Conclusion

Harakat Ashab al-Yamin al-Islamia has emerged rapidly, but its fragmented Telegram presence, recycled media, and overlap with Iranian-aligned channels complicate its assessment as a standalone organization.

Instead, it is best understood as part of a broader ecosystem in which content is circulated, repurposed, and reinforced across multiple actors. In this environment, attribution becomes less about identifying a single origin point and more about understanding how narratives move across channels.

This model allows new entities to project visibility and claim relevance without demonstrating sustained operational capability, blurring the line between coordinated activity and opportunistic amplification.

As this ecosystem evolves, tracking how new entities emerge, gain visibility, and integrate into existing networks will remain critical to assessing how influence and perceived operational reach are constructed within these networks.

---

Keep up with the latest. Follow us on LinkedIn.

April 02, 2026

Our analyst team shares a few articles each week in our email newsletter which goes every Thursday. Make sure to register! This blog highlights those articles in order of what was the most popular in our newsletter – what our readers found the most intriguing. Stay tuned for a recap every month. We hope sharing these resources and news articles emphasizes the importance of cybersecurity and sheds light on the latest in threat intelligence.

1. Fake Google Security site uses PWA app to steal credentials, MFA codes – Bleeping Computer

Using a fake Google Account security page, a recent phishing campaign was discovered delivering a web-based app designed to steal “one-time passcodes, harvesting cryptocurrency wallet addresses, and proxying attacker traffic through victims’ browsers”. The campaign uses social engineering and Progressive Web App (PWA) features to convince users that they are interacting with a legitimate Google webpage. The threat actors use the domain (google-prism[.]com) and have users follow a four-step process that gives permissions and allows the installation of malware. Once installed the malware can exfiltrate contacts, real time GPS data, and clipboard contents. Read full article.

2. UAC-0050 Targets European Financial Institution With Spoofed Domain and RMS Malware – The Hacker News

Recent social engineering attacks targeting European financial institutions has been attributed to the Russian linked threat actor, UAC-0050 (DaVinci Group). According to researchers, the attack mimicked a Ukrainian judicial domain “to deliver an email containing a link to a remote access payload.” The attack begins with a spear-phishing email designed to look urgent and legitimate. It uses legal-themed language to pressure the recipient into acting. The email includes a link that directs the target to download a compressed file hosted on PixelDrain, a file-sharing service. If the victim opens the fake “PDF,” the malicious file runs and installs an MSI package for Remote Manipulator System (RMS). Article here.

3. Predator spyware hooks iOS SpringBoard to hide mic, camera activity – Bleeping Computer

Surveillance firm, Intellexa, utilizes a single hook function (‘HiddenDot::setupHook()’) inside Springboard that prevents sensor activity updates in IOS products. This activity had been acknowledged previously, but the way the firm carried it out was not well understood. Recent research by Jamf analyzed Predator samples and was able to document the hiding process. The malware does not exploit IOS vulnerabilities but instead leverages “previously obtained kernel-level access to hijack system indicators that would otherwise expose its surveillance operation”. This information has helped address previously existing gaps in understanding the exploitation techniques used by commercial spyware. Read more here.

4. APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2 – The Hacker News

Since 2024, Chinese aligned threat group (Silver Dragon) has been observed operating within the umbrella of APT41 and targeting organizations throughout Europe and Southeast Asia. Silver Dragon gains its initial access by exploiting public-facing internet servers and delivering phishing emails that contain malicious attachments. To maintain persistence, the group hijacks legitimate Windows services, which allows the malware processes to blend into normal system activity. The group’s operations appear to specifically target government organizations. On compromised systems, they deploy Cobalt Strike beacons to maintain persistence, along with GearDoor, a backdoor that uses Google Drive as its command-and-control (C2) channel. Read here.

6. SLH Offers $500–$1,000 Per Call to Recruit Women for IT Help Desk Vishing Attacks – The Hacker News

On February 22, 2026, Scattered Lapsus$ Hunters (SLH) posted on their Telegram Channel stating, “if you are female and want to make some money via calling for us hit up”. The group is offering women $500-$1000 per call to help desks, with a provided written script. The recruitment seems to be an effort by the group to sidestep the “traditional” attacker profiles that IT help desk staff are trained to recognize, thereby making their impersonation attempts more convincing and effective. SLH’s primary objective is to target help desks and call centers as entry points into organizations, further highlighting the intent behind their new recruitment strategy. Read full article.

7. Poland’s nuclear research centre targeted by cyberattack – Bleeping Computer

On March 12, Poland’s National Centre for Nuclear Research (NCBJ) claimed hackers had targeted their IT infrastructure but were blocked before accessing information. The organization stated that its early-detection security systems and internal procedures prevented a breach and allowed IT staff to rapidly secure the targeted systems. The attack has not been formally attributed to any group. While Polish authorities say early indicators suggest a possible connection to Iran, they warn that the evidence could represent a false-flag attempt meant to take advantage of ongoing global tensions. Read full article.

8. SloppyLemming Targets Pakistan and Bangladesh Governments Using Dual Malware Chains – The Hacker News

SloppyLemming, a threat activity cluster, has been linked to two separate attack chains that delivered malware to government agencies and critical infrastructure operators in Pakistan and Bangladesh between January 2025 and January 2026. The first attack delivered PDF lure documents to victims that once open installed his application installed a package that included a legitimate Microsoft .NET file (NGenTask.exe) and a malicious file (mscorsvc.dll). The malicious file used a technique called DLL sideloading to run. It then decrypted and launched a custom 64-bit shellcode implant. The second attack deployed Excel documents that contained malicious macros that deliver “keylogger malware”. Learn more.

---

Make sure to register for our weekly newsletter to get access to what our analysts are reading on a weekly basis.

April 01, 2026

While you’re hopefully busy avoiding all the harmless classic April Fool’s jokes, the threat actors lurking in the corners of the darknet are busy perfecting much more convincing—and dangerous—”pranks”.

Over the last few years, we’ve tracked how phishing evolved from misspelled emails to AI-generated perfection. But this year, the joke is getting even more personal.

The Evolution of the “Trick”

In our previous April Fools’ specials, we’ve explored everything from the absurdity of 24 hours on the dark web to the rise of AI-powered smishing. This year, threat actors aren’t just writing better emails—they’re stealing faces and voices. Threat actors have evolved. They’re no longer just blasting generic emails into the void—they’re refining tactics using real data, automation, and even AI-generated content to increase success rates.

The AI Factor

More and more phishing messages aren’t feeling like scams: no spelling errors, no awkward phrasing, no obvious red flags. That’s because they probably weren’t written by humans. AI is now being used to generate phishing emails, fake profiles, and even voice messages that mimic real people—making scams faster, cheaper, and more believable than ever. The old advice of “look for bad grammar” is quickly becoming outdated.

Here are the new ways threat actors are trying to “fool” you this year:

Deepfake Video Calls

Using just a few minutes of public video from LinkedIn or a recorded webinar, threat actors can now overlay a “digital mask” in real-time; this is a deepfake. Don’t be fooled into your “boss” asking for an urgent wire transfer on what seems to be a standard zoom call. Watch for unnatural blinking, “glitching” around the neck area, or a slight delay between their mouth moving and the audio.

Voice Cloning via Vishing

We’ve warned about vishing (voice phishing) before, but it has leveled up. Threat actors no longer need to “act” like your IT person. With as little as 30 seconds of audio, they can clone a specific person’s voice to leave a voicemail that is indistinguishable from the real thing. Our analysts have seen a 40% uptick in “Urgent Voicemail” scams where the actor impersonates a C-suite executive requesting a password reset “while they’re boarding a flight.”

Hyper-Personalized Social Engineering

Forget the broad survey scams and junk car emails from the past. Today’s threat actor uses AI to scrape your entire digital footprint—your recent vacation photos, your “workversary” post, and even your favorite coffee shop—to build a persona that feels like a long-lost friend. We always suggest exercising caution when sharing online. Imagine this: you return home from attending a work conference and get a message on LinkedIn: “Hey [Your Name], saw you were at the Cybersecurity Summit last week! I’m the guy who sat next to you during the AI keynote. Here’s that whitepaper we discussed.” One click, and you’ve installed a specialized infostealer.

How to be “Prank-Proof”

Spotting a digital deception requires a keen eye and a bit of healthy skepticism.

• Implement a “Safe Word”: For high-stakes financial transactions, establish an offline “challenge-response” phrase that only your team knows.
• Trust, But Verify: If your “boss” makes an unusual request via video or voice, hang up and call them back on a known, trusted number.
• Assume Nothing is Private: If it’s on the internet, a threat actor can use it to build a profile of you. Tighten those privacy settings!

Cyber threats continue to evolve—but the fundamentals still matter: enable multi-factor authentication, use strong, unique passwords, verify before you click, and stay informed.

Technology moves fast, but the goal of the threat actor remains the same: to exploit human trust. This April Fools’ Day, let’s keep the surprises limited to harmless office pranks. Stay vigilant, stay skeptical, and remember: if a request feels “off,” it probably is.

---

Follow us on LinkedIn.

March 19, 2026

Cybersecurity might as well have its own language. There are so many acronyms, terms, sayings that cybersecurity professionals and threat actors both use that unless you are deeply knowledgeable, have experience in the security field or have a keen interest, one may not know. Understanding what these acronyms and terms mean is the first step to developing a thorough understanding of cybersecurity and in turn better protecting yourself, clients, and employees. 

In this blog series, we aim to explain and simplify some of the most commonly used terms. Previously, we have covered bullet proof hosting, CVEs, APIs, brute force attacks, zero-day exploits, doxing, data harvesting, IoCs, and credential stuffing. In this edition, we dive into Ransomware as a Service.

Ransomware as a Service 101 

Ransomware has become one of the most disruptive cyber threats affecting organizations worldwide. What was once a technically complex attack carried out by a small number of sophisticated hackers has evolved into a scalable criminal ecosystem. Today, ransomware can be purchased, deployed, and monetized through a model known as Ransomware-as-a-Service (RaaS). It is a business model for cybercriminals to hire ransomware operators to launch ransomware attacks on their behalf.

DarkOwl research and analysis shows how ransomware groups operate like structured businesses on darknet forums and marketplaces—recruiting affiliates, sharing tools, and dividing profits. Understanding how this ecosystem works is critical for organizations seeking to defend against it.

RaaS is a business model in which ransomware developers create malware and infrastructure, then lease it to affiliates who carry out attacks. In turn, the developers get a percentage of the ransom earnings from the affiliates. Typically, the affiliate keeps 70-80%, while the developer takes a 20-30% “licensing fee.” This model lowers the barrier to entry and this model of cybercrime is now the driving force behind the global surge in extortion attacks. Individuals with limited technical skills can participate in ransomware campaigns simply by purchasing access to a RaaS toolkit.

Ransomware groups often operate similarly to legitimate businesses, complete with recruitment processes, internal management tools, and operational dashboards used to track victims and ransom payments. DarkOwl analysts often find “starter kits” for sale on darknet forums. These kits include everything a criminal needs: the malware, a user manual on how to infect a target, and even 24/7 technical support from the developers. It is a professionalized industry where reputation and “customer service” matter to the criminals.

Figure 1: Post on criminal market XSS offers triple extortion software for purchase; Source: DarkOwl Vision

Ransomware as a Service in the Wild

RansomHub 

The group RansomHub first appeared in February 2024, with an announcement on the Russian forum RAMP. The group operates a ransomware-as-a-service (RaaS) model, targeting multiple platforms, including Windows, Linux, and ESXi.  A user named “koley” made the announcement and invited others to join their affiliate program. RansomHub quickly became one of the most active ransomware groups, claiming 593 victims by the end of the year. RansomHub’s affiliate program has been prolific over taking established groups, such as LockBit, in the number of victims they have. Notably, RansomHub was responsible for a significant breach of the U.S. healthcare payment system in 2024. 

Hive

First observed in 2021, Hive operated as a RaaS platform with affiliates targeting organizations worldwide. The group notably targeted healthcare organizations and used double-extortion tactics—encrypting systems while also threatening to release stolen data. In 2023, an international law-enforcement operation seized Hive’s infrastructure after the group had already impacted more than 1,500 organizations globally.

Conti

Conti was one of the most prolific ransomware operations in the world. Internal chat logs leaked in 2022 revealed a highly organized operation that included employee-like roles, development pipelines, and operational dashboards used to track victims and payments. Although the group officially shut down, many of its members dispersed into other ransomware operations, continuing the ecosystem under new names.

BlackCat

Also known as ALPHV, BlackCat emerged in 2021 and quickly gained attention for being written in the Rust programming language. The group implemented a public data-leak site that indexed stolen files, increasing pressure on victims to pay ransom demands.

Protection and Mitigation

Ransomware is an efficient criminal operation yielding high profit for minimal work. Due to pseudo-anonymous technology, using the dark web for ransomware operations and cryptocurrency for payments, as well as email and VPN services that do not track physical location, ransomware groups will continue their activities because the risk of punishment is minimal, and the operations are profitable.

As always, DarkOwl recommends practicing cyber hygiene at work and home.

1. The 3-2-1 Backup Rule: Keep three copies of your data, on two different media types, with one copy stored completely offline. By using multiple storage types and locations, it helps you avoid having a single point of failure.
2. Enable Multi-Factor Authentication (MFA): Turn on MFA for every account. It adds a second proof (app prompt, code, or security key) so a stolen password alone won’t grant access.
3. Patches and Updates: Keep everything current—laptops, phones, browsers, and even routers/IoT. Updates patch known flaws attackers actively exploit. Criminals look for “holes” in outdated software.
4. Phishing Awareness & Training: Most RaaS attacks start with a simple phishing email. Slow down on links and attachments. Verify unusual requests on a separate channel and report suspicious emails/messages to IT.

Product Highlight: Ransomware API

Ransomware is not only a problem for those directly affected. Awareness of events among your own or your customers’ supplier ecosystems can help you stay aware of potential vectoring threats. The DarkOwl Ransomware API is designed to answer the essential question: Has an organization I monitor been extorted or compromised in a cybersecurity incident?

Leveraging the world’s leading and continuously updated darknet data index, you can gain insight into potential risk by conducting targeted ransomware searches. Ransomware API enables users to safely query continuously sourced and updated ransomware sites, primarily but not exclusively hosted in TOR and Telegram, run by criminal gangs, and threat actors to detect mentions of criminal activity against an organization.

Search parameters enable queries by company website, company name, contact name, or other proximity indicators such as products, brands, or other intellectual property.  Automated monitoring and alerting ensure continuous vigilance to a dynamic list of sources continually updated by DarkOwl.

---

Curious to learn more about Ransomware API? Contact us.

March 02, 2026

Our analyst team shares a few articles each week in our email newsletter which goes every Thursday. Make sure to register! This blog highlights those articles in order of what was the most popular in our newsletter – what our readers found the most intriguing. Stay tuned for a recap every month. We hope sharing these resources and news articles emphasizes the importance of cybersecurity and sheds light on the latest in threat intelligence.

1. Mandiant Finds ShinyHunters-Style Vishing Attacks Stealing MFA to Breach SaaS Platforms – The Hacker News

On January 31, Mandiant reported a newly identified expansion in threat activity involving tactics similar to those used by ShinyHunters. These attacks employ voice phishing (vishing) and credential-harvesting websites that impersonate targeted organizations, enabling attackers to obtain single sign-on (SSO) credentials and multi-factor authentication (MFA) codes to gain unauthorized access to victim environments. Mandiant’s threat intelligence team said it is monitoring the activity across several clusters, UNC6661, UNC6671, and UNC6240 (ShinyHunters), to account for the possibility that these groups are evolving their tactics or imitating previously observed methods. Read full article.

2. Hackers exploit SolarWinds WHD flaws to deploy DFIR tool in attacks – BleepingComputer

CISA flagged a critical SolarWinds Web Help Desk (WHD) vulnerability, CVE-2025-40551, that is now being exploited by unknown hackers. Using legitimate tools, such as Zoho ManageEngine, threat actors were able to target organizations and maintain persistent, hands-on access to compromised environments. Following initial access, attackers installed the Zoho ManageEngine Assist agent from an MSI hosted on the Catbox file-sharing platform, configured it for unattended access, and registered the affected host with a Zoho Assist account created using an anonymous Proton Mail address. Article here.

3. FBI seizes RAMP cybercrime forum used by ransomware gangs – BleepingComputer

On January 28, it was discovered the FBI had seized RAMP, a Russian cybercrime forum, that advertised malware and hacking services. Both the forum’s Tor site and its Clearnet domain, ramp4u[.]io, have been taken offline and now show a seizure banner declaring, “The Federal Bureau of Investigation has seized RAMP.” According to the notice, “This action has been taken in coordination with the United States Attorney’s Office for the Southern District of Florida and the Computer Crime and Intellectual Property Section of the Department of Justice,” indicating a multi-agency effort behind the takedown. RAMP administrator “Stallman” acknowledged the takedown in a message on XSS, adding that he has no plans to create a successor platform. Read more here.

4. Chinese hackers exploiting Dell zero-day flaw since mid-2024 – BleepingComputer

Chinese state hacking group, UNC6201, is believed to be behind a zero-day exploitation of  in Dell RecoverPoint for Virtual Machines, tracked as CVE-2026-22769. The high-risk vulnerability has been exploited since May 2024 and shows persistent access of the malware SLAYSTYLE and BRICKSTORM. Additionally, UNC6201 deploys a newly identified malware called Grimbolt, which leverages a technique that is faster and more difficult to analyze than BRICKSTORM. Google Threat Intelligence Group (GTIG) has not confirmed an initial access vector, but previous attacks connected to UNC6201 indicate a possible target of edge appliances for initial access. Read here.

6. One threat actor responsible for 83% of recent Ivanti RCE attacks – BleepingComputer

Recent threat intelligence observations link one threat actor to two critical vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile (EPMM). According to GreyNoise Threat Research team, between February 1st and 9th the EPMM experienced 417 observed exploitation sessions. Of those 417, 83% of observed exploitation can be tracked to a single IP address (193.24.123.42) on bulletproof infrastructure. The activity is designed to trigger a DNS callback to a unique subdomain controlled by the tester. This approach allows threat actors to confirm that their command was successfully executed without needing a direct response from the target system. Read full article.

7. Sandworm hackers linked to failed wiper attack on Poland’s energy systems – BleepingComputer

In late December 2025, the Russian state sponsored hacking groups, Sandworm, attempted to deploy a destructive “data-wiping malware” called DynoWiper against Poland’s power grid. Polish officials have claimed the attack “targeted two combined heat and power plants as well as a management system used to control electricity generated from renewable sources such as wind turbines and photovoltaic farms.” Officials also stated that their current “systems in place” were able to prevent the attack but gave minimal additional information. Read full article.

8. China-Linked Amaranth-Dragon Exploits WinRAR Flaw in Espionage Campaigns – The Hacker News

Throughout 2025, Amaranth-Dragon, a China-linked threat actor has been connected with new cyber espionage campaigns targeting government and law enforcement in Southeast Asia. Threat actors abused a now-patched security vulnerability (CVE-2025-8088) in RARLAB WinRAR, which permits arbitrary code execution upon opening a specially crafted archive.  Although the exact method of initial access is still unclear, the highly targeted nature of the campaigns and the use of customized lures tied to regional political, economic, or military events strongly suggest spear-phishing. In these attacks, emails likely delivered archive files hosted on trusted cloud services such as Dropbox, helping attackers appear legitimate and evade traditional perimeter defenses. Learn more.

---

Make sure to register for our weekly newsletter to get access to what our analysts are reading on a weekly basis.

February 18, 2026

In an era of data breaches and constant headlines focused on “security” topics, “security” has become a catch-all term. While the terms cyber security and information security are often used interchangeably, it is important to acknowledge that they focus on different areas – they are related, but their scope differs. In this blog, we will explore how they differ in scope, focus, and application.

Information Security Vs Cybersecurity

To start, information security (infosec) can be thought of as an umbrella term, while cybersecurity is a specialization underneath that umbrella. Using the terms interchangeably can lead to gaps in your defense strategy as cyber security focuses on the digital realm, while information security protects data in all forms.

Information Security

Information Security is the broad practice of protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction. This includes both data in the digital realm, as well as physical data (think of a file on your computer and a file in your filing cabinet). The goal of information security is to protect the CIA Triad (note that since cybersecurity is a subset of information security, these goals align to cybersecurity as well – the scope is just more specific). The CIA Triad stands for confidentiality, integrity, and availability:

• Confidentiality: is your sensitive information only accessible to those authorized to see it?
  • Common Threats: phishing, man in the middle attacks, human error
• Integrity: is your data authentic, accurate, and reliable?
  • Common Threats: man in the middle attacks, human error, malware, hardware/software glitches
• Availability: are the systems, networks, and data up and running whenever authorized users need them?
  • Common Threats: distributed denial of service attacks, hardware failure, ransomware, natural disaster

Examples of information security would be the practice of shredding sensitive paper documents, office keycard systems, and encryption policies. Threats against strong information security include theft, natural disasters, and physical breaches.

Cybersecurity

Cybersecurity is the practice of defending computers, servers, mobile devices, electronic systems, networks, and data from malicious digital attacks. If it involves the internet or a digital network, it’s cybersecurity. In the example above, cybersecurity is the data in the digital realm – a file on your computer (and the systems, networks, and hardware that house it). The goal in cybersecurity is to protect against cyber attacks – hacking, malware, phishing – to name a few. Examples of cybersecurity would be firewalls, antivirus software, and securing “Internet of Things” (IoT) devices. Threats against secure cybersecurity include cyber warfare, hacking, and data breaches.

How They Work Together

Security is a holistic culture, not just a software update. Information security and cybersecurity work together in creating overlapping layers of defense. You cannot have a robust security policy without incorporating both: the physical and digital layers of defense and policies covering both.

For example, infosec would set the overall policy of protecting and encrypting data (business level decision based on risk), while the cybersecurity division would implement the tech to do so (firewalls, encryption, multi-factor authentication, etc). In a situation where a breach or attack does happen, the two have distinct roles but cannot be successful without the other:

• Information Security
  • Determines the data that was stolen
  • Manages the legal and regulatory fallout (GDPR/HIPAA notifications)
  • Initiates the Business Continuity Plan to ensure the company stays operational during the cleanup
• Cyber Security
  • Identifies the threat details
  • Isolates the issue and stops it from continuing
  • Patches the vulnerability that the hacker used

In short, cybersecurity handles the threats (hackers, viruses, bots) while information security handles the risks (legal compliance, physical safety, data integrity).

Best Practices

With so many of us working from home, it is important to practice good daily security hygiene to make sure that not only the digital data of your company is safe, but potential physical risks are minimized as well. Below is a checklist covering the digital and physical bases to ensure your data stays private and your hardware stays safe:

Digital Checklist (Cybersecurity):

Protect your devices and network from remote attacks.

• Secure the Router:
  • Change the default admin password
  • Enable WPA3 (or WPA2-AES) encryption
  • Turn off WPS (Wi-Fi Protected Setup
• Segment Your Wi-Fi:
  • Set up a “Guest Network” specifically for your work laptop
    • This keeps your work data separate from “unsecure” items like an Amazon Alexa or gaming console
• Enable MFA/2FA:
  • Use an authenticator app (like Google Authenticator or Authy) on every account
• Automate Updates:
  • Set your OS (Operating System) and browser to “Auto-Update” so you get security patches immediately
• VPN for Public Use:
  • Use a reputable VPN to create an encrypted “tunnel” for your data

InfoSec Checklist:

Protect the physical environment and the data itself.

• Full Disk Encryption:
  • Ensure BitLocker (Windows) or FileVault (Mac) is on
• The “Clear Desk” Policy:
  • Don’t leave passwords on sticky notes
  • Shred any documents containing client names, addresses, or account numbers before throwing them away
• Visual Privacy:
  • Use a privacy screen filter on your monitor
• Secure Backup (3-2-1 Rule):
  • Keep 3 copies of your data:
    • 2 different types of media (laptop and an external drive)
    • 1 copy stored off-site (encrypted cloud storage like Backblaze or iCloud)
• Webcam Cover:
  • Have a physical slide cover for your camera is the only 100% guarantee against “cam-fecting”
• Lock your computer when you step away

---

February 02, 2026

Our analyst team shares a few articles each week in our email newsletter which goes every Thursday. Make sure to register! This blog highlights those articles in order of what was the most popular in our newsletter – what our readers found the most intriguing. Stay tuned for a recap every month. We hope sharing these resources and news articles emphasizes the importance of cybersecurity and sheds light on the latest in threat intelligence.

1. ‘Bad actor’ hijacks Apex Legends characters in live matches – BleepingComputer

Over the weekend of January 09, players in Apex Legends, a battle royale shooter game, reported game disruptions caused by threat actors hijacking characters, disconnecting users, and changing nicknames. Respawn, the publisher of the game, confirmed the security incident claiming “bad actor is able to control the inputs of another player remotely in Apex Legends”. The company does not believe threat actors were able to exploit or infect malware, nor execute code. Read full article.

2. 27 Malicious npm Packages Used as Phishing Infrastructure to Steal Login Credentials – The Hacker News

On December 23, 2025 the Socket Threat Research Team announced the discovery of a 5 month long spear-phishing operation that turned 27 npm packages “into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in”. The campaign targeted 25 organizations across the U.S. and Allied nations focusing on manufacturing, industrial automation, plastics, and healthcare. Specializing in focusing on sales and commercial personnel, the operation repurposed npm and package CDN’s “into durable hosting infrastructure, delivering client-side HTML and JavaScript lures that the threat actor embeds directly in phishing pages.” Following initial interaction, the script redirects the browser to threat-actor controlled infrastructure. Article here.

3. Hackers Use LinkedIn Messages to Spread RAT Malware Through DLL Sideloading – The Hacker News

ReliaQuest’s Threat Research team has discovered a new phishing campaign using private messages to deliver malicious payloads with the intent to deploy remote access trojan (RAT). The attack began with a message sent via LinkedIn that contained a “malicious WinRAR self-extracting archive”. Once opened, the archive extracts four components, mainly a PDF disguised with names that align with the victim’s industry. The final payload attempts to communicate with an external server that can grant persistent remote access. Read more here.

4. Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware – The Hacker News

Recent activity shows Chinese threat actor, Silver Fox, has begun using income tax themed lures to distribute ValleyRAT. The group has focused on Indian entities, using phishing emails containing decoy PDFs claiming to be from India’s Income Tax Department. Opening the attachment leads victims to download files that injects ValleyRAT into the system and communicates with external servers. Read here.

6. North Korea-Linked Hackers Target Developers via Malicious VS Code Projects – The Hacker News

The Contagious Interview campaign, which has been linked to North Korean threat actors, has been observed leveraging a version of Microsoft Visual Studio Code (VS Code) to deploy a backdoor on compromised systems. First discovered in December 2025, the attack involves instructing targets to clone a repository “on GitHub, GitLab, or Bitbucket, and launch the project in VS Code as part of a supposed job assessment.” The overall goal is for payload to run every time a file in the folder is opened, which eventually leads to deployment of malwares like, BeaverTail and InvisibleFerret. Read full article.

7. Hackers claim to hack Resecurity, firm says it was a honeypot – BleepingComputer

Scattered Lapsus$ Hunters (SLH) announced via Telegram that they had breached systems belonging to Resecurity and stole internal data. To prove their claims SLH posted screenshots of the data which revealed communications between employees and Pastebin personnel. Resecurity published a report in December 2025 disputing the claims and stated after identifying threat actor probing activity in November 2025, they deployed a “honeypot” account. The account was in an isolated environment that contained fake information and was being monitored. Read full article.

8. China-linked hackers exploited Sitecore zero-day for initial access – BleepingComputer

The China-linked threat actor UAT-8837 has been observed attempting to compromise North American infrastructure by exploiting both known and zero-day vulnerabilities. The attacks begin with leveraging compromised credentials or by exploiting server vulnerabilities. Recent attacks include zero-day flaw in Sitecore products, CVE-2025-53690. Researchers claim UAT-8837 uses “open-source and living-off-the-land utilities, continually cycling variants to evade detection.” Learn more.

---

Make sure to register for our weekly newsletter to get access to what our analysts are reading on a weekly basis.