MITRE releases ATT&CK v20 with AI abuse, MFA bypass, water utility techniques
MITRE says the update broadens coverage of recent adversary activity and tradecraft.
Threat Actors
threat actor APT nation-state espionage campaign botnet infrastructure C2 hosting
-
-
BeyondTrust suspects Armory Castle uses AI to model target products for exploit development
Armory Castle began exploiting BeyondTrust zero-day CVE-2026-102764 on August 29, 2026.
-
ConnectWise suspends Cloud Backup after Microsoft 365 tenant compromise
ConnectWise disabled seven compromised application identities after attackers used them to authenticate across 173 Microsoft 365 tenants.
-
Attackers exploit Discord and Ngrok for CikaBika Bot command‑and‑control
Darktrace notes the malware collects system data, captures screenshots, and the PowerShell script attempts to copy the Rust DLL into Microsoft Edge's installation folder and rename it dbghelp.dll.
-
Researchers detail how imgdecode npm package hides Windows shellcode
The MALFEX campaign has used the package to deliver a loader that downloads encrypted shellcode from GitHub on Windows systems.
-
Hackers used compromised ConnectWise credential to sign in to 173 Microsoft 365 tenants
Huntress reported that attackers used the credential to get Microsoft Graph tokens from IP address 144.172.64.128 on October 15, 2026 between 06:13 and 08:34 UTC.
-
Armory Castle escalates BeyondTrust zero-day exploitation with credential theft and lateral movement
Google warns of continued targeting of edge devices as the group deploys webshells, backdoors and SOCKS5 tunneling after patch release
-
Israeli ad-tech firm used targeted ads to deliver Candiru spyware without user interaction
Citizen Lab confirms AdFection as the first zero-click spyware delivery method via ads, linked to 45 infected Al Jazeera devices between 2024 and 2025
-
China-linked Armory Castle hijacks BeyondTrust Remote Support Servers via zero-day since August
The espionage group exploited CVE-2026-102764 to deploy custom malware, harvest credentials, and evade detection across enterprise networks, researchers say
-
OpenAI warns employees foreign agents could use sex to steal AI secrets
Abdulrahman Alfozan, a 35‑year‑old Saudi engineer at OpenAI, was arrested last Friday on charges of intercepting communications after a hidden recording device was found in a San Francisco conference room
-
Unit 42 details AI‑powered espionage campaign targeting Linux government servers
The operation, designated CL‑UNK‑1211, occurred between October 2025 and April 2026 and involved AI‑created payloads that held conversational comments and reasoning notes, showing LLM‑assisted code generation.
-
Cisco Talos links Kazakhstan-nexus UAT-6275 to CIS water, energy targets
It focuses on water protection, resource handling, and energy systems across the CIS.