Loading story…
The provided items do not converge on a single cybersecurity incident, vulnerability disclosure, or coordinated threat campaign; instead they span a ransomware claim (Qilin alleging access to Malaysia Airlines without evidence), a ransomware malware profile (CYFIRMA’s write-up of Ripper ransomware and its behaviors like .ripper12 file extension and READ_NOTE.html), and multiple policy/industry pieces (US legal action against malware/spyware sellers, US tech/cyber bills, and interviews/op-eds on AI, app security, and higher-education risk). Several entries are also roundups or conference/event coverage (Help Net Security “week in review,” JPCERT’s JSAC day-2 recap, and a DEF CON-related interview), which are informative but not tied to one specific operational event.
As a result, this set should be treated as low-cohesion for incident-driven alerting: the only concrete, potentially actionable security events are (1) Qilin’s unsubstantiated listing of Malaysia Airlines (with the possibility of later data-leak proof) and (2) the technical indicators described for Ripper ransomware (encryption behavior, extension, and ransom note filename). The remaining references are primarily general commentary, interviews, policy updates, or training-style content (e.g., CISSP IAM playbook, IoT “vulnerabilities” advice article, OSINT profile), and do not provide corroboration or additional detail on the Malaysia Airlines claim or the Ripper ransomware activity.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
On February 22, 2026, the Qilin ransomware gang listed Malaysia Airlines as a claimed victim on its leak site. No breach details or proof-of-data samples were provided, so the claim remained unverified.
By January 9, 2026, CYFIRMA had reported discovery of the Ripper ransomware targeting Windows systems. The analysis detailed its RSA/AES encryption, .ripper12 extension, ransom note behavior, persistence mechanisms, shadow copy deletion, and related detection content including a Sigma rule.
CYFIRMA reported a critical remote code execution vulnerability, tracked as CVE-2025-54322, affecting Xspeeder SXZOS firmware. The report highlights it as a notable development in the weekly threat landscape.
Since mid-2025, the Kimwolf operation has rapidly expanded by compromising millions of low-cost Android TV and streaming devices. The botnet abuses exposed unauthenticated ADB access and residential proxy monetization schemes.
In March 2025, Qilin reportedly attacked Kuala Lumpur International Airport, causing significant disruptions to digital infrastructure. The incident is referenced as part of a broader pattern of ransomware activity in Malaysia's aviation sector.
In 2022, the Daixin Team compromised AirAsia Group and stole data involving nearly 5 million passengers and employees. The incident is cited as prior ransomware-related activity affecting Malaysia's aviation sector.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
No single cybersecurity event or topic coherently links the provided items; the set mixes unrelated **malware/campaign reporting** (e.g., *Steaelite* RAT MaaS capabilities; a fake Google security-check PWA leading to browser/Android surveillance; **Velvet Tempest**-linked ClickFix activity associated with *Termite* ransomware; the **SeaFlower** backdoored Web3-wallet campaign; and **ResidentBat** Android spyware attributed to the Belarusian KGB) with **healthcare breach notifications/settlements** (multiple provider incidents and a DragonForce-related settlement) and **policy/legal/governance** coverage (US healthcare cyber reform legislation; UK Court of Appeal ruling on “personal data”; South Korea considering cyber/data law updates). Several entries are primarily **opinion, interviews, newsletters, podcasts, or generic guidance** (agentic AI “hype vs reality,” AI for incident response, board metrics/risk signals, IAM exam playbook, dark web monitoring advice, crypto safety tips, and conference/podcast promos), which do not describe a specific incident and should be treated as low-signal for incident-driven intelligence. For operational relevance, the incident-focused items provide discrete, unconnected takeaways: *Steaelite* is described as an “all-in-one” Windows 10/11 RAT with credential theft, RCE, file management, and ransomware/DDoS-style modules managed via a web panel; Malwarebytes details a social-engineering flow impersonating Google that abuses PWA behavior and browser APIs (notifications, contacts, GPS, clipboard) and can drop an Android companion implant; Deception.Pro logs a ClickFix-to-LOLBins chain (e.g., `curl.exe`, `tar.exe`, PowerShell) with observed C2 and hands-on-keyboard AD discovery leading toward ransomware activity; Confiant-reported **SeaFlower** uses trojanized clones of major crypto wallets to steal seed phrases; Censys documents **ResidentBat** infrastructure fingerprints and notes physical/ADB sideloading as the installation method. Separately, HIPAA Journal items cover multiple healthcare entities disclosing unauthorized access/exfiltration and a class-action settlement tied to a prior DragonForce ransomware incident, while government/legal pieces address sector-wide reforms and evolving interpretations of data-protection duties rather than a single breach.
Jun 29, 2026
The provided items do not describe a single cohesive cybersecurity event; they span multiple unrelated threat reports and opinion pieces. Notable incident-level reporting includes **APT28** activity in Western/Central Europe (“Operation MacroMaze”) using spear-phishing lures with Office macros that beacon via `INCLUDEPICTURE` to `webhook[.]site` and then execute VBScript/CMD/batch stages for persistence and follow-on payload delivery. Separately, **MuddyWater** (Iran/MOIS-linked) was reported running “Operation Olalampo” against organizations in the Middle East and Africa, delivering new custom malware (including a **Char** backdoor using a **Telegram bot** for C2) and, in some cases, attempting exploitation of public-facing servers in addition to phishing. Criminal activity and initial-access tradecraft were also covered across distinct stories: a DFIR case study described exploitation of **Apache ActiveMQ** `CVE-2023-46604` to gain RCE, conduct post-exploitation (Metasploit/Meterpreter, privilege escalation, LSASS access, lateral movement), and ultimately deploy **LockBit**-branded ransomware via RDP using previously stolen credentials (with indications the payload was built using the leaked builder and used *Session* for communications). Multiple reports described malware delivery via compromised web assets and social engineering, including **GrayCharlie** injecting malicious JavaScript into WordPress sites to push **NetSupport RAT**, **Stealc**, and **SectopRAT** via fake updates/ClickFix-style CAPTCHAs, and a separate **ClickFix** campaign delivering a custom C++ RAT (**MIMICRAT**) through fake Cloudflare verification prompts that trick users into running PowerShell. Additional, unrelated threat reporting included a **NuGet** supply-chain attack (typosquatted `NCryptYo` plus companion packages) targeting ASP.NET Identity data and enabling backdoored authorization rules, and malicious Chrome extensions using a “**Promise Bomb**” browser-crash technique to drive users to run fake “CrashFix” PowerShell steps. Several other items were generic commentary/roundups (data breach trends, quantum preparedness, Enigma history, NATO public opinion polling, recon how-to, and a malware-newsletter link list) and do not add event-specific intelligence.
Jun 29, 2026
The referenced items are **weekly newsletter/roundup posts** that aggregate multiple, unrelated cybersecurity developments rather than reporting a single discrete incident. They highlight a mix of **data breaches**, **ransomware**, **active exploitation and KEV additions**, and **malware campaigns**—including mentions of BeyondTrust RS/PRA vulnerabilities (including `CVE-2026-1731`) being exploited, CISA adding various flaws to the **Known Exploited Vulnerabilities (KEV)** catalog, and ongoing malware activity such as **LummaStealer**, **NetSupport RAT** targeting, and Linux botnet activity (e.g., **SSHStalker**). Separately, the roundup coverage also includes public-sector and critical-service disruptions and regulatory action: a reported cyberattack on the **European Commission’s mobile device management (MDM)** environment with potential exposure of staff contact details, a **ransomware** incident disrupting Senegal’s national identity services, and an Australian court penalty against **FIIG Securities** tied to inadequate cybersecurity controls following a prior ransomware breach and data exposure. Overall, the content is best treated as situational awareness across many stories, not as a cohesive incident requiring a single-issue response plan.
Jun 29, 2026