At a Glance Malware Family Doorway botnet (modular Rust scanning and delivery engine with staged loaders) Threat Actor Unattributed operator group known internally as "the team" (suspected commercial proxy network builder) Target / Victims Routers, IP cameras, digital video recorders, optical network terminals, and enterprise Java servers (4,217 logged IPs and 1,772 mapped victim devices across 75+ territories) Delivery Vector…

CloudSEK analyzed exposed Doorway workspaces, finding a Rust exploitation engine, staged loaders and evidence of compromised devices and Java services. The…

Les chercheurs de CloudSEK ont découvert une campagne de cyberattaques baptisée Doorway, visant des routeurs, des caméras de surveillance et des serveurs d'entreprise.

Les chercheurs de CloudSEK ont découvert une campagne de cyberattaques baptisée Doorway, visant des routeurs, des caméras de surveillance et des serveurs d'entreprise.

CloudSek traces MR ROBOT, an Android MaaS operation targeting Indian bank customers, and details its custom trojans, SMS/OTP and credential theft, silent…

Undercode Cybersecurity Intelligence | October 29, 2026 Introduction: When Legitimate Software Becomes a Threat Cybersecurity researchers at CloudSEK have linked a suspicious campaign involving fake document-review websites to genuine, digitally signed ScreenConnect installers configured to connect to unauthorized remote-access tenants. The operation reportedly combines deceptive web pages, visitor profiling, and Telegram-based data transmission to support a potentially malicious remote-access workflow.

Cybercriminals are using fake Adobe Acrobat and document-signing pages to distribute legitimate ConnectWise ScreenConnect remote-access software, potentially giving external operators persistent access to Windows systems. A new CloudSEK investigation reveals how trusted, digitally signed software is being used with unauthorized remote-access configurations, creating risks that conventional file-signature checks alone may not detect. Key findings: Legitimate software abused: Two genuine, digitally signed ScreenConnect installers were identified with configurations pointing to separate remote-access tenants.

Cet article présente une analyse technique détaillée des opérations du groupe cybercriminel GOLD OGRE, opérateur du ransomware Aur0ra (aussi connu sous le nom Aurora ransomware). L'analyse s'appuie sur des investigations menées depuis mai 2026 et est complétée par des rapports tiers de Gambit Security et CloudSEK.

A New Malware-as-a-Service Operation Targets Indian Bank Customers A newly discovered Android malware-as-a-service (MaaS) operation is enabling cybercriminals to steal banking credentials, intercept one-time passwords (OTPs), and redirect victims’ phone calls. The operation, known as MR ROBOT, has already been linked to thousands of intercepted text messages from hundreds of infected Android devices. In research published on October 28, 2026, cybersecurity threat intelligence firm CloudSEK detailed how the criminal operation packages Android banking trojans into a subscription-based service.

CloudSEK identified a Microsoft 365 phishing operation targeting organizations in more than 40 countries. An infrastructure analysis linked its indicators to…

A Widespread Phishing Campaign Raises Fresh Concerns About Enterprise Identity Security Introduction: A Global Threat to Microsoft 365 Users A phishing operation targeting Microsoft 365 users across more than 40 countries has been identified by cybersecurity researchers at CloudSEK, highlighting the continuing threat posed by credential theft and malicious online infrastructure. According to a report shared by Cybersecurity News Everyday on October 20, 2026, researchers analyzed indicators associated with the campaign and linked them to additional domains and IP addresses. The investigation suggests that the operation may involve a broader network of internet infrastructure than initially identified.

CloudSEK found seven npm (Node Package Manager) packages, posing as an AI toolkit, that were built to quietly install a remote-access trojan on Windows machines, and two were still downloadable days a...

CloudSEK researchers have uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. The packages deploy a modified Windows remote-access trojan (RAT) capable of stealthy surveillance and remote control. More concerningly, two malicious packages remained downloadable on npm as of October 8, despite being flagged as malicious. Key findings: 7 malicious packages, 4 publisher accounts:

Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have

Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have

Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have

Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have

Fascinating look by CloudSEK researchers at Azazel, a Russian-speaking affiliate of the Gentlemen ransomware group 👇 Azazel "simultaneously robbed his victims, betrayed his own RaaS operator, and l...