TL;DR Security researchers uncovered an active espionage campaign led by the UAT-6275 threat actor against government agencies across the Commonwealth of Independent States (CIS). Between June 2025 and August 2026, the group deployed four distinct infection chains, including a WinRAR vulnerability exploit. Moreover, operational security mistakes exposed the group's staging servers and GitHub repositories to investigators. What Happened in the Campaigns…

The article explains that ransomware defense is most effective before encryption, when defenders can detect exposed credentials, malicious infrastructure, and attacker behavior earlier in the attack lifecycle. It also shows how Recorded Future uses threat intelligence, the Intelligence Graph, and workflow integrations to help organizations prioritize relevant ransomware threats and disrupt them sooner. #RecordedFuture #IntelligenceGraph #RaaS

At a glance Actor or group: Tajin Group (suspected Chinese-speaking cybercriminal syndicate) Activity type: Phishing, payment card theft, and money laundering Targets or victims: Mainland Chinese citizens, global banks, and cryptocurrency exchanges Scale: Claimed 208,848 USDT marketplace deposit; processing up to $7,382 per unauthorized withdrawal Jurisdiction or law-enforcement status: Active threat group operating on sanctioned platforms (Xinbi Guarantee recently disrupted by the U.S.

BIRN has identified Andreas Maul, a town councillor for Germany’s far-right AfD party, as the man behind a Serbian company sanctioned by the US for aiding a Russian alleged cybercrime service provider...