Resultados

2 casos · pág. 1/1

securelist.com · há 1d high

Toy Ghouls deploys custom backdoors using HiveMQ MQTT and Element/Matrix as C2 against Russian organizations

Toy Ghouls (aka Bearlyfy, Laboo.boo, Feral Wolf), a financially motivated group targeting Russian organizations since 2025, was observed in early July 2026 using a custom backdoor for the first time. Kaspersky GERT identified two versions, mqtt-bird-agent 0.1.0 (C2 over the public HiveMQ MQTT broker) and matrix-bird-agent 0.1.0 (C2 over a…

Toy Ghouls Bearlyfy

cisa.gov · há 12h high

CISA and partners publish #StopRansomware advisory on SafePay ransomware: 600+ victims, VPN and edge-device exploitation

A joint StopRansomware advisory (AA26-293A) from the FBI, CISA, USSS, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit details SafePay ransomware activity observed through August 2026. SafePay has been highly active since August 2024 and was among the most active …

CVE-2020-3259 CVE-2023-20269 CVE-2023-27532 SafePay critical infrastructure government