Gentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live Cyberattacks
A Russian-speaking Gentlemen ransomware affiliate used the Model Context Protocol (MCP) to execute commands during live intrusions, turning an AI coding assi...
NSO
Unknown
auto-detected
AI Intelligence Brief cached
Edit Profile
Entity Relationships
Related YARA Rules View all on YARA Rules page →
90-Day Activity
All Articles (419)
Last 90 Days
All Time
OT Attacks on US Critical Infrastructure Could Disrupt Military Operations and Physical Processes
US critical infrastructure faces an operational technology threat that extends beyond civilian service outages. State-sponsored intrusions and direct attacks...
Johnson Controls EasyIO FG
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device. The following vers...
Former Employee Sentenced for Damaging Employer’s Windows Network Infrastructure
A former infrastructure engineer has been sentenced to 32 months in federal prison for damaging his employer’s computer network and demanding a ransom in Bit...
Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds
An affiliate of The Gentlemen RaaS group ran a parallel leak site during extortion of two dozen victims
University of Illinois Chicago College of Medicine systems impacted by ransomware attack
The University of Illinois Chicago (UIC) recently experienced a ransomware attack that disrupted access to certain systems within its College of Medicine, le...
University of Illinois Chicago affected by ransomware attack on medical school
A ransomware attack that affected the University of Illinois Chicago (UIC) College of Medicine resulted in the theft of some information from its servers.
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
A blank field. A public repo.
12 Best ITDR Tools Compared (2026): Features & Pricing
Microsoft Defender for Identity is the best ITDR solutions starting point for most estates often already licensed while CrowdStrike leads platform-consolidat...
Another OpenAI Safety Expert Quits and Raises New AI Safety Concerns
OpenAI safety veteran David Robinson resigns, warning that the company’s culture and fast AI development model could create bigger risks. OpenAI safety veter...
Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure
Warlock ransomware continues to exploit unpatched SharePoint flaws to breach water utilities, telecoms, governments, and universities worldwide. Warlock rans...
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in a...
N0n ransomware: what you need to know
N0n is a newly-emerged cyber extortion gang. The group was first spotted in the middle of September 2026, and within days it had published on its dark web le...
Warlock ransomware breach SharePoint in water, telecom operator attacks
The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint...
Mississippi mayor says ransomware incident led city to shut down systems
Government services were temporarily disrupted by ransomware in Vicksburg, Mississippi. Mayor Willis Thompson said the FBI and other authorities are investig...
'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries
The group is exploiting a variety of vulnerabilities impacting Microsoft SharePoint, according to a new report from Symantec Threat Hunter Team.
Sony PS5 Relapse Jailbreak Exploit Uses JSC Memory Corruption and Kernel UAF
A newly released PlayStation 5 jailbreak chain, called Relapse, targets PS5 and PS5 Pro consoles running firmware versions 7.00 through 13.
Police Target KillSec Ransomware Group with Arrests and Seizures
Investigators have disrupted the operations of ransomware group KillSec and arrested several key suspects
16-Year-Old Suspected KillSec Ransomware Leader Arrested in International Operation
International law enforcement authorities have arrested three suspects linked to the KillSec ransomware group, including a 16-year-old who is alleged to be t...
Teenager arrested in Spain suspected of leading KillSec ransomware group
Spanish police have arrested a 16-year-old suspected of leading the KillSec ransomware group, which is accused of stealing data and threatening to publish it...