安全情报 CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure 📡 Palo Alto Unit42 · 2026-06-25 CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure Menu Tools ATOMs Security Consulting About Us Under Attack? Threat Research Center Threat Research Malware Malware CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure 10 min read Related Products Advanced
安全情报 Threat Brief: Mitigating Large-Scale Credential Attacks 📡 Palo Alto Unit42 · 2026-06-26 Threat Brief: Mitigating Large-Scale Credential Attacks Threat Brief: Mitigating Large-Scale Credential Attacks Menu Tools ATOMs Security Consulting About Us Under Attack? Threat Research Center High Profile Threats General General Threat Brief: Mitigating Large-Scale Credential Attacks 5 min read Related Products Next-Generation Firewall Unit 42 Incident Response
安全情报 Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector 📡 Palo Alto Unit42 · 2026-07-01 Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector Menu Tools ATOMs Security Consulting About Us Under Attack? Threat Research Center Threat Research Malware Malware Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector
安全情报 How We Added WebAuthn to a Browser-Based RDP Client 📡 Palo Alto Unit42 · 2026-07-02 How We Added WebAuthn to a Browser-Based RDP Client How We Added WebAuthn to a Browser-Based RDP Client Menu Tools ATOMs Security Consulting About Us Under Attack? Threat Research Center Insights General General How We Added WebAuthn to a Browser-Based RDP Client 8 min read Related
安全情报 A VBScript campaign distributed through WhatsApp deploying RMM software 📡 Kaspersky Securelist · 2026-06-22 A VBScript campaign distributed through WhatsApp deploying RMM software An unknown actor distributes malicious VBS scripts via WhatsApp | Securelist Solutions for: Home Products Small Business 1-50 employees Medium Business 51-999 employees Enterprise 1000+ employees by Kaspersky CompanyAccount Get In Touch Dark mode off English Russian Spanish Brazil
安全情报 StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader 📡 Kaspersky Securelist · 2026-06-24 StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader StrikeShark: a new campaign involving a custom SharkLoader and Cobalt Strike Beacon | Securelist Solutions for: Home Products Small Business 1-50 employees Medium Business 51-999 employees Enterprise 1000+ employees by Kaspersky CompanyAccount Get In Touch Dark mode off
安全情报 Inside the 2026 SMB threat landscape: From phishing and scams to fake AI tools 📡 Kaspersky Securelist · 2026-06-25 Inside the 2026 SMB threat landscape: From phishing and scams to fake AI tools Threat landscape for SMBs in 2026: fake AI tools, phishing and more | Securelist Solutions for: Home Products Small Business 1-50 employees Medium Business 51-999 employees Enterprise 1000+ employees by Kaspersky CompanyAccount Get In
安全情报 Beware of the license manager: how a Schneider Electric software vulnerability puts industrial facilities at risk 📡 Kaspersky Securelist · 2026-06-26 Beware of the license manager: how a Schneider Electric software vulnerability puts industrial facilities at risk CVE-2024-2658 vulnerability in Schneider Electric software: risks to industrial control systems | Securelist Solutions for: Home Products Small Business 1-50 employees Medium Business 51-999 employees Enterprise 1000+ employees by Kaspersky CompanyAccount Get
安全情报 📊 2026-07-07 漏洞情报日报 · 200 条 · 高危 97 每日漏洞情报汇总 · 2026-07-07 📊 2026-07-07 漏洞情报日报 📋 共 200 条 🔥 高危/严重 97 条 💣 Exploit-DB-RSS 7 条 🐙 GitHub-Advisory 50 条 🔥25 🛡️ NVD-Latest 72 条 🔥72 ⚔️ Sploitus 71 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-53486 (Critical)：影响 Decompress 库（Tar/Zip 等多种格式）。漏洞存在于解压写入文件逻辑中，构造的恶意压缩包可导致目录穿越，实现越界写入或读取任意文件。 * CVE-2026-54769、CVE-2026-55615、CVE-2026-54760 (Critical)：影响 Langroid 框架。SQLChatAgent 与 Neo4jChatAgent 因正则绕过或无验证执行，导致
APT情报 装甲狼人APT组织利用AI生成载荷，BusySnake窃密木马瞄准全球政府与能源 卡巴斯基发现Armored Likho（装甲狼人）APT组织使用AI生成载荷和BusySnake窃密木马，针对俄罗斯、巴西、哈萨克斯坦政府及电力行业。该攻击链利用GitHub托管恶意模块，通过NSIS自解压和LNK文件实现初始感染，最终窃取浏览器凭证并建立反向SSH隧道。本文深度分析攻击手法、IOC及缓解措施。
APT情报 AI幻觉域名成供应链攻击新向量：幽灵抢注技术深度分析 Palo Alto Unit 42揭示AI幻觉域名（Phantom Squatting）成为软件供应链攻击新向量。攻击者利用LLM生成不存在的域名并预注册，拦截AI系统流量。研究发现超过13,000个恶意域名和25万个未注册幻觉域名，攻击链包括发现、注册、诱捕和绕过四个阶段。企业需强化AI输出验证和实时防御。
漏洞分析 Exploit for CVE-2026-10104 exploit CVE-2026-10104是WordPress插件的经过身份验证存储型XSS漏洞。Product Video Gallery for Woocommerce ≤1.5.1.8受影响，攻击者可注入恶意脚本，劫持会话或提升权限。立即升级版本或实施输入输出过滤可防御。
漏洞分析 Exploit for CVE-2025-59382 exploit CVE-2025-59382 是QNAP QTS/QuTS hero密码重置功能中的严重URL注入漏洞，CVSS评分9.8。远程攻击者无需认证即可重置管理员密码，导致设备完全沦陷。本文提供详细技术分析、攻击场景、检测方法与修复建议，帮助QNAP用户及时防御账户接管攻击。
漏洞分析 Exploit for CVE-2026-39047 exploit CVE-2026-39047 是影响 EPSON L14150 打印机的高危栈缓冲区溢出漏洞，CVSS 7.5。攻击者可通过 TCP 9100 端口发送特制 RAW 打印数据包，实现远程代码执行。本文分析漏洞成因、攻击场景与修复建议，帮助用户防御该威胁。
安全情报 The Gentlemen are knocking: сustom backdoors and evolving tactics 📡 Kaspersky Securelist · 2026-06-29 The Gentlemen are knocking: сustom backdoors and evolving tactics The Gentlemen RaaS: rapid growth and a new ransomware variant | Securelist Solutions for: Home Products Small Business 1-50 employees Medium Business 51-999 employees Enterprise 1000+ employees by Kaspersky CompanyAccount Get In Touch Dark mode off English Russian Spanish
安全情报 ToddyCat: your hidden email assistant. Part 2 📡 Kaspersky Securelist · 2026-06-30 ToddyCat: your hidden email assistant. Part 2 How the ToddyCat APT group gains access to Gmail accounts | Securelist Solutions for: Home Products Small Business 1-50 employees Medium Business 51-999 employees Enterprise 1000+ employees by Kaspersky CompanyAccount Get In Touch Dark mode off English Russian Spanish Brazil Solutions
安全情报 OpenClaw: risks for the users and how to mitigate them 📡 Kaspersky Securelist · 2026-07-01 OpenClaw: risks for the users and how to mitigate them Security risks for OpenClaw users and how to mitigate these risks | Securelist Solutions for: Home Products Small Business 1-50 employees Medium Business 51-999 employees Enterprise 1000+ employees by Kaspersky CompanyAccount Get In Touch Dark mode off English
安全情报 The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign 📡 Kaspersky Securelist · 2026-07-01 The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign How a single ScreenConnect incident exposed a massive campaign | Securelist Solutions for: Home Products Small Business 1-50 employees Medium Business 51-999 employees Enterprise 1000+ employees by Kaspersky CompanyAccount Get In Touch Dark mode
安全情报 Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects 📡 Kaspersky Securelist · 2026-07-02 Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects How to improve your organization’s security based on compromise assessment findings | Securelist Solutions for: Home Products Small Business 1-50 employees Medium Business 51-999 employees Enterprise 1000+ employees by Kaspersky CompanyAccount Get In Touch Dark
安全情报 Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign 📡 Kaspersky Securelist · 2026-07-03 Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign Armored Likho’s new weapon: BusySnake Stealer | Securelist Solutions for: Home Products Small Business 1-50 employees Medium Business 51-999 employees Enterprise 1000+ employees by Kaspersky CompanyAccount Get In Touch Dark mode off English Russian Spanish
安全情报 Scattered Spider Hackers Plead Guilty on Day 1 of Trial 📡 Krebs on Security · 2026-06-23 Scattered Spider Hackers Plead Guilty on Day 1 of Trial Scattered Spider Hackers Plead Guilty on Day 1 of Trial – Krebs on Security --> Advertisement Advertisement --> Skip to content Home About the Author Advertising/Speaking Scattered Spider Hackers Plead Guilty on
安全情报 FBI Seizes NetNut Proxy Platform, Popa Botnet 📡 Krebs on Security · 2026-07-02 FBI Seizes NetNut Proxy Platform, Popa Botnet FBI Seizes NetNut Proxy Platform, Popa Botnet – Krebs on Security --> Advertisement Advertisement --> Skip to content Home About the Author Advertising/Speaking FBI Seizes NetNut Proxy Platform, Popa Botnet July 2, 2026 17 Comments
安全情报 📊 2026-07-06 漏洞情报日报 · 200 条 · 高危 119 每日漏洞情报汇总 · 2026-07-06 📊 2026-07-06 漏洞情报日报 📋 共 200 条 🔥 高危/严重 119 条 🛡️ NVD-Latest 119 条 🔥119 ⚔️ Sploitus 81 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-13768 (CVSS 10.0) - Gardyn 智能花园设备：暴露了高权限的 IoTHub 所有者密钥，攻击者利用该密钥可调用 IoTHub 注册表管理功能，获取所有 Gardyn Home Kit 及 Studio 设备的连接信息，进而实施远程代码执行与内网横向移动。PoC 已公开，利用条件极低。 * CVE-2026-27419 (CVSS 9.9) - Zegen
APT情报 StrikeShark行动：SharkLoader加载器携Cobalt Strike Beacon全球扩散 卡巴斯基披露StrikeShark攻击活动：攻击者利用SharkLoader加载器，通过漏洞利用和恶意投递器在全球部署Cobalt Strike Beacon，感染印尼、台湾等多国政府及企业。详细分析攻击链、DLL劫持技术及缓解措施。
APT情报 潜伏四年未察觉：2025年入侵评估揭示的安全盲区与响应鸿沟 卡巴斯基2025年入侵评估报告揭示：企业安全防御存在严重盲区，60%的入侵事件因缺乏高置信度告警而被遗漏，攻击者利用LoLBins和远程管理工具长期潜伏，平均超3个月才被发现。缺乏持续监控和威胁狩猎的企业，高/中危事件概率高达84-86%。报告强调定期入侵评估、备份安全审查和事件响应预案更新的重要性，为安全团队提供了从被动防御转向主动狩猎的关键洞察。
