Anomali Cyber Watch

Anomali's Threat Research team continually tracks security threats to identify when new, highly critical security threats emerge. The Anomali Threat Research team's briefings discuss current threats and risks like botnets, data breaches, misconfigurations, ransomware, threat groups, and various vulnerabilities. The team also creates free and premium threat intelligence feeds for Anomali's industry-leading Threat Intelligence Platform, ThreatStream.

Anomali Cyber Watch Blog

Anomali Cyber Watch: LockBit 5.0, Chrome Zero-Day CVE-2026-2441, Infostealer Targets OpenClaw, and more
Anomali Cyber Watch: LockBit 5.0, Chrome Zero-Day CVE-2026-2441, Infostealer Targets OpenClaw, and more
Published on:
February 24, 2026
Blog

Anomali Cyber Watch: LockBit 5.0, Chrome Zero-Day CVE-2026-2441, Infostealer Targets OpenClaw, and more

Read More
Anomali Cyber Watch: Zero-Click Affects Claude, SolarWinds Vulnerabilities for Velociraptor and more
Anomali Cyber Watch: Zero-Click Affects Claude, SolarWinds Vulnerabilities for Velociraptor and more
Published on:
February 17, 2026
Blog

Anomali Cyber Watch: Zero-Click Affects Claude, SolarWinds Vulnerabilities for Velociraptor and more

Read More
Anomali Cyber Watch: Notepad++ Attack, RAT Uses Hugging Face, Microsoft Office Flaw and more
Anomali Cyber Watch: Notepad++ Attack, RAT Uses Hugging Face, Microsoft Office Flaw and more
Published on:
February 10, 2026
Blog

Anomali Cyber Watch: Notepad++ Attack, RAT Uses Hugging Face, Microsoft Office Flaw and more

Read More
Anomali Cyber Watch: Stanley Malware Toolkit, ShinyHunters, Vulnerability in WhatsApp and more
Anomali Cyber Watch: Stanley Malware Toolkit, ShinyHunters, Vulnerability in WhatsApp and more
Published on:
February 3, 2026
Blog

Anomali Cyber Watch: Stanley Malware Toolkit, ShinyHunters, Vulnerability in WhatsApp and more

Read More
Anomali Cyber Watch: Evelyn Stealer Abuses, PDFSider Malware, Open-Source Tools Deploy RAT and more
Anomali Cyber Watch: Evelyn Stealer Abuses, PDFSider Malware, Open-Source Tools Deploy RAT and more
Published on:
January 27, 2026
Blog

Anomali Cyber Watch: Evelyn Stealer Abuses, PDFSider Malware, Open-Source Tools Deploy RAT and more

Read More
Anomali Cyber Watch: Remcos RAT, BitB phishing, Linux Malware Framework, Supply Chain Intrusion and more
Anomali Cyber Watch: Remcos RAT, BitB phishing, Linux Malware Framework, Supply Chain Intrusion and more
Published on:
January 20, 2026
Blog

Anomali Cyber Watch: Remcos RAT, BitB phishing, Linux Malware Framework, Supply Chain Intrusion and more

Read More
Anomali Cyber Watch: Cisco ISE Flaw, Ni8mare, N8scape, Zero-Click Prompt Injection and more
Anomali Cyber Watch: Cisco ISE Flaw, Ni8mare, N8scape, Zero-Click Prompt Injection and more
Published on:
January 13, 2026
Blog

Anomali Cyber Watch: Cisco ISE Flaw, Ni8mare, N8scape, Zero-Click Prompt Injection and more

Read More
Anomali Cyber Watch: OWASP Agentic AI, MongoBleed, WebRAT Malware, and more
Anomali Cyber Watch: OWASP Agentic AI, MongoBleed, WebRAT Malware, and more
Published on:
January 6, 2026
Blog

Anomali Cyber Watch: OWASP Agentic AI, MongoBleed, WebRAT Malware, and more

Read More
Anomali Cyber Watch: SantaStealer Threat, Christmas Scams of 2025, React2Shell Exploit, Phishing via ISO, and more
Anomali Cyber Watch: SantaStealer Threat, Christmas Scams of 2025, React2Shell Exploit, Phishing via ISO, and more
Published on:
December 23, 2025
Blog

Anomali Cyber Watch: SantaStealer Threat, Christmas Scams of 2025, React2Shell Exploit, Phishing via ISO, and more

Read More
Anomali Cyber Watch: GhostPenguin, SharePoint Exploits, Android Spyware, CastleLoader Malware Expansion, and more
Anomali Cyber Watch: GhostPenguin, SharePoint Exploits, Android Spyware, CastleLoader Malware Expansion, and more
Published on:
December 16, 2025
Blog

Anomali Cyber Watch: GhostPenguin, SharePoint Exploits, Android Spyware, CastleLoader Malware Expansion, and more

Read More
Anomali Cyber Watch: React and Next.js RCE Vulnerabilities, "Evil Twin" Wifi Networks, Record 29.7 Tbps DDoS Attack, and More
Anomali Cyber Watch: React and Next.js RCE Vulnerabilities, "Evil Twin" Wifi Networks, Record 29.7 Tbps DDoS Attack, and More
Published on:
December 9, 2025
Blog

Anomali Cyber Watch: React and Next.js RCE Vulnerabilities, "Evil Twin" Wifi Networks, Record 29.7 Tbps DDoS Attack, and More

Read More
Anomali Cyber Watch: ShadowPad Backdoor, Password Strength Analysis, HashJack, FlexibleFerret, and More
Anomali Cyber Watch: ShadowPad Backdoor, Password Strength Analysis, HashJack, FlexibleFerret, and More
Published on:
December 2, 2025
Blog

Anomali Cyber Watch: ShadowPad Backdoor, Password Strength Analysis, HashJack, FlexibleFerret, and More

Read More
Anomali Cyber Watch: New Chrome Zero-Day, Sneaky 2FA Phishing Kit, DigitStealer, APT24 "BadAudio" Malware, and More
Anomali Cyber Watch: New Chrome Zero-Day, Sneaky 2FA Phishing Kit, DigitStealer, APT24 "BadAudio" Malware, and More
Published on:
November 25, 2025
Blog

Anomali Cyber Watch: New Chrome Zero-Day, Sneaky 2FA Phishing Kit, DigitStealer, APT24 "BadAudio" Malware, and More

Read More
Anomali Cyber Watch: OWASP Top Ten Updates, AI Voice Scams, DanaBot Malware, Lumma Stealer, and More
Anomali Cyber Watch: OWASP Top Ten Updates, AI Voice Scams, DanaBot Malware, Lumma Stealer, and More
Published on:
November 18, 2025
Blog

Anomali Cyber Watch: OWASP Top Ten Updates, AI Voice Scams, DanaBot Malware, Lumma Stealer, and More

Read More
Anomali Cyber Watch: SesameOp Backdoor, DragonForce Cartel, Gootloader Malware, and More
Anomali Cyber Watch: SesameOp Backdoor, DragonForce Cartel, Gootloader Malware, and More
Published on:
November 11, 2025
Blog

Anomali Cyber Watch: SesameOp Backdoor, DragonForce Cartel, Gootloader Malware, and More

Read More
Anomali Cyber Watch: Typosquatted npm Packages, Qilin Ransomware, New Water Saci Campaign, and More
Anomali Cyber Watch: Typosquatted npm Packages, Qilin Ransomware, New Water Saci Campaign, and More
Published on:
November 4, 2025
Blog

Anomali Cyber Watch: Typosquatted npm Packages, Qilin Ransomware, New Water Saci Campaign, and More

Read More
Anomali Cyber Watch: "ROBOT" Malware Suite, GlassWorm, Vidar Stealer 2.0, and More
Anomali Cyber Watch: "ROBOT" Malware Suite, GlassWorm, Vidar Stealer 2.0, and More
Published on:
October 28, 2025
Blog

Anomali Cyber Watch: "ROBOT" Malware Suite, GlassWorm, Vidar Stealer 2.0, and More

Read More
Anomali Cyber Watch: F5 Breach, Mysterious Elephant APT, Malicious MCP Servers, and More
Anomali Cyber Watch: F5 Breach, Mysterious Elephant APT, Malicious MCP Servers, and More
Published on:
October 21, 2025
Blog

Anomali Cyber Watch: F5 Breach, Mysterious Elephant APT, Malicious MCP Servers, and More

Read More
Anomali Cyber Watch: Oracle E-Business Suite Zero-Day, Vampire Bot Malware, XWorm 6.0, and More
Anomali Cyber Watch: Oracle E-Business Suite Zero-Day, Vampire Bot Malware, XWorm 6.0, and More
Published on:
October 14, 2025
Blog

Anomali Cyber Watch: Oracle E-Business Suite Zero-Day, Vampire Bot Malware, XWorm 6.0, and More

Read More
Anomali Cyber Watch: Phantom Taurus, MatrixPDF, Klopatra, and More
Anomali Cyber Watch: Phantom Taurus, MatrixPDF, Klopatra, and More
Published on:
October 7, 2025
Blog

Anomali Cyber Watch: Phantom Taurus, MatrixPDF, Klopatra, and More

Read More
Anomali Cyber Watch: Nimbus Manticore, Spoofed IC3 Portals, a Record-Breaking DDoS Attack, and More
Anomali Cyber Watch: Nimbus Manticore, Spoofed IC3 Portals, a Record-Breaking DDoS Attack, and More
Published on:
September 30, 2025
Blog

Anomali Cyber Watch: Nimbus Manticore, Spoofed IC3 Portals, a Record-Breaking DDoS Attack, and More

Read More
Anomali Cyber Watch: FileFix Phishing, AI-Driven Pen-Testing, the Return of Scattered Spider, and More
Anomali Cyber Watch: FileFix Phishing, AI-Driven Pen-Testing, the Return of Scattered Spider, and More
Published on:
September 23, 2025
Blog

Anomali Cyber Watch: FileFix Phishing, AI-Driven Pen-Testing, the Return of Scattered Spider, and More

Read More
Anomali Cyber Watch: Salesloft Drift Breach, Salty2FA Phishing, GPUGate Malware, and More
Anomali Cyber Watch: Salesloft Drift Breach, Salty2FA Phishing, GPUGate Malware, and More
Published on:
September 16, 2025
Blog

Anomali Cyber Watch: Salesloft Drift Breach, Salty2FA Phishing, GPUGate Malware, and More

Read More
Anomali Cyber Watch: APT 29, APT37, Silver Fox, Grok AI Exploits, and More
Anomali Cyber Watch: APT 29, APT37, Silver Fox, Grok AI Exploits, and More
Published on:
September 9, 2025
Blog

Anomali Cyber Watch: APT 29, APT37, Silver Fox, Grok AI Exploits, and More

Read More
Anomali Cyber Watch: PromptLock Ransomware, Blind Eagle, Lovable Website Attacks, and More
Anomali Cyber Watch: PromptLock Ransomware, Blind Eagle, Lovable Website Attacks, and More
Published on:
September 2, 2025
Blog

Anomali Cyber Watch: PromptLock Ransomware, Blind Eagle, Lovable Website Attacks, and More

Read More
Anomali Cyber Watch: Noodlophile Stealer, GodRAT, Apple ImageIO Zero-Day, and More
Anomali Cyber Watch: Noodlophile Stealer, GodRAT, Apple ImageIO Zero-Day, and More
Published on:
August 26, 2025
Blog

Anomali Cyber Watch: Noodlophile Stealer, GodRAT, Apple ImageIO Zero-Day, and More

Read More
Anomali Cyber Watch: WinRAR Malware, Erlang OTP Exploitation, Charon Ransomware, and More
Anomali Cyber Watch: WinRAR Malware, Erlang OTP Exploitation, Charon Ransomware, and More
Published on:
August 19, 2025
Blog

Anomali Cyber Watch: WinRAR Malware, Erlang OTP Exploitation, Charon Ransomware, and More

Read More
Anomali Cyber Watch: PXA Stealer, ClickFix Malware, Fake TikTok Shops, Throttlestop, and More
Anomali Cyber Watch: PXA Stealer, ClickFix Malware, Fake TikTok Shops, Throttlestop, and More
Published on:
August 12, 2025
Blog

Anomali Cyber Watch: PXA Stealer, ClickFix Malware, Fake TikTok Shops, Throttlestop, and More

Read More
Detecting the ToolShell SharePoint Exploit
Detecting the ToolShell SharePoint Exploit
Published on:
August 11, 2025
Blog

Detecting the ToolShell SharePoint Exploit

Read More
Anomali Cyber Watch: SHUYAL Infostealer, PyPI Phishing Campaign, Gunra Ransomware, UNC2891, and More
Anomali Cyber Watch: SHUYAL Infostealer, PyPI Phishing Campaign, Gunra Ransomware, UNC2891, and More
Published on:
August 4, 2025
Blog

Anomali Cyber Watch: SHUYAL Infostealer, PyPI Phishing Campaign, Gunra Ransomware, UNC2891, and More

Read More
Anomali Cyber Watch: APT41, PoisonSeed Attacks, ToolShell Vulnerability, DCHSpy, Android Malware, and More
Anomali Cyber Watch: APT41, PoisonSeed Attacks, ToolShell Vulnerability, DCHSpy, Android Malware, and More
Published on:
July 28, 2025
Blog

Anomali Cyber Watch: APT41, PoisonSeed Attacks, ToolShell Vulnerability, DCHSpy, Android Malware, and More

Read More
Anomali Cyber Watch: Interlock RAT, North Koreans Flood npm Registry, Stealthy WordPress PHP Malware, and Semiconductor Sector Hacks
Anomali Cyber Watch: Interlock RAT, North Koreans Flood npm Registry, Stealthy WordPress PHP Malware, and Semiconductor Sector Hacks
Published on:
July 22, 2025
Blog

Anomali Cyber Watch: Interlock RAT, North Koreans Flood npm Registry, Stealthy WordPress PHP Malware, and Semiconductor Sector Hacks

Read More
Anomali Cyber Watch: BERT Ransomware Group, Employee Login Credential Attacks, Malicious Chrome Extensions, and More
Anomali Cyber Watch: BERT Ransomware Group, Employee Login Credential Attacks, Malicious Chrome Extensions, and More
Published on:
July 17, 2025
Blog

Anomali Cyber Watch: BERT Ransomware Group, Employee Login Credential Attacks, Malicious Chrome Extensions, and More

Read More
Anomali Cyber Watch: Scattered Spider Hacking Spree, Iranian Cyber Threats, PDF Phishing Campaigns, and More
Anomali Cyber Watch: Scattered Spider Hacking Spree, Iranian Cyber Threats, PDF Phishing Campaigns, and More
Published on:
July 10, 2025
Blog

Anomali Cyber Watch: Scattered Spider Hacking Spree, Iranian Cyber Threats, PDF Phishing Campaigns, and More

Read More
Anomali Cyber Watch: TA4903 Spoofs U.S. Agencies for BEC, Malicious Script Hijacks Browsers to Conduct WordPress Brute Force, and More
Anomali Cyber Watch: TA4903 Spoofs U.S. Agencies for BEC, Malicious Script Hijacks Browsers to Conduct WordPress Brute Force, and More
Published on:
March 11, 2024
Blog

Anomali Cyber Watch: TA4903 Spoofs U.S. Agencies for BEC, Malicious Script Hijacks Browsers to Conduct WordPress Brute Force, and More

Read More
Anomali Cyber Watch: Lazarus Exploited Admin-to-Kernel Zero-Day, Fancy Bear Has Been Using Compromised Ubiquiti EdgeRouters, and More
Anomali Cyber Watch: Lazarus Exploited Admin-to-Kernel Zero-Day, Fancy Bear Has Been Using Compromised Ubiquiti EdgeRouters, and More
Published on:
March 5, 2024
Blog

Anomali Cyber Watch: Lazarus Exploited Admin-to-Kernel Zero-Day, Fancy Bear Has Been Using Compromised Ubiquiti EdgeRouters, and More

Read More
Anomali Cyber Watch: Volt Typhoon Maintained Access to US Critical Infrastructure, New MoqHao Variants Launch Automatically, and More.
Anomali Cyber Watch: Volt Typhoon Maintained Access to US Critical Infrastructure, New MoqHao Variants Launch Automatically, and More.
Published on:
February 14, 2024
Blog

Anomali Cyber Watch: Volt Typhoon Maintained Access to US Critical Infrastructure, New MoqHao Variants Launch Automatically, and More.

Read More
Anomali Cyber Watch: NSPX30 Implant Relies on Network Interception, Mustang Panda Spies on Myanmar Government, and More
Anomali Cyber Watch: NSPX30 Implant Relies on Network Interception, Mustang Panda Spies on Myanmar Government, and More
Published on:
January 30, 2024
Blog

Anomali Cyber Watch: NSPX30 Implant Relies on Network Interception, Mustang Panda Spies on Myanmar Government, and More

Read More
Anomali Cyber Watch: China-Sponsored UNC3886 Had Zero-Day Access to VMWare ESXi Hosts, ColdRiver Authored First Custom Backdoor, and More
Anomali Cyber Watch: China-Sponsored UNC3886 Had Zero-Day Access to VMWare ESXi Hosts, ColdRiver Authored First Custom Backdoor, and More
Published on:
January 22, 2024
Blog

Anomali Cyber Watch: China-Sponsored UNC3886 Had Zero-Day Access to VMWare ESXi Hosts, ColdRiver Authored First Custom Backdoor, and More

Read More
Anomali Cyber Watch: China-Sponsored Group Exploits Ivanti Devices, RE#TURGENCE Targets MSSQL Servers to Deliver MIMIC Ransomware, and More
Anomali Cyber Watch: China-Sponsored Group Exploits Ivanti Devices, RE#TURGENCE Targets MSSQL Servers to Deliver MIMIC Ransomware, and More
Published on:
January 16, 2024
Blog

Anomali Cyber Watch: China-Sponsored Group Exploits Ivanti Devices, RE#TURGENCE Targets MSSQL Servers to Deliver MIMIC Ransomware, and More

Read More
Anomali Cyber Watch: Sea Turtle Adopted Open-Source Linux Tools, AsyncRAT Delivered by GIF Attachments, and More
Anomali Cyber Watch: Sea Turtle Adopted Open-Source Linux Tools, AsyncRAT Delivered by GIF Attachments, and More
Published on:
January 9, 2024
Blog

Anomali Cyber Watch: Sea Turtle Adopted Open-Source Linux Tools, AsyncRAT Delivered by GIF Attachments, and More

Read More
Anomali Cyber Watch: Infostealers Target Google Oauth MultiLogin Endpoint, Kimsuky Adopts Chrome Remote Desktop C2 Communication, and More
Anomali Cyber Watch: Infostealers Target Google Oauth MultiLogin Endpoint, Kimsuky Adopts Chrome Remote Desktop C2 Communication, and More
Published on:
January 5, 2024
Blog

Anomali Cyber Watch: Infostealers Target Google Oauth MultiLogin Endpoint, Kimsuky Adopts Chrome Remote Desktop C2 Communication, and More

Read More
Leashing Cerberus
Leashing Cerberus
Published on:
November 11, 2019
Blog

Leashing Cerberus

Read More
China-Based APT Mustang Panda Targets Minority Groups, Public and Private Sector Organizations
China-Based APT Mustang Panda Targets Minority Groups, Public and Private Sector Organizations
Published on:
October 7, 2019
Blog

China-Based APT Mustang Panda Targets Minority Groups, Public and Private Sector Organizations

Read More
The eCh0raix Ransomware
The eCh0raix Ransomware
Published on:
July 10, 2019
Blog

The eCh0raix Ransomware

Read More
Rocke Evolves Its Arsenal With a New Malware Family Written in Golang
Rocke Evolves Its Arsenal With a New Malware Family Written in Golang
Published on:
March 15, 2019
Blog

Rocke Evolves Its Arsenal With a New Malware Family Written in Golang

Read More
Weekly Threat Briefing: Windows Servers Targeted for Cryptocurrency Mining via IIS Flaw
Weekly Threat Briefing: Windows Servers Targeted for Cryptocurrency Mining via IIS Flaw
Published on:
April 17, 2018
Blog

Weekly Threat Briefing: Windows Servers Targeted for Cryptocurrency Mining via IIS Flaw

Read More
Petya (NotPetya, Petrwrap)
Petya (NotPetya, Petrwrap)
Published on:
June 28, 2017
Blog

Petya (NotPetya, Petrwrap)

Read More
Explore More Resources