10+ hour, 45+ min ago   (367+ words) Rescana Technical Analysis of Malware/TTPs The attack chain began with the automated mass-download of 1.8 million Android APKs from multiple app stores using a distributed pipeline orchestrated on ten AWS EC2 instances. The APKs were decompiled and scanned for hardcoded secrets…...

1+ week, 7+ hour ago   (237+ words) No public attribution to a specific APT group has been made, but the sophistication and targeting patterns suggest a well-organized criminal operation with a focus on financial gain. The malware’s modular architecture and rapid evolution indicate ongoing development and adaptation…...

1+ week, 1+ day ago   (422+ words) No exploitation in the wild or public proof-of-concept (PoC) has been confirmed as of September 4, 2026. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and there is no CISA-confirmed active exploitation. However, the exposure is automatable…...

1+ week, 1+ day ago   (555+ words) rescana.com FalconFlank Zero-Day Exposes Critical Privilege Escalation Vulnerability in CrowdStrike Falcon Sensor for Windows 11 and Windows Server 2026 A critical zero-day vulnerability, designated FalconFlank, has been publicly disclosed in the CrowdStrike Falcon Sensor for Windows. This flaw enables local attackers…...

1+ week, 1+ day ago   (772+ words) rescana.com Large-Scale Phishing Campaign Uses Invisible Unicode and ActiveCampaign to Evade Email Security Filters A newly identified, large-scale phishing campaign is actively exploiting invisible Unicode characters to bypass traditional email security filters, sending millions of malicious emails globally. This…...

1+ week, 1+ day ago   (299+ words) The breach demonstrates a pattern of targeting CI/CD platforms for supply chain compromise, credential theft, and lateral movement. The lack of timely patching, even by the vendor, highlights the importance of rapid vulnerability management in environments with access to…...

1+ week, 1+ day ago   (517+ words) Rescana Active Exploitation Alert: North Korean APTs Deploy Ted Backdoor in Compromised HAProxy Builds to Hijack Web Traffic Technical Analysis of Malware/TTPs The Ted backdoor is not a vulnerability in the official HAProxy codebase, but rather a malicious plugin…...

1+ week, 1+ day ago   (289+ words) Attribution for the attack has been assigned to the ShinyHunters extortion gang, based on reporting from enterprise blockchain security firm Holborn. While this attribution is consistent with ShinyHunters’ historical targeting of SaaS, e-commerce, and supply chain providers, it is based…...

2+ week, 1+ day ago   (126+ words) Indicators of compromise include anomalous minting or burning of tokens, transactions involving vesting accounts with balances wrapping to 2^256, and the rapid creation and exploitation of vesting accounts. The exploit contracts were deployed to precomputed addresses and immediately used to trigger…...

2+ week, 5+ day ago   (209+ words) Both vulnerabilities are remotely exploitable via HTTP(S) requests to the vulnerable endpoint and require no authentication or user interaction. The attack surface is significant, with over 600 internet-exposed instances identified through search engine reconnaissance, including those hosted on Kaltura’s own infrastructure....