Malware4 min read
Mistic Backdoor Feeds Qilin, Akira, and Black Basta Operations
Symantec links the stealthy Mistic backdoor to KongTuke, an initial access broker supplying corporate network access to major ransomware gangs.
James RiveraJun 25, 2026
Initial Access Broker
6 articles tagged with "Initial Access Broker"
Announcements4 min read
Russian Access Broker Gets 81 Months for Yanluowang Attacks
Aleksei Volkov sentenced to nearly 7 years for selling network access to ransomware gangs. Facilitated dozens of attacks causing over $9 million in losses to US organizations.
ProbablyPwned Editorial TeamMar 26, 2026
Vulnerabilities3 min read
Single IP Behind 83% of Ivanti EPMM Attacks, Sleepers Found
GreyNoise traces Ivanti EPMM exploitation to bulletproof hosting on PROSPERO network. Defenders find dormant webshells—signs of initial access broker activity.
Vulnerability DeskFeb 14, 2026
Malware3 min read
SHADOW#REACTOR: Multi-Stage Remcos RAT Hits Enterprises
Security researchers expose an active campaign using layered evasion techniques to deliver Remcos RAT through MSBuild abuse and .NET Reactor-protected loaders.
Malware DeskJan 31, 2026
Malware3 min read
SHADOW#REACTOR Campaign Drops Remcos RAT via MSBuild
Multi-stage malware campaign uses text-based stagers and living-off-the-land binaries to deliver Remcos RAT to enterprise targets.
Malware DeskJan 17, 2026
Vulnerabilities4 min read
Christmas Attack Campaign Targets ColdFusion with 2.5M Requests
GreyNoise researchers uncover coordinated campaign exploiting 767 CVEs across 47 technology stacks. Hong Kong-based infrastructure generated 98% of attack traffic on Christmas Day.
Vulnerability DeskJan 5, 2026