Threat actor

Fire Ant

In 5 briefs, most recently 1 September 2026. RSS for this tag

Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗

Coverage in DanSec Daily

  1. Berlin city data theft by Rhysida, McKesson breach claimed by ShinyHunters, and Cronos restart after $74M Tectonic exploit.
  2. McKesson breach claimed by ShinyHunters (284M records), Berlin city ransomware by Rhysida, and ServiceNow critical code injection patches.
  3. Allianz Life breach, WordPress Post SMTP flaw exposing 200k+ sites, and ToolShell SharePoint exploits.
  4. Ransomware up 63% in Q2 2025, Amazon's Q Developer VS Code extension hijacked with wiper commands, and a North Korean IT worker laptop-farm sentencing.
  5. BlackSuit ransomware sites seized, Toptal GitHub breach poisons npm packages, and ToolShell SharePoint flaws hit 400+ servers.