Threat actor

Ghostwriter

In 2 briefs, most recently 23 May 2026. RSS for this tag

Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗

Coverage in DanSec Daily

  1. Cloud Atlas and Ghostwriter espionage, Megalodon GitHub commit campaign, and First VPN takedown, plus actively exploited LiteSpeed cPanel and Drupal flaws.
  2. Foxconn ransomware by Nitrogen, OpenAI breach via TanStack supply chain attack, and Cisco SD-WAN zero-day CVE-2026-20182 exploited in the wild.