Threat actor

Kimsuky

In 14 briefs, most recently 11 August 2026. RSS for this tag

Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗

Coverage in DanSec Daily

  1. Polish CHP plant hacked via private cellular APN, LexisNexis and Valve/CEVA breaches, and actively exploited Progress Kemp LoadMaster flaw.
  2. Charter and Carnival breaches by ShinyHunters, FortiClient EMS CVE-2026-35616 exploitation, and Gogs and Gitea flaws.
  3. Foxconn ransomware by Nitrogen, OpenAI breach via TanStack supply chain attack, and Cisco SD-WAN zero-day CVE-2026-20182 exploited in the wild.
  4. Hackers selling Target source code, the n8n "Ni8mare" flaw hitting about 60,000 instances, and a Gogs zero-day under a CISA patch order.
  5. IDHS exposing ~700,000 residents' health data, a VMware ESXi zero-day exploited via SonicWall VPN, and Trend Micro Apex Central RCE patches.
  6. WhatsApp worm spreading Astaroth in Brazil, Kimwolf botnet infecting 2M+ Android TV boxes, and HPE OneView CVE-2025-37164 under active exploitation.
  7. Brightspeed customer data claimed stolen by Crimson Collective, fake AITOPIA Chrome extensions harvesting AI chats, and critical n8n 'Ni8mare' RCE (CVSS 10.0).
  8. Ferry malware arrests in France, E-Note crypto exchange seizure, HPE OneView CVE-2025-37164 RCE, and Kimsuky's $2B crypto theft in 2025.
  9. The GlobalLogic Oracle EBS data theft, the Rhadamanthys infostealer takedown, and Microsoft's November 2025 Patch Tuesday with 63 flaws including a kernel …
  10. Miljödata breach affecting 1.5M, Nikkei Slack compromise and actively exploited Post SMTP WordPress flaw.
  11. Balancer DeFi $120M hack, Everest ransomware claims, and XWiki RCE exploitation.
  12. JLR extends shutdown after cyberattack; Microsoft and Cloudflare dismantle RaccoonO365 phishing network; DHS misconfigured data hub exposes sensitive …
  13. Connex Credit Union breach hits 172,000 members; Citrix NetScaler CVE-2025-6543 exploited against Dutch critical orgs; BlackSuit ransomware infrastructure …
  14. DOGE's alleged NLRB data exfiltration, a Microsoft Entra lockout mishap, and the 'Fog' ransomware campaign hitting over 100 victims since January.