DanSec

Threat actor

KimWolf

In 14 briefs, most recently 12 August 2026. RSS for this tag

Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗

Coverage in DanSec Daily

  1. Microsoft August Patch Tuesday zero-days, Cisco ASA/FTD exploitation, Mozilla signing key exposure, and Gunra ransomware warnings.
  2. Kimwolf botmaster arrested, GitHub breach via malicious VS Code extension, and Grafana repo theft via TanStack supply chain attack.
  3. Navia breach exposes 2.7M records; Trivy GitHub Actions compromised again; Magento defacement campaign hits thousands of sites.
  4. Stryker wiper attack wiping ~80,000 devices, Lazarus linked to Bitrefill breach, and PolyShell Magento RCE flaw.
  5. LexisNexis data leak, UMMC ransomware outage, and FBI/Europol seizure of the LeakBase forum.
  6. Canadian Tire breach hits 38M accounts, South Korea tax office leaks crypto wallet phrase ($4.8M stolen), and Kimwolf botnet botmaster identified as Dort.
  7. Spain's Ministry of Science IT outage, Conpet ransomware attack tied to Qilin, and Substack breach.
  8. Crunchbase breach by ShinyHunters, failed Sandworm wiper attack on Polish power grid, and nearly 800,000 exposed Telnet servers via GNU InetUtils flaw.
  9. Kyowon ransomware, Fortinet FortiSIEM RCE exploits, the RedVDS takedown, and the AISURU/Kimwolf botnet disruption in this January 2026 brief.
  10. WhatsApp worm spreading Astaroth in Brazil, Kimwolf botnet infecting 2M+ Android TV boxes, and HPE OneView CVE-2025-37164 under active exploitation.
  11. Brightspeed breach claimed by Crimson Collective, Zestix stealing data from ShareFile, Nextcloud and OwnCloud, and critical n8n and MongoDB flaws.
  12. Covenant Health breach tied to Qilin ransomware, Fortinet firewalls hit by a five-year-old 2FA bypass, and $8.5M stolen from Trust Wallet users.
  13. The University of Sydney breach, Denmark water utility attack attributed to Russia, and actively exploited WatchGuard Fireware VPN flaw CVE-2025-14733.
  14. LKQ Oracle EBS breach, Cisco AsyncOS zero-day CVE-2025-20393 exploited by China-linked APT, and Kimwolf botnet hijacking 1.8M Android devices for DDoS.