30d signal volume
A suspect was apprehended while operating a vehicle containing a body concealed in the trunk. The incident represents a serious criminal offense involving potential homicide or unlawful transport of human remains.
Bandit reported tensions with Operative in Kyara [10 sources]
Three proof-of-concept exploits are being used in active attacks against Microsoft's built-in security platform; two are unpatched. This indicates ongoing cyber operations targeting a critical system component with available exploitation code and limited defensive patching options.
This copyrighted Google/Mandiant threat intelligence document discusses how AI models are dramatically accelerating vulnerability discovery and exploit development, enabling mass exploitation campaigns by threat actors of varying skill levels. It provides strategic defensive roadmaps for both advanced and foundational vulnerability management programs, emphasizing automation, resilience, continuous asset discovery, and AI-integrated security operations to counter the evolving threat landscape.
Cybersecurity researchers disclosed a China-aligned espionage campaign targeting government and defense sectors across South, East, Southeast Asia, and a NATO-affiliated European government. Trend Micro attributed the activity to SHADOW-EARTH-053, a tracked threat activity cluster assessed to conduct sustained espionage operations.
China's state-backed groups are deploying covert networks of compromised devices to execute attacks using low-cost, low-risk, and deniable methods. This approach suggests a strategic shift toward sustainable cyber operations with reduced attribution exposure.
Kinahan cartel conflicts with rival organizations have been attributed to at least 20 murders across four European countries per Europol assessment. This represents a significant transnational organized crime threat with documented lethality and cross-border operational capability.
Cybersecurity researchers are warning of two cybercrime groups (Cordial Spider and Snarky Spider) conducting rapid, high-impact attacks within SaaS environments while leaving minimal traces. These groups are attributed to high-speed data theft operations using sophisticated techniques to evade detection.
CISA added CVE-2026-31431, a Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability, to its Known Exploited Vulnerabilities Catalog based on active exploitation evidence. Federal agencies must remediate this vulnerability per Binding Operational Directive 22-01, and CISA urges all organizations to prioritize remediation as part of vulnerability management practices.
NASA's Office of Inspector General revealed a Chinese national posed as a U.S. researcher in a spear-phishing campaign targeting NASA employees and other government agencies, universities, and private companies. The operation aimed to obtain sensitive information in violation of export control laws and represents a sustained counter-intelligence concern.
A ransomware gang is noted for its rapid operational scaling and sophisticated technical capabilities despite a seemingly innocuous name. Researchers have documented the group's impressive speed in expanding operations, suggesting a well-organized and technically advanced criminal enterprise.
Israel conducted military strikes across southern Lebanon on Saturday, targeting multiple Hezbollah positions. The Israeli military reported hitting dozens of Hezbollah targets in the operation.
A Vietnamese-linked phishing operation codenamed AccountDumpling has been discovered using Google AppSheet as a phishing relay to distribute malicious emails targeting Facebook account compromise. The stolen accounts are subsequently sold through an illicit storefront operated by the threat actors, with approximately 30,000 Facebook accounts compromised in this scheme.
Russian drone strikes on May 1 overnight targeted Odesa, setting fire to two apartment buildings according to the city's military administration head Serhiy Lysak. The incident reflects ongoing military operations against Ukrainian civilian infrastructure in a major port city.
A group recruited children from Finland to attend a camp in Crimea while simultaneously receiving employment support from the City of Helsinki. This activity raises concerns about foreign influence operations targeting minors and the potential misuse of municipal resources.
Armed forces conducted combined airstrikes and ground operations that forced the Chin resistance coalition to withdraw from the state's second capital after maintaining control since April 2025. This represents a significant military setback for resistance forces and a tactical victory for government forces in the region.
Following publication of investigative reporting, threat actors impersonated ICIJ journalists to conduct a social engineering campaign targeting Taiwanese officials and human rights advocates. The operation sought to extract sensitive data through fraudulent persona spoofing. Investigation by Citizen Lab provided additional analysis of this coordinated threat activity.
A threat actor has established multiple command and control channels leveraging popular legitimate services including Microsoft Outlook, Slack, Discord, and file.io for conducting online espionage operations. This approach provides redundancy and makes detection more difficult.