Real-time global intelligence

© 2026 OpenWatch. All rights reserved.

For informational and entertainment purposes only. Not investment advice.

Platform

Brief
Signals
Countries
Companies
Industries
Themes
Scenarios
Rankings

Tools

Globe
Analytics
Crises
Clusters
Supply Chain
Alliances
Screener
Watchlist
Portfolio

Developer

API Reference
Developer Keys
Webhooks
Status

Sources

View all sources →

1,000+ tracked sources

Signals updated every 15 minutes

Not investment advice. OpenWatch is provided for informational and entertainment purposes only. While we strive for accuracy, precision, and source attribution in all intelligence assessments, geopolitical analysis involves inherent uncertainty and our conclusions may be incomplete, delayed, or incorrect. Nothing on this platform constitutes financial, investment, legal, or professional advice of any kind. Forward-looking scenarios and probability estimates are analytical hypotheses — not independently validated forecasts. Any actions taken based on information found here are solely your responsibility. Always consult a qualified financial advisor before making investment decisions. Past signal patterns do not guarantee future outcomes.

Methodology
Privacy Policy
Terms of Use

openwatch.io

v·7bfae86

Signal Search

Search across all ingested intelligence signals. Supports websearch syntax: AND OR "exact phrase" -exclude

Keywords

Threat Layer

Military Cyber Economic Disaster Political Criminal Health Supply Chain

Signal Type

Any Crisis Update Resolution

Region

Country

Min. Severity

Any ≥ 3 ≥ 5 ≥ 7 ≥ 9

Date Range

Clear all filters

Sort by

Severity Newest

↓Export CSV (requires API key)

Themes:🧠AI Chip Bottleneck 🛡US Defense Surge 🚢Red Sea Escalation ⚓Shipping Lane Fragmentation

772 results for Economic+Health+Disaster+Cyber · Crisis

Page 6 of 31

CyberCrisis🇸🇦Saudi Arabia 🇹🇷Turkey 🇲🇾Malaysia+3

58d ago

Introduction Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in recovered payloads, we believe the exploit chain to be called DarkSword. Since at least November 2025, GTIG has observed multiple commercial surveillance vendors and suspected state-sponsored actors utilizing DarkSword in distinct campaigns.

6.1/10·Mandiant Threat Intelligence·Coruna

Primary Source ↗Details →

CyberCrisis🇲🇱Mali60d ago

Written by: Bavi Sadayappan, Zach Riddle, Ioana Teaca, Kimberly Goody, Genevieve Stark Introduction Since 2018, when many financially motivated threat actors began shifting their monetization strategy to post-compromise ransomware deployments, ransomware has become one of the most pervasive threats to organizations across almost every industry vertical and region. In recent years ransomware operations have evolved, creating a robust ecosystem that has lowered the barrier to entry via the commoditization and specialization of the supporting underground communities, which is exemplified by the proliferation of the ransomware-as-a-service (RaaS) business model. While ransomware remains a dominant threat due to the volume of activity and the potential for serious operational disruptions, we have observed multiple indicators that suggest the overall profitability of ransomware operations is in decline.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇲🇱Mali70d ago

Written by: Matthew McWhirt, Bhavesh Dhake, Emilio Oropeza, Gautam Krishnan, Stuart Carrera, Greg Blaum, Michael Rudden UPDATE (March 13): Added guidance around abuse or misuse of endpoint / MDM platforms . Background Threat actors leverage destructive malware to destroy data, eliminate evidence of malicious activity, or manipulate systems in a way that renders them inoperable. Destructive cyberattacks can be a powerful means to achieve strategic or tactical objectives; however, the risk of reprisal is likely to limit the frequency of use to very select incidents.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇨🇳China 🇰🇵North Korea 🇲🇱Mali+171d ago

Written by: Casey Charrier, James Sadowski, Zander Work, Clement Lecigne, Benoît Sevens, Fred Plan Executive Summary Google Threat Intelligence Group (GTIG) tracked 90 zero-day vulnerabilities exploited in-the-wild in 2025. Although that volume of zero-days is lower than the record high observed in 2023 (100), it is higher than 2024’s count (78) and remained within the 60–100 range established over the previous four years, indicating a trend toward stabilization at these levels. In 2025, we continued to observe the structural shift, first identified in 2024, toward increased enterprise exploitation.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇨🇳China 🇲🇱Mali79d ago

Introduction Last week, Google Threat Intelligence Group (GTIG), Mandiant, and partners took action to disrupt a global espionage campaign targeting telecommunications and government organizations in dozens of nations across four continents. The threat actor, UNC2814, is a suspected People's Republic of China (PRC)-nexus cyber espionage group that GTIG has tracked since 2017. This prolific, elusive actor has a long history of targeting international governments and global telecommunications organizations across Africa, Asia, and the Americas and had confirmed intrusions in 42 countries when the disruption was executed.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇮🇷Iran 🇨🇳China 🇷🇺Russia92d ago

Introduction In the final quarter of 2025, Google Threat Intelligence Group (GTIG) observed threat actors increasingly integrating artificial intelligence (AI) to accelerate the attack lifecycle, achieving productivity gains in reconnaissance, social engineering, and malware development. This report serves as an update to our November 2025 findings regarding the advances in threat actor usage of AI tools. By identifying these early indicators and offensive proofs of concept, GTIG aims to arm defenders with the intelligence necessary to anticipate the next phase of AI-enabled threats, proactively thwart malicious activity, and continually strengthen both our classifiers and model.

6.1/10·Mandiant Threat Intelligence

Primary Source ↗Details →

CyberCrisis🇷🇺Russia 🇨🇳China 🇦🇺Australia+294d ago

Introduction In modern warfare, the front lines are no longer confined to the battlefield; they extend directly into the servers and supply chains of the industry that safeguards the nation. Today, the defense sector faces a relentless barrage of cyber operations conducted by state-sponsored actors and criminal groups alike. In recent years, Google Threat Intelligence Group (GTIG) has observed several distinct areas of focus in adversarial targeting of the defense industrial base (DIB).

6.1/10·Mandiant Threat Intelligence

Primary Source ↗Details →

CyberCrisis🇲🇱Mali 🇲🇽Mexico95d ago

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info Insaat--Fikir Odalari AdminPando A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26. The username and password parameters are vulnerable to SQL injection, allowing unauthenticated attackers to bypass authentication completely. Successful exploitation grants full administrative access to the application, including the ability to manipulate the public-facing website content (HTML/DOM manipulation).

6.1/10·US-CERT Bulletins·Mali

Primary Source ↗Details →

CyberCrisis🇲🇱Mali105d ago

Introduction Mandiant is tracking a significant expansion and escalation in the operations of threat clusters associated with ShinyHunters-branded extortion. As detailed in our companion report, 'Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft' , these campaigns leverage evolved voice phishing (vishing) and victim-branded credential harvesting to successfully compromise single sign-on (SSO) credentials and enroll unauthorized devices into victim multi-factor authentication (MFA) solutions. This activity is not the result of a security vulnerability in vendors' products or infrastructure.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇲🇱Mali 🇺🇸United States105d ago

Introduction Mandiant has identified an expansion in threat activity that uses tactics, techniques, and procedures (TTPs) consistent with prior ShinyHunters-branded extortion operations. These operations primarily leverage sophisticated voice phishing (vishing) and victim-branded credential harvesting sites to gain initial access to corporate environments by obtaining single sign-on (SSO) credentials and multi-factor authentication (MFA) codes. Once inside, the threat actors target cloud-based software-as-a-service (SaaS) applications to exfiltrate sensitive data and internal communications for use in subsequent extortion demands.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇷🇺Russia 🇨🇳China 🇧🇷Brazil+1108d ago

Introduction The Google Threat Intelligence Group (GTIG) has identified widespread, active exploitation of the critical vulnerability CVE-2025-8088 in WinRAR, a popular file archiver tool for Windows, to establish initial access and deliver diverse payloads. Discovered and patched in July 2025, government-backed threat actors linked to Russia and China as well as financially motivated threat actors continue to exploit this n-day across disparate operations. The consistent exploitation method, a path traversal flaw allowing files to be dropped into the Windows Startup folder for persistence, underscores a defensive gap in fundamental application security and user awareness.

6.1/10·Mandiant Threat Intelligence

Primary Source ↗Details →

EconomicCrisis🇱🇰Sri Lanka 🇲🇱Mali 🇲🇹MT+1109d ago

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info Agatasoft--AgataSoft PingMaster Pro AgataSoft PingMaster Pro 2.1 contains a denial of service vulnerability in the Trace Route feature that allows attackers to crash the application by overflowing the host name input field. Attackers can generate a 10,000-character buffer and paste it into the host name field to trigger an application crash and potential system instability. 2026-01-23 7.5 CVE-2021-47893 ExploitDB-49567 Vendor Homepage VulnCheck Advisory: AgataSoft PingMaster Pro 2.1 - Denial of Service   Aida Computer Information Technology Inc.--Hotel Guest Hotspot Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aida Computer Information Technology Inc.

6.1/10·US-CERT Bulletins·Mali

Primary Source ↗Details →

CyberCrisis🇦🇼AW 🇮🇹Italy 🇯🇵Japan+3115d ago

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info 10-Strike--Strike Network Inventory Explorer Pro 10-Strike Network Inventory Explorer Pro 9.31 contains a buffer overflow vulnerability in the text file import functionality that allows remote code execution. Attackers can craft a malicious text file with carefully constructed payload to trigger a reverse shell and execute arbitrary code on the target system. 2026-01-15 9.8 CVE-2021-47772 ExploitDB-50472 Vendor Homepage   10-Strike--Strike Network Inventory Explorer Pro 10-Strike Network Inventory Explorer Pro 9.31 contains an unquoted service path vulnerability in the srvInventoryWebServer service running with LocalSystem privileges.

6.1/10·US-CERT Bulletins·Mali

Primary Source ↗Details →

CyberCrisis🇦🇷Argentina 🇦🇼AW 🇯🇵Japan+2123d ago

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info AA-Team--Amazon Native Shopping Recommendations Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Native Shopping Recommendations allows SQL Injection.This issue affects Amazon Native Shopping Recommendations: from n/a through 1.3. 2026-01-05 9.3 CVE-2025-30633 https://vdp.patchstack.com/database/wordpress/plugin/woozone-contextual/vulnerability/wordpress-amazon-native-shopping-recommendations-plugin-1-3-sql-injection-vulnerability?_s_id=cve   AA-Team--Premium Age Verification / Restriction for WordPress Incorrect Privilege Assignment vulnerability in AA-Team Premium Age Verification / Restriction for WordPress, AA-Team Responsive Coming Soon Landing Page / Holding Page for WordPress allows Privilege Escalation.This issue affects Premium Age Verification / Restriction for WordPress: from n/a through 3.0.2; Responsive Coming Soon Landing Page / Holding Page for WordPress: from n/a through 3.0. 2026-01-06 8.8 CVE-2025-29004 https://patchstack.com/database/wordpress/plugin/age-restriction/vulnerability/wordpress-premium-age-verification-restriction-for-wordpress-plugin-3-0-2-privilege-escalation-vulnerability?_s_id=cve https://patchstack.com/database/wordpress/plugin/wordpress-flat-countdown/vulnerability/wordpress-responsive-coming-soon-landing-page-holding-page-for-wordpress-3-0-privilege-escalation-vulnerability?_s_id=cve   AA-Team--Premium SEO Pack Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Premium SEO Pack allows SQL Injection.This issue affects Premium SEO Pack: from n/a through 3.3.2.

6.1/10·US-CERT Bulletins·Mali

Primary Source ↗Details →

CyberCrisis🇨🇳China 🇮🇹Italy 🇲🇰North Macedonia+2130d ago

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info SmarterTools--SmarterMail Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. 2025-12-29 10 CVE-2025-52691 https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/   MiniDVBLinux--MiniDVBLinux MiniDVBLinux 5.4 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands as root through the 'command' GET parameter. Attackers can exploit the /tpl/commands.sh endpoint by sending malicious command values to gain root-level system access.

6.1/10·US-CERT Bulletins·Mali

Primary Source ↗Details →

HealthCrisis449d ago

Conflict in DR Congo: What’s happening & how to help Fighting in eastern DR Congo has rapidly escalated in 2025, displacing hundreds of thousands as humanitarian needs skyrocket. Leila Rafei February 20 2025, 1:00pm Doctors Without Borders/Médecins Sans Frontières (MSF) teams working in DRC are witnessing how this latest escalation of violence is impacting people’s lives and compounding the humanitarian crisis, particularly in camps where displaced people are sheltering. As the conflict continues to unfold, here’s what to know about what’s happening in eastern DRC and how to help.

6.1/10·Doctors Without Borders (MSF)

Primary Source ↗Details →

HealthCrisis🇸🇩Sudan 🇹🇩Chad 🇸🇸South Sudan954d ago

Sudan crisis response How MSF is responding to one of the world’s largest humanitarian crises. Leila Rafei October 4 2023, 8:36am Since then, people have been enduring extreme violence that has devastated every aspect of their lives. As the war destroys infrastructure, displaces communities, and blocks the movement of aid, millions of people are now facing acute food insecurity and recurring disease outbreaks, in addition to psychological trauma.

6.1/10·Doctors Without Borders (MSF)

Primary Source ↗Details →

CyberCrisis🇺🇸United States6d ago

The hacking group ShinyHunters stole roughly 6.65 terabytes of data from the educational platform Canvas, affecting nearly 9,000 schools and millions of students worldwide, and has been extorting individual institutions to prevent their data from being publicly released. The FBI has acknowledged the breach, and while Canvas has been restored online, stolen data remains at risk of exposure as some schools enter negotiations with the hackers.

6.0/10·Dawn

Primary Source ↗Details →

CyberCrisis🇭🇷Croatia7d ago

The ShinyHunters hacking group has claimed responsibility for a major breach of Canvas, the widely-used learning management software, with up to 9,000 universities and schools potentially affected by the attack.

6.0/10·Index.hr

Primary Source ↗Details →

CyberCrisis🇰🇵North Korea 🇨🇳China10d ago

The North Korean state-sponsored hacking group ScarCruft infiltrated a video game platform's software supply chain, embedding a backdoor called BirdCall into its components to spy on ethnic Koreans living in China — marking a shift from the group's previous Windows-only targeting approach.

6.0/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇨🇳China10d ago

Attackers are actively exploiting a critical remote code execution flaw in Weaver E-cology, a popular enterprise office automation platform, with a CVSS score of 9.8 — meaning no login is required to compromise affected systems running versions released before March 12, 2026.

6.0/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇺🇸United States11d ago

Multiple proof-of-concept exploits emerged quickly after an authentication-bypass flaw was made public, and at least one researcher says the vulnerability had already been exploited in the wild for a month before disclosure — suggesting attackers had a significant head start.

6.0/10·Dark Reading

Primary Source ↗Details →

CyberCrisis🇲🇱Mali15d ago

Attackers compromised the popular Python Lightning package and published two trojanized versions capable of stealing credentials, with four cybersecurity firms confirming the supply chain intrusion affected versions 2.6.2 and 2.6.3 released on April 30, 2026.

6.0/10·The Hacker News·Mali

Primary Source ↗Details →

CyberCrisis🇺🇸United States22d ago

A threat actor tracked as UAT-4356 is actively exploiting two known vulnerabilities in Cisco Firepower network security devices, gaining unauthorized access to unpatched systems — a campaign flagged by Cisco's Talos intelligence team.

6.0/10·Cisco Talos Intelligence

Primary Source ↗Details →

CyberCrisis🇺🇸United States24d ago

Cybercriminals in 2025 are increasingly targeting vulnerabilities in multi-factor authentication systems and weaponizing legitimate, stolen credentials to launch convincing phishing attacks from trusted business accounts. The shift signals a coordinated focus on exploiting organizational trust—a fundamental weakness in everyday business security workflows.

6.0/10·Cisco Talos Intelligence

Primary Source ↗Details →