TL;DR Nova did not begin as Nova. The ransomware-as-a-service operation first emerged publicly in March 2025 under the name RALord, advertising a Rust-based ransomware payload, recruiting…
Read morer57 is a high-volume database/access broker, not a single-campaign actor. Activity spans 40+ countries across ~160 threads dated late 2023 through mid-2026, with a clear tiering:…
Read moreTL;DR This is Part 2 of our investigation into Lawxsz, an Argentinian threat actor behind the Valkyrie, Prysmax, and Packit stealers, along with several RATs and…
Read moreIn the last blog, we examined how combolists are built from the raw sources (breach dumps, infostealer logs, and SQLi mass exploitation), the curation process, and…
Read moreIntroduction n8n is an open-source node-based workflow automation tool that allows you to connect applications, databases, and AI agents to automate tasks. In this post, we…
Read moreTL;DR We have been tracking a large-scale Chinese smishing campaign targeting multiple regions and industries with primary focus on telecom providers, toll road system, postal services…
Read moreArkanix Stealer is an actively developed credential‑theft malware family that is primarily advertised on Discord, where its operators have been promoting rapid updates and new feature…
Read moreWhat Is Valkyrie Stealer? Valkyrie Stealer is a C++ infostealer designed to collect credentials, system information, browser data, messaging-app sessions, and other user assets from Windows…
Read moreWho is APT27? APT27 — also known as Emissary Panda, Iron Tiger, and LuckyMouse — is a Chinese state-sponsored cyber-espionage group active since at least 2010.…
Read moreRun a free dark web report for your domain: breached credentials, infostealer logs and dark web mentions in seconds.
