One threat actor responsible for 83% of recent Ivanti RCE attacks

1. Executive Summary (BLUF)

Targeted campaign identified involving infrastructure clusters and tactical overlap. Recommended urgency: Routine.

• One threat actor responsible for 83% of recent Ivanti RCE attacks: Threat intelligence observations show that a single threat actor is responsible for most of the active exploitation of two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-21962 and CVE-2026-24061. [...]
• Snail mail letters target Trezor and Ledger users in crypto-theft attacks: Threat actors are sending physical letters pretending to be from Trezor and Ledger, makers of cryptocurrency hardware wallets, to trick users into submitting recovery phrases in crypto theft attacks. [...]
• Fake job recruiters hide malware in developer coding challenges: A new variation of the fake recruiter campaign from North Korean threat actors is targeting JavaScript and Python developers with cryptocurrency-related tasks. [...]
• Claude LLM artifacts abused to push Mac infostealers in ClickFix attack: Threat actors are abusing Claude artifacts and Google Ads in ClickFix campaigns that deliver infostealer malware to macOS users searching for specific queries. [...]
• Louis Vuitton, Dior, and Tiffany fined $25 million over data breaches: South Korea has fined luxury fashion brands Louis Vuitton, Christian Dior Couture, and Tiffany $25 million for failing to implement adequate security measures, which facilitated unauthorized access and the exposure of data belonging to more than 5.5 million customers. [...]
• Google Ties Suspected Russian Actor to CANFAIL Malware Attacks on Ukrainian Orgs: A previously undocumented threat actor has been attributed to attacks targeting Ukrainian organizations with malware known as CANFAIL. Google Threat Intelligence Group (GTIG) described the hacking group as possibly affiliated with Russian intelligence services. The threat actor is assessed to have targeted defense, military, government, and energy organizations within the Ukrainian regional and
• Google Links China, Iran, Russia, North Korea to Coordinated Defense Sector Cyber Operations: Several state-sponsored actors, hacktivist entities, and criminal groups from China, Iran, North Korea, and Russia have trained their sights on the defense industrial base (DIB) sector, according to findings from Google Threat Intelligence Group (GTIG). The tech giant's threat intelligence division said the adversarial targeting of the sector is centered around four key themes: striking defense
• UAT-9921 Deploys VoidLink Malware to Target Technology and Financial Sectors: A previously unknown threat actor tracked as UAT-9921 has been observed leveraging a new modular framework called VoidLink in its campaigns targeting the technology and financial services sectors, according to findings from Cisco Talos. "This threat actor seems to have been active since 2019, although they have not necessarily used VoidLink over the duration of their activity," researchers Nick
• Malicious Chrome Extensions Caught Stealing Business Data, Emails, and Browsing History: Cybersecurity researchers have discovered a malicious Google Chrome extension that's designed to steal data associated with Meta Business Suite and Facebook Business Manager. The extension, named CL Suite by @CLMasters (ID: jkphinfhmfkckkcnifhjiplhfoiefffl), is marketed as a way to scrape Meta Business Suite data, remove verification pop-ups, and generate two-factor authentication (2FA) codes.
• npm’s Update to Harden Their Supply Chain, and Points to Consider: In December 2025, in response to the Sha1-Hulud incident, npm completed a major authentication overhaul intended to reduce supply-chain attacks. While the overhaul is a solid step forward, the changes don’t make npm projects immune from supply-chain attacks. npm is still susceptible to malware attacks – here’s what you need to know for a safer Node community. Let’s start with the original
• Student Loan Breach Exposes 2.5M Records: 2.5 million people were affected, in a breach that could spell more trouble down the line.
• Watering Hole Attacks Push ScanBox Keylogger: Researchers uncover a watering hole attack likely carried out by APT TA423, which attempts to plant the ScanBox JavaScript-based reconnaissance tool.
• Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms: Over 130 companies tangled in sprawling phishing campaign that spoofed a multi-factor authentication system.
• Ransomware Attacks are on the Rise: Lockbit is by far this summer’s most prolific ransomware group, trailed by two offshoots of the Conti group.
• Cybercriminals Are Selling Access to Chinese Surveillance Cameras: Tens of thousands of cameras have failed to patch a critical, 11-month-old CVE, leaving thousands of organizations exposed.
• Zscaler-SquareX Deal Boosts Zero Trust, Secure Browsing Capabilities: Zscaler's acquisition of SquareX comes as competitors like CrowdStrike and Palo Alto Networks are also investing in secure browser technologies.
• Microsoft Under Pressure to Bolster Defenses for BYOVD Attacks: Threat actors are exploiting security gaps to weaponize Windows drivers and terminate security processes in targeted networks, and there may be no easy fixes in sight.
• Nation-State Hackers Put Defense Industrial Base Under Siege: Espionage groups from China, Russia and other nations burned at least two dozen zero-days in edge devices in attempts to infiltrate defense contractors' networks.
• AI Agents 'Swarm,' Security Complexity Follows Suit: As AI deployments scale and start to include packs of agents autonomously working in concert, organizations face a naturally amplified attack surface.
• Ivanti EPMM Zero-Day Bugs Spark Exploit Frenzy — Again: It's time to phase out the "patch and pray" approach, eliminate needless public interfaces, and enforce authentication controls, one expert says.

"No specific community attribution found."

DeviceNetworkEvents
| where RemoteUrl contains "suspicious-entity"
| summarize count() by DeviceName, RemoteUrl

index=network_logs () | stats count by src_ip, dest_url