📃Title: Disclosing new PebbleDash-based tools
📅Date: 2026-05-14
🔗References:
https://securelist.com/kimsuky-appleseed-pebbledash-campaigns/119785/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• TA-category="APT"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Kaspersky"
• threat-actor="Kimsuky"
• target-information="Brazil"
• target-information="Germany"
• target-information="South Korea"
• sector="Defense"
• sector="Government, Administration"
• malpedia="Appleseed"
• malpedia="PEBBLEDASH"
mitre-attack-pattern=['T1053.005', 'T1113', 'T1132.001', 'T1056.001', 'T1204.002', 'T1573.001', 'T1543.003', 'T1566.001', 'T1005', 'T1140', 'T1219', 'T1055', 'T1112', 'T1041', 'T1059.001', 'T1547.001', 'T1027', 'T1059.003', 'T1071.001', 'T1090.001']

MISP event uuid: 0d8d2f88-341b-4ee7-ae73-5113a3f9d3db

📃Title: Device Code Phishing is an Evolution in Identity Takeover
📅Date: 2026-05-13
🔗References:
https://www.proofpoint.com/us/blog/threat-insight/device-code-phishing-evolution-identity-takeover

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Proofpoint"
mitre-attack-pattern=['T1539', 'T1114', 'T1204.002', 'T1566.002', 'T1598.003', 'T1566.001', 'T1185', 'T1087', 'T1528', 'T1204', 'T1534', 'T1566', 'T1078', 'T1486', 'T1598', 'T1213', 'T1204.001', 'T1078.004', 'T1566.003']

MISP event uuid: 402e1b2f-0ec7-4c71-a016-c3cc30ff9204

📃Title: Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files
📅Date: 2026-05-15
🔗References:
https://unit42.paloaltonetworks.com/gremlin-stealer-evolution/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="malware-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Palo Alto"
• malpedia="Gremlin"
mitre-attack-pattern=['T1056.001', 'T1539', 'T1115', 'T1082', 'T1106', 'T1005', 'T1140', 'T1567', 'T1552', 'T1032', 'T1185', 'T1555.003', 'T1027.001', 'T1528', 'T1041', 'T1027', 'T1081', 'T1567.002', 'T1027.002', 'T1071.001']

MISP event uuid: 6cc3f205-3931-4e73-a46d-b5a657ab4949

📃Title: Kazuar: Anatomy of a nation-state botnet
📅Date: 2026-05-14
🔗References:
https://www.microsoft.com/en-us/security/blog/2026/05/14/kazuar-anatomy-of-a-nation-state-botnet/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="malware-analysis"
• TA-category="APT"
• TA-category="State-Sponsored"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Microsoft"
• target-information="Ukraine"
• malpedia="Kazuar"
• threat-actor="Turla"
mitre-attack-pattern=['T1113', 'T1056.001', 'T1114', 'T1074.001', 'T1082', 'T1071', 'T1005', 'T1055', 'T1071.003', 'T1090', 'T1059', 'T1083', 'T1497', 'T1102', 'T1057', 'T1041', 'T1562.001', 'T1027', 'T1114.002', 'T1573', 'T1095', 'T1132', 'T1027.002', 'T1071.001']

MISP event uuid: 5df6c3a9-4e93-4dc5-bc9f-d50b8ac31856

📃Title: [Ransomware] Unconfirmed: PNS* Ins****** Bro**** Sdn Bhd
📅Date: 2026-05-17
🔗References: https://www.ransomware.live/id/UE5TQiBJbnN1cmFuY2UgQnJva2VycyBTZG4gQmhkQHFpbGlu

🔖Rectifyq Taxonomies:
Relevancy: 🔴 Highly Relevant
Category: 💥 Data Breach
- TA-category="Ransomware"

🔖MISP Galaxies:
- target-information="Malaysia"
- sector="Finance"
- ransomware="Qilin"
mitre-attack-pattern=[]

MISP event uuid: 1cfaf58b-285e-4477-bac1-1ab80f7da206

📃Title: [Ransomware] Unconfirmed: Int************ (+ Tsk************** + Ame******************** + Woo*************
📅Date: 2026-05-13
🔗References: https://www.ransomware.live/id/SW50ZWNlbmcuY29tLm15ICgrIFRza3N5bmVyZ3kuY29tLm15ICsgQW1lbWFudWZhY3R1cmluZy5jb20ubXkgKyBXb29kbm92YS5jb20ubXkpQHBheWxvYWQ=

🔖Rectifyq Taxonomies:
Relevancy: 🔴 Highly Relevant
Category: 💥 Data Breach
- TA-category="Ransomware"

🔖MISP Galaxies:
- target-information="Malaysia"
- sector="Manufacturing"
- ransomware="payload"
mitre-attack-pattern=[]

MISP event uuid: 8958fe77-93e2-4663-9b9f-1fddb1d6bed6

📃Title: [Ransomware] Unconfirmed: Maj*** Per******** Alo* Gaj**
📅Date: 2026-05-17
🔗References: https://www.ransomware.live/id/TWFqbGlzIFBlcmJhbmRhcmFuIEFsb3IgR2FqYWhAcWlsaW4=

🔖Rectifyq Taxonomies:
Relevancy: 🔴 Highly Relevant
Category: 💥 Data Breach
- TA-category="Ransomware"

🔖MISP Galaxies:
- target-information="Malaysia"
- sector="Public Sector"
- ransomware="Qilin"
mitre-attack-pattern=[]

MISP event uuid: c842284d-499a-41d9-82a5-631ed5a1f5ca

📃Title: [Ransomware] Unconfirmed: MSC Gro**
📅Date: 2026-05-18
🔗References: https://www.ransomware.live/id/TVNDIEdyb3VwQGxhbWFzaHR1

🔖Rectifyq Taxonomies:
Relevancy: 🔴 Highly Relevant
Category: 💥 Data Breach
- TA-category="Ransomware"

🔖MISP Galaxies:
- target-information="Malaysia"
- sector="Logistic"
- ransomware="lamashtu"
mitre-attack-pattern=[]

MISP event uuid: 47843fe4-1296-4293-8487-a6e1566e00e2

📃Title: Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities
📅Date: 2026-05-14
🔗References:
https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: 💉 Vulnerability
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="critical-vuln"
• target="broad-based"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Cisco Talos Intelligence Group"
mitre-attack-pattern=['T1003', 'T1552.005', 'T1021.004', 'T1005', 'T1190', 'T1505.003', 'T1090', 'T1083', 'T1552.001', 'T1098', 'T1059.004', 'T1562.001', 'T1078', 'T1027', 'T1573', 'T1496', 'T1070.004', 'T1071.001', 'T1136', 'T1018']

MISP event uuid: fbb6cb43-042c-4d70-99d5-c92d71587c91

📃Title: Spring harvest - Leek Likho group's campaign to hunt for documents
📅Date: 2026-05-15
🔗References:
https://securelist.ru/tr/leek-likho-hunting-for-data-with-tor-and-llms/115601/

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• TA-category="APT"
• target="broad-based"
• topic="ai"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Kaspersky"
• sector="Government, Administration"
• target-information="Belarus"
• target-information="Russia"
mitre-attack-pattern=['T1547', 'T1090', 'T1059']

MISP event uuid: 8483102e-5129-4460-b958-d38750a66fe4

📃Title: Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor
📅Date: 2026-05-14
🔗References:
https://www.darktrace.com/blog/chinese-apt-campaign-targets-entities-with-updated-fdmtp-backdoor

🔖Rectifyq Taxonomies:
Relevancy: 🟡 Somewhat Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• TA-category="APT"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• country="china"
• region="142 - Asia"
mitre-attack-pattern=['T1007', 'T1027', 'T1030', 'T1053', 'T1071', 'T1082', 'T1095', 'T1140', 'T1547', 'T1574', 'T1127', 'T1562', 'T1499', 'T1195', 'T1490', 'T1056', 'T1123', 'T1059', 'T1134', 'T1055', 'T1574.001', 'T1106', 'T1547.001', 'T1053.005']

MISP event uuid: 4583b718-a906-4818-8811-97ba5fae34a6

📃Title: Cato CTRL Threat Research: Suspected China-Linked Threat Actor Targets Global Manufacturer with Undocumented TencShell Malware
📅Date: 2026-05-13
🔗References:
https://www.catonetworks.com/blog/cato-ctrl-suspected-china-linked-threat-actor-targets-global-manufacturer/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="intrusion-analysis"
• target="targeted"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
mitre-attack-pattern=['T1005', 'T1036', 'T1041', 'T1055', 'T1057', 'T1059', 'T1071', 'T1082', 'T1083', 'T1090', 'T1102', 'T1105', 'T1106', 'T1113', 'T1129', 'T1547', 'T1548', 'T1548.002', 'T1070.004', 'T1090.001', 'T1036.008', 'T1571', 'T1620', 'T1547.001', 'T1071.001', 'T1059.003']

MISP event uuid: 2a009741-12ae-4be9-8bd5-9f1fb78483bf

📃Title: Vidar v1.5 in Go: same family, new language, heavy sandbox checks
📅Date: 2026-05-16
🔗References:
https://www.derp.ca/research/vidar-go-sandbox-dead-drop/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="malware-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• malpedia="Vidar"
mitre-attack-pattern=['T1497']

MISP event uuid: 086035cf-56d1-42da-82a8-35dfa8c0e324

📃Title: FlowerStorm unleashes the KrakVM: PhaaS operators turn to VM-based obfuscation
📅Date: 2026-05-14
🔗References:
https://sublime.security/blog/flowerstorm-unleashes-the-krakvm-phaas-operators-turn-to-vm-based-obfuscation/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="tool-profile"
• sub-category="campaign-analysis"
• topic="mobile-attack"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
mitre-attack-pattern=['T1566']

MISP event uuid: 0e1d220e-d9da-4f25-ac9e-469b98eadcad

📃Title: macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain
📅Date: 2026-05-18
🔗References:
https://www.sentinelone.com/blog/shub-reaper-macos-stealer-spoofs-apple-google-and-microsoft-in-a-single-attack-chain/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="malware-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="SentinelOne"
mitre-attack-pattern=['T1560.001', 'T1539', 'T1074.001', 'T1036.005', 'T1555.001', 'T1204.002', 'T1082', 'T1059.002', 'T1005', 'T1555.003', 'T1083', 'T1566', 'T1059.004', 'T1027', 'T1567.002', 'T1543.001', 'T1070.004', 'T1071.001', 'T1102.001']

MISP event uuid: 9f05b1a5-3943-44f0-9c7a-e5523c92663d

📃Title: Active Supply Chain Attack Compromises Packages on npm
📅Date: 2026-05-19
🔗References:
https://socket.dev/blog/antv-packages-compromised

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="supply-chain"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="37ebf9d7-5e9a-466f-a42c-6e60313db868"
• malpedia="Shai-Hulud"
mitre-attack-pattern=['T1059.007', 'T1552.005', 'T1573.001', 'T1106', 'T1219', 'T1552.004', 'T1552.001', 'T1567.001', 'T1059.004', 'T1027', 'T1195.002', 'T1070.004', 'T1071.001', 'T1543.002', 'T1105', 'T1078.004', 'T1552.007']

MISP event uuid: 05e5980c-095e-4789-a521-73f3eb7e7b31

📃Title: Copycat hits another npm package
📅Date: 2026-05-18
🔗References:
https://www.theregister.com/cyber-crime/2026/05/18/shai-hulud-copycat-hits-another-npm-package/5242180

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="supply-chain"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• malpedia="Shai-Hulud"
mitre-attack-pattern=['T1543', 'T1082', 'T1053', 'T1005', 'T1140', 'T1567', 'T1552.004', 'T1016', 'T1087', 'T1059', 'T1552.001', 'T1027', 'T1573', 'T1195.002', 'T1496', 'T1485', 'T1498', 'T1071.001', 'T1552.007']

MISP event uuid: e1975520-e8cf-4ff6-91ab-31ba2c8ec017