📃Title: InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise
📅Date: 2026-05-05
🔗References:
https://www.trendmicro.com/en_us/research/26/e/installfix-and-claude-code.html

🔖Rectifyq Taxonomies:
Relevancy: 🔴 Highly Relevant
Category: ⚔ Threat
• sub-category="malware-analysis"
• sub-category="campaign-analysis"
• target="broad-based"
• mitre-att&ck="from-original-src"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="x"
• action-taken="linkedin"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Trend Micro"
• target-information="Malaysia"
• target-information="Netherlands"
• target-information="Thailand"
• target-information="United States"
• sector="Education"
• sector="Electronic"
• sector="Food"
• sector="Government, Administration"
mitre-attack-pattern=['T1559.001', 'T1562', 'T1583.008', 'T1218.005', 'T1027', 'T1059.001', 'T1566.002', 'T1059.005']

MISP event uuid: e30b1a07-b830-46e2-bf69-e67eee29d4af

📃Title: Exposing a Global Smishing Operation Across 19 Countries: Governments, Postal Services, and Telecoms Targeted
📅Date: 2026-05-27
🔗References:
https://hunt.io/blog/massive-smishing-campaign-governments-postal-telecoms

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="mobile-attack"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Hunt.io"
• target-information="United States"
• target-information="Albania"
• target-information="Armenia"
• target-information="Bulgaria"
• target-information="Estonia"
• target-information="France"
• target-information="Georgia"
• target-information="Greece"
• target-information="Ireland"
• target-information="Kosovo"
• target-information="Latvia"
• target-information="Lithuania"
• target-information="North Macedonia"
• target-information="Montenegro"
• target-information="Romania"
• target-information="Slovenia"
• target-information="Spain"
• target-information="Trinidad and Tobago"
• target-information="United Kingdom"
mitre-attack-pattern=['T1583', 'T1204.002', 'T1566.002', 'T1598.003', 'T1586.002', 'T1608.001', 'T1583.001', 'T1560', 'T1090', 'T1584', 'T1586', 'T1102', 'T1608', 'T1583.006', 'T1204', 'T1041', 'T1566', 'T1078', 'T1598', 'T1213', 'T1584.001']

MISP event uuid: 36e75fd8-359f-4f84-8258-5f35cf8ed39b

📃Title: A New Threat Actor Targeting the Cryptocurrency Industry's Software Development Infrastructure
📅Date: 2026-05-27
🔗References:
https://www.wiz.io/blog/threat-actors-target-crypto-orgs

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="crypto-related"
• target="broad-based"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Wiz Blog"
mitre-attack-pattern=[]

MISP event uuid: 9672f16b-c5cd-4c1f-82fa-488daf2773c3

📃Title: A miner with a side of RAT: the unintended gift with your TV show or book
📅Date: 2026-05-28
🔗References:
https://securelist.com/video-books-pirates-miners-rat/119943/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="intrusion-analysis"
• sub-category="campaign-analysis"
• target="broad-based"
• TA-category="Cybercrime"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Kaspersky"
mitre-attack-pattern=['T1132.001', 'T1568.002', 'T1071.004', 'T1573.001', 'T1543.003', 'T1497.001', 'T1082', 'T1140', 'T1219', 'T1036', 'T1112', 'T1083', 'T1057', 'T1547.001', 'T1562.001', 'T1055.012', 'T1027', 'T1518.001', 'T1059.003', 'T1574.002', 'T1105']

MISP event uuid: 92c2564d-b7dd-46df-94ff-b63fa34fed48

📃Title: Typosquatted npm packages used to steal cloud and CI/CD secrets
📅Date: 2026-05-28
🔗References:
https://www.microsoft.com/en-us/security/blog/2026/05/28/typosquatted-npm-packages-used-steal-cloud-ci-cd-secrets/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="supply-chain"
• target="broad-based"
• topic="cloud"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Microsoft"
mitre-attack-pattern=['T1033', 'T1059.007', 'T1069.003', 'T1021.004', 'T1082', 'T1083', 'T1552.001', 'T1087.004', 'T1057', 'T1098', 'T1078', 'T1027', 'T1195.002', 'T1071.001', 'T1543.002', 'T1105', 'T1021.001', 'T1550.001', 'T1078.004', 'T1552.007']

MISP event uuid: 129b0e64-c241-431c-9742-ec756cbde228

📃Title: The Gentlemen ransomware: Dissecting a self-propagating Go encryptor
📅Date: 2026-05-28
🔗References:
https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="TA-profile"
• sub-category="malware-analysis"
• TA-category="Ransomware"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Microsoft"
• ransomware="the gentlemen"
mitre-attack-pattern=['T1053.005', 'T1489', 'T1135', 'T1106', 'T1070.003', 'T1021.002', 'T1021.006', 'T1070.001', 'T1021.003', 'T1482', 'T1083', 'T1059.001', 'T1547.001', 'T1562.001', 'T1486', 'T1134', 'T1018', 'T1569.002', 'T1490']

MISP event uuid: 6707c413-a393-496b-92e4-29b1bbb663ec

📃Title: FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet Patch
📅Date: 2026-05-27
🔗References:
https://arcticwolf.com/resources/blog/forticlient-ems-exploited-via-cve-2026-35616-to-deliver-ekz-infostealer-disguised-as-a-fortinet-patch

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="intrusion-analysis"
• sub-category="critical-vuln"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Arctic Wolf"
mitre-attack-pattern=['T1190']

MISP event uuid: 31e1118e-9aa4-4708-8eca-21d21950bfd2

📃Title: Sapphire Sleet Targets macOS
📅Date: 2026-05-29
🔗References:
https://www.levelblue.com/blogs/spiderlabs-blog/sapphire-sleet-targets-macos-in-multi-stage-intrusion-campaign

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• TA-category="APT"
• target="broad-based"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="da7743e9-205e-47b0-8afc-b7aa7a5ae050"
• threat-actor="Lazarus Group"
• threat-actor="STARDUST CHOLLIMA"
mitre-attack-pattern=[]

MISP event uuid: 9805a443-f7d8-4233-9c46-75dea24852bb

📃Title: Kimsuky's Advanced Attack Techniques: JSONPing, Webex Spoofing, and a New HttpSpy Variant
📅Date: 2026-05-27
🔗References:
https://www.enki.co.kr/en/media-center/blog/kimsuky-s-advanced-attack-techniques-jsonping-webex-spoofing-and-a-new-httpspy-variant

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• TA-category="APT"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• threat-actor="Kimsuky"
• target-information="South Korea"
• sector="Military"
mitre-attack-pattern=['T1010', 'T1070.009', 'T1027.010', 'T1134.002', 'T1005', 'T1140', 'T1055.001', 'T1027.009', 'T1027.013', 'T1041', 'T1070.004', 'T1083', 'T1059.007', 'T1204.002', 'T1036.004', 'T1566', 'T1057', 'T1090', 'T1012', 'T1620', 'T1547.001', 'T1053.005', 'T1113', 'T1132.001', 'T1573.001', 'T1497.001', 'T1082', 'T1070.006', 'T1071.001', 'T1059.003']

MISP event uuid: 8852557e-67b3-41c3-a52f-51232fc96b30

📃Title: Operation XENOFISCAL: SideCopy deploying persistent XenoRAT targeting the MoF, Afghanistan
📅Date: 2026-05-29
🔗References:
https://www.seqrite.com/blog/operation-xenofiscal-sidecopy-deploying-persistent-xenorat-targeting-the-mof-afghanistan/

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• TA-category="APT"
• target="broad-based"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Seqrite"
• target-information="Afghanistan"
• threat-actor="SideCopy"
• malpedia="XenoRAT"
mitre-attack-pattern=['T1123', 'T1115', 'T1140', 'T1562.001', 'T1583.001', 'T1568', 'T1573', 'T1090.002', 'T1070.004', 'T1027.011', 'T1564.001', 'T1059.007', 'T1056.001', 'T1218.005', 'T1106', 'T1095', 'T1027', 'T1055', 'T1012', 'T1620', 'T1547.001', 'T1053.005', 'T1113', 'T1518.001', 'T1129', 'T1518', 'T1566.001', 'T1218', 'T1082', 'T1125', 'T1071.001', 'T1059.003']

MISP event uuid: eb0c187a-2b4d-421e-9faa-871606571fb0

📃Title: Operation Dragon Weave: Uncovering a China-Linked Campaign Targeting Czech Republic and Taiwan Using Azure Cloud C2
📅Date: 2026-05-29
🔗References:
https://www.seqrite.com/blog/operation-dragon-weave-uncovering-a-china-linked-campaign-targeting-czech-republic-and-taiwan-using-azure-cloud-c2/

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: 💉 Vulnerability
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="cloud"
• target="broad-based"
• TA-category="APT"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Seqrite"
• target-information="Czech Republic"
• target-information="Taiwan"
mitre-attack-pattern=['T1204.002', 'T1497.001', 'T1566.001', 'T1082', 'T1055', 'T1016', 'T1090', 'T1083', 'T1057', 'T1041', 'T1059.001', 'T1027', 'T1573', 'T1059.005', 'T1574.002', 'T1105', 'T1102.001', 'T1620']

MISP event uuid: 2a39eb24-b765-4968-9c52-198844a7f7f9

📃Title: Reloaded in a modern Remcos RAT Infection
📅Date: 2026-05-29
🔗References:
https://blog.gdatasoftware.com/2026/05/38426-donutloader-remcos-rat

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="intrusion-analysis"
• target="broad-based"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="G DATA"
• malpedia="Remcos"
mitre-attack-pattern=['T1560.001', 'T1059.007', 'T1566.001', 'T1071', 'T1140', 'T1219', 'T1036', 'T1055', 'T1218', 'T1059', 'T1059.001', 'T1027', 'T1564.003', 'T1059.003', 'T1059.005', 'T1105', 'T1620']

MISP event uuid: 8851f4ff-ce5e-4109-a60f-6bdb729a78d5

📃Title: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites
📅Date: 2026-05-30
🔗References:
https://www.silentpush.com/blog/drivesurge/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="TA-profile"
• TA-category="Cybercrime"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Silent Push"
mitre-attack-pattern=['T1588.004', 'T1204.002', 'T1566.002', 'T1140', 'T1583.001', 'T1055', 'T1112', 'T1090.002', 'T1583.006', 'T1059.001', 'T1547.001', 'T1059.004', 'T1027', 'T1203', 'T1059.006', 'T1070.004', 'T1189', 'T1564.001', 'T1204.001']

MISP event uuid: 60f381bf-1ce4-4f1c-bf8f-bbe210033304

📃Title: A stealthy RAT burrowing deep into Android devices
📅Date: 2026-05-26
🔗References:
https://www.welivesecurity.com/en/malware/btmob-stealthy-rat-burrowing-deep-android-devices/

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="malware-analysis"
• sub-category="campaign-analysis"
• topic="mobile-attack"
• target="broad-based"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="ESET"
• target-information="Argentina"
• target-information="Brazil"
• malpedia="BTMOB RAT"
mitre-attack-pattern=[]

MISP event uuid: 0da26aa9-86b0-415a-a8c4-0ce1d326a101

📃Title: Nimbus RAT: How Threat Actors Are Abusing Microsoft Teams and Google Drive to Deploy a Java RAT
📅Date: 2026-05-28
🔗References:
https://www.esentire.com/blog/nimbus-rat-how-threat-actors-are-abusing-microsoft-teams-and-google-drive-to-deploy-a-java-rat

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="intrusion-analysis"
• target="targeted"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="eSentire"
mitre-attack-pattern=['T1560.001', 'T1113', 'T1033', 'T1132.001', 'T1071.004', 'T1114.001', 'T1204.002', 'T1573.001', 'T1566.002', 'T1082', 'T1106', 'T1005', 'T1140', 'T1555', 'T1219', 'T1055', 'T1010', 'T1112', 'T1016', 'T1087', 'T1083', 'T1057', 'T1041', 'T1534', 'T1547.001', 'T1056.002', 'T1027', 'T1102.002', 'T1059.003', 'T1071.001']

MISP event uuid: f5cbcf38-1444-44ec-ba04-af735b61b5b4

📃Title: Malicious npm packages abuse dependency confusion to profile developer environments
📅Date: 2026-05-29
🔗References:
https://www.microsoft.com/en-us/security/blog/2026/05/29/33-malicious-npm-packages-abuse-dependency-confusion-profile-developer-environments/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="supply-chain"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Microsoft"
mitre-attack-pattern=['T1059.007', 'T1036.005', 'T1497.001', 'T1574.001', 'T1082', 'T1106', 'T1140', 'T1059', 'T1083', 'T1497', 'T1102', 'T1552.001', 'T1027', 'T1195.002', 'T1564.003', 'T1071.001', 'T1518', 'T1105', 'T1078.004', 'T1552.007']

MISP event uuid: 1fc9cd4b-9149-47fa-b7ea-3316688e46ea

📃Title: FSB’s matryoshka #1/3 – Gamaredon’s gifts that keeps unpacking – GammaPhish and GammaWorm
📅Date: 2026-06-01
🔗References:
https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="malware-analysis"
• TA-category="APT"
• target="broad-based"
• topic="geopolitical"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Sekoia"
• target-information="Ukraine"
• threat-actor="Gamaredon Group"
mitre-attack-pattern=['T1053.005', 'T1132.001', 'T1204.002', 'T1566.001', 'T1082', 'T1091', 'T1005', 'T1547.009', 'T1112', 'T1020', 'T1547.001', 'T1027', 'T1573', 'T1102.002', 'T1071.001', 'T1059.005', 'T1204.001', 'T1564.004', 'T1102.001']

MISP event uuid: 4b07e628-47c4-46c6-a774-3c500bd9f831

📃Title: Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
📅Date: 2026-06-01
🔗References:
https://socket.dev/blog/mini-shai-hulud-campaign-hits-red-hat-cloud-services-npm-packages

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• topic="supply-chain"
• topic="cloud"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="37ebf9d7-5e9a-466f-a42c-6e60313db868"
• malpedia="Shai-Hulud"
mitre-attack-pattern=[]

MISP event uuid: e150d133-a2a1-4b77-890d-774c4dba737b