📃Title: Fighting Spyware: An Update
📅Date: 2026-06-08
🔗References:
https://about.fb.com/news/2026/06/fighting-spyware-an-update-from-whatsapp/
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• surveillance-vendor="NSO group"
mitre-attack-pattern=[]
MISP event uuid: 6268df24-e703-42f7-a6af-8313400d290f
📅Date: 2026-06-08
🔗References:
https://about.fb.com/news/2026/06/fighting-spyware-an-update-from-whatsapp/
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• surveillance-vendor="NSO group"
mitre-attack-pattern=[]
MISP event uuid: 6268df24-e703-42f7-a6af-8313400d290f
Meta Newsroom
Fighting Spyware: An Update From WhatsApp
WhatsApp caught and disrupted spear phishing attempts linked to NSO, a spyware firm blacklisted by the US government.
📃Title: Phishing Attacks Leverage TikTok, Instagram Reels
📅Date: 2026-06-09
🔗References:
https://www.reversinglabs.com/blog/social-media-attacks-phishing
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• target="broad-based"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"
MISP event uuid: 2f8fa130-d7a4-4f88-ab56-c30a49a24645
📅Date: 2026-06-09
🔗References:
https://www.reversinglabs.com/blog/social-media-attacks-phishing
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• target="broad-based"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"
MISP event uuid: 2f8fa130-d7a4-4f88-ab56-c30a49a24645
ReversingLabs
Social Media Attacks Target One Tutorial at a Time | RL Blog
ReversingLabs has discovered two phishing techniques on TikTok and Instagram leveraging short-form videos. Here’s how they work.
📃Title: Technical Analysis of MLTBackdoor
📅Date: 2026-06-09
🔗References:
https://www.zscaler.com/blogs/security-research/technical-analysis-mltbackdoor
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="malware-analysis"
• target="broad-based"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• producer="Zscaler"
mitre-attack-pattern=['T1497.001', 'T1082', 'T1106', 'T1005', 'T1140', 'T1055', 'T1497.003', 'T1090', 'T1083', 'T1041', 'T1027', 'T1573.002', 'T1518.001', 'T1059.003', 'T1027.002', 'T1071.001', 'T1105', 'T1564.004', 'T1055.001']
MISP event uuid: 1e7ef089-c72a-4013-a7ea-a5b3e9c56c8c
📅Date: 2026-06-09
🔗References:
https://www.zscaler.com/blogs/security-research/technical-analysis-mltbackdoor
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="malware-analysis"
• target="broad-based"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• producer="Zscaler"
mitre-attack-pattern=['T1497.001', 'T1082', 'T1106', 'T1005', 'T1140', 'T1055', 'T1497.003', 'T1090', 'T1083', 'T1041', 'T1027', 'T1573.002', 'T1518.001', 'T1059.003', 'T1027.002', 'T1071.001', 'T1105', 'T1564.004', 'T1055.001']
MISP event uuid: 1e7ef089-c72a-4013-a7ea-a5b3e9c56c8c
Zscaler
Technical Analysis of MLTBackdoor | ThreatLabz
MLTBackdoor is a new malware family that provides post-exploitation capabilities on demand and likely used by an initial access broker for ransomware attacks.
📃Title: From Fake Amazon Security Alert to HarborWatch Agent: ClickFix Delivery of a Custom Monitoring RAT
📅Date: 2026-06-08
🔗References:
https://cofense.com/blog/from-fake-amazon-security-alert-to-harborwatch-agent-clickfix-delivery-of-a-custom-monitoring-rat
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• producer="Cofense"
mitre-attack-pattern=['T1053.005', 'T1132.001', 'T1036.005', 'T1566.002', 'T1082', 'T1005', 'T1140', 'T1497.003', 'T1083', 'T1036.004', 'T1057', 'T1041', 'T1059.001', 'T1204.003', 'T1027', 'T1573', 'T1564.003', 'T1071.001', 'T1018', 'T1204.001']
MISP event uuid: 59c95ca0-4902-4443-be40-3629edf6d854
📅Date: 2026-06-08
🔗References:
https://cofense.com/blog/from-fake-amazon-security-alert-to-harborwatch-agent-clickfix-delivery-of-a-custom-monitoring-rat
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• producer="Cofense"
mitre-attack-pattern=['T1053.005', 'T1132.001', 'T1036.005', 'T1566.002', 'T1082', 'T1005', 'T1140', 'T1497.003', 'T1083', 'T1036.004', 'T1057', 'T1041', 'T1059.001', 'T1204.003', 'T1027', 'T1573', 'T1564.003', 'T1071.001', 'T1018', 'T1204.001']
MISP event uuid: 59c95ca0-4902-4443-be40-3629edf6d854
Cofense
From Fake Amazon Security Alert to HarborWatch Agent: ClickFix Delivery of a Custom Monitoring RAT
The Cofense Phishing Defense Center has identified an Amazon-themed malware delivery campaign that abuses the ClickFix self-infection technique to deliver a custom monitoring RAT known as HarborWatch Agent. This campaign highlights a growing trend in the…
📃Title: Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)
📅Date: 2026-06-08
🔗References:
https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: 💉 Vulnerability
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="critical-vuln"
• target="broad-based"
• TA-category="Ransomware"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• producer="Check Point"
• target-information="Taiwan"
• ransomware="Qilin"
mitre-attack-pattern=['T1133', 'T1190', 'T1021', 'T1589.002', 'T1583.003', 'T1090.003', 'T1078', 'T1486', 'T1573', 'T1071.001', 'T1584.004']
MISP event uuid: a362920c-5c4c-41c8-a8ee-358d61175368
📅Date: 2026-06-08
🔗References:
https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: 💉 Vulnerability
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="critical-vuln"
• target="broad-based"
• TA-category="Ransomware"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• producer="Check Point"
• target-information="Taiwan"
• ransomware="Qilin"
mitre-attack-pattern=['T1133', 'T1190', 'T1021', 'T1589.002', 'T1583.003', 'T1090.003', 'T1078', 'T1486', 'T1573', 'T1071.001', 'T1584.004']
MISP event uuid: a362920c-5c4c-41c8-a8ee-358d61175368
Check Point Blog
Patch Critical Check Point VPN Vulnerability (CVE-2026-50751)- Check Point Blog
Check Point issues an urgent hotfix for CVE-2026-50751, a critical IKEv1 VPN authentication bypass vulnerability under active exploitation.
📃Title: From Malspam to Fileless .NET Loader
📅Date: 2026-06-03
🔗References:
https://www.huntress.com/blog/malspam-to-loader-delivery-chain-analysis
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="intrusion-analysis"
• target="targeted"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• producer="Huntress"
mitre-attack-pattern=['T1053.005', 'T1204.002', 'T1573.001', 'T1497.001', 'T1218.004', 'T1566.001', 'T1082', 'T1140', 'T1497.003', 'T1218.003', 'T1112', 'T1562.006', 'T1059.001', 'T1547.001', 'T1562.001', 'T1055.012', 'T1027', 'T1070.004', 'T1071.001', 'T1059.005']
MISP event uuid: 10570b78-9ce0-4a79-a52d-7da02fd487ca
📅Date: 2026-06-03
🔗References:
https://www.huntress.com/blog/malspam-to-loader-delivery-chain-analysis
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="intrusion-analysis"
• target="targeted"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• producer="Huntress"
mitre-attack-pattern=['T1053.005', 'T1204.002', 'T1573.001', 'T1497.001', 'T1218.004', 'T1566.001', 'T1082', 'T1140', 'T1497.003', 'T1218.003', 'T1112', 'T1562.006', 'T1059.001', 'T1547.001', 'T1562.001', 'T1055.012', 'T1027', 'T1070.004', 'T1071.001', 'T1059.005']
MISP event uuid: 10570b78-9ce0-4a79-a52d-7da02fd487ca
Huntress
Inside .NET Loader Analysis: From Malspam to In-Memory Loader | Huntress
A malspam campaign abusing Google's DoubleClick delivers the loader through a five-stage chain that evades detection and blinds Windows telemetry before persisting
📃Title: SilabRAT, What's Your Power?
📅Date: 2026-06-10
🔗References:
https://www.group-ib.com/blog/silabrat-hijackloader-trojan-malware/
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="malware-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• producer="Group-IB"
• malpedia="SnappyClient"
mitre-attack-pattern=['T1548', 'T1134', 'T1087', 'T1071', 'T1560', 'T1547', 'T1217', 'T1185', 'T1115', 'T1059', 'T1555', 'T1001', 'T1114', 'T1480', 'T1041', 'T1083', 'T1657', 'T1562', 'T1056', 'T1571', 'T1027', 'T1057', 'T1021', 'T1053', 'T1113', 'T1518', 'T1539', 'T1218', 'T1082', 'T1552', 'T1204', 'T1497', 'T1047']
MISP event uuid: 447672a5-3ae6-43ed-a720-ef117e9eda12
📅Date: 2026-06-10
🔗References:
https://www.group-ib.com/blog/silabrat-hijackloader-trojan-malware/
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="malware-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• producer="Group-IB"
• malpedia="SnappyClient"
mitre-attack-pattern=['T1548', 'T1134', 'T1087', 'T1071', 'T1560', 'T1547', 'T1217', 'T1185', 'T1115', 'T1059', 'T1555', 'T1001', 'T1114', 'T1480', 'T1041', 'T1083', 'T1657', 'T1562', 'T1056', 'T1571', 'T1027', 'T1057', 'T1021', 'T1053', 'T1113', 'T1518', 'T1539', 'T1218', 'T1082', 'T1552', 'T1204', 'T1497', 'T1047']
MISP event uuid: 447672a5-3ae6-43ed-a720-ef117e9eda12
Group-IB
SilabRAT, What’s Your Power?
SilabRAT (aka SnappyClient) is an advanced Remote Access Trojan (RAT) sold as a Malware-as-a-Service (MaaS) on Darkweb forums. Developed by the threat actor "o1oo1," SilabRAT is heavily focused on financial gain through credential theft. It offers stability…
📃Title: Ransomware Analysis: Go Binary and Fast Encryption
📅Date: 2026-06-09
🔗References:
https://darkatlas.io/blog/how-a-go-binary-locks-down-enterprise-networks-in-minutes-the-story-behind-gentlemen-ransomware
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="TA-profile"
• sub-category="malware-analysis"
• TA-category="Ransomware"
• target="broad-based"
• detection-rules="yara-from-src"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• target-information="United States"
• target-information="Brazil"
• target-information="Germany"
• target-information="United Kingdom"
• ransomware="the gentlemen"
mitre-attack-pattern=['T1053.005', 'T1047', 'T1003', 'T1489', 'T1069.002', 'T1135', 'T1082', 'T1070.003', 'T1140', 'T1021.002', 'T1021.006', 'T1070.001', 'T1083', 'T1059.001', 'T1547.001', 'T1562.001', 'T1027', 'T1486', 'T1018', 'T1490']
MISP event uuid: c92fa0fa-d0dc-4c67-b387-52edb9b647d7
📅Date: 2026-06-09
🔗References:
https://darkatlas.io/blog/how-a-go-binary-locks-down-enterprise-networks-in-minutes-the-story-behind-gentlemen-ransomware
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="TA-profile"
• sub-category="malware-analysis"
• TA-category="Ransomware"
• target="broad-based"
• detection-rules="yara-from-src"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• target-information="United States"
• target-information="Brazil"
• target-information="Germany"
• target-information="United Kingdom"
• ransomware="the gentlemen"
mitre-attack-pattern=['T1053.005', 'T1047', 'T1003', 'T1489', 'T1069.002', 'T1135', 'T1082', 'T1070.003', 'T1140', 'T1021.002', 'T1021.006', 'T1070.001', 'T1083', 'T1059.001', 'T1547.001', 'T1562.001', 'T1027', 'T1486', 'T1018', 'T1490']
MISP event uuid: c92fa0fa-d0dc-4c67-b387-52edb9b647d7
📃Title: PHISH ALERT: Press Play for Compromise — Voicemail Phishing Kit Bundles SSO Hijacking, Credential Theft, and RMM Delivery
📅Date: 2026-06-09
🔗References:
https://x.com/Kb4Threatlabs/status/2064374959989043207
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
mitre-attack-pattern=['T1132.001', 'T1539', 'T1036.005', 'T1566.002', 'T1598.003', 'T1566.001', 'T1608.001', 'T1219', 'T1583.001', 'T1185', 'T1056.003', 'T1528', 'T1598.002', 'T1566', 'T1027', 'T1102.002', 'T1071.001', 'T1584.004', 'T1204.001', 'T1550.001']
MISP event uuid: 4a9ac54f-35f0-4d1a-a3b2-3ce5b9329fc0
📅Date: 2026-06-09
🔗References:
https://x.com/Kb4Threatlabs/status/2064374959989043207
🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
mitre-attack-pattern=['T1132.001', 'T1539', 'T1036.005', 'T1566.002', 'T1598.003', 'T1566.001', 'T1608.001', 'T1219', 'T1583.001', 'T1185', 'T1056.003', 'T1528', 'T1598.002', 'T1566', 'T1027', 'T1102.002', 'T1071.001', 'T1584.004', 'T1204.001', 'T1550.001']
MISP event uuid: 4a9ac54f-35f0-4d1a-a3b2-3ce5b9329fc0
X (formerly Twitter)
KB4ThreatLabs (@Kb4Threatlabs) on X
PHISH ALERT: Press Play for Compromise — Voicemail Phishing Kit Bundles SSO Hijacking, Credential Theft, and RMM Delivery
KnowBe4 ThreatLabs is tracking an advanced voicemail-themed campaign utilizing local HTML attachments to hijack Microsoft 365 sessions…
KnowBe4 ThreatLabs is tracking an advanced voicemail-themed campaign utilizing local HTML attachments to hijack Microsoft 365 sessions…
📃Title: China-Linked Fake Consulting Sites Targeting US Clearance Holders Seized
📅Date: 2026-06-10
🔗References:
https://hackread.com/fbi-seizes-china-fake-consulting-sites-us-clearance/
🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="report"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• target-information="United States"
• country="china"
mitre-attack-pattern=[]
MISP event uuid: 5161867f-df57-43a4-9e41-d2cf2b309ad4
📅Date: 2026-06-10
🔗References:
https://hackread.com/fbi-seizes-china-fake-consulting-sites-us-clearance/
🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="report"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"
🔖MISP Galaxies:
• target-information="United States"
• country="china"
mitre-attack-pattern=[]
MISP event uuid: 5161867f-df57-43a4-9e41-d2cf2b309ad4
Hackread
FBI Seizes China-Linked Fake Consulting Sites Targeting US Clearance Holders
The Justice Department and FBI seized 13 fake consulting websites that officials say targeted US clearance holders with paid research work designed to obtain sensitive government information.
📃Title: [Ransomware] Unconfirmed: Ked**
📅Date: 2026-06-16
🔗References: https://www.ransomware.live/id/S2VkYWhAbm92YQ==
🔖Rectifyq Taxonomies:
Relevancy: 🔴 Highly Relevant
Category: 💥 Data Breach
- TA-category="Ransomware"
🔖MISP Galaxies:
- target-information="Malaysia"
- sector="Not Found"
- ransomware="nova"
mitre-attack-pattern=[]
MISP event uuid: 242eb3b9-0164-4c40-8914-89f6c183e490
📅Date: 2026-06-16
🔗References: https://www.ransomware.live/id/S2VkYWhAbm92YQ==
🔖Rectifyq Taxonomies:
Relevancy: 🔴 Highly Relevant
Category: 💥 Data Breach
- TA-category="Ransomware"
🔖MISP Galaxies:
- target-information="Malaysia"
- sector="Not Found"
- ransomware="nova"
mitre-attack-pattern=[]
MISP event uuid: 242eb3b9-0164-4c40-8914-89f6c183e490
Ransomware.live
Victim: Kedah – nova
Ransomware.live discovered on 2026-06-16 that Kedah has been claimed by Nova ransomware group
Rectifyq Cybersecurity News 🇲🇾 pinned «📃Title: [Ransomware] Unconfirmed: Ked** 📅Date: 2026-06-16 🔗References: https://www.ransomware.live/id/S2VkYWhAbm92YQ== 🔖Rectifyq Taxonomies: Relevancy: 🔴 Highly Relevant Category: 💥 Data Breach - TA-category="Ransomware" 🔖MISP Galaxies: - target-infor…»