Dark Watch

Dark Watch follows active cyber threats, ransomware, malware, cybercrime, espionage, phishing and data breaches. Coverage focuses on how attacks develop, the systems and behaviours they exploit, and what defenders can learn from verified threat research, incident reporting and attacker activity—while clearly separating confirmed facts from unverified claims.

Compromised LiteLLM 1.107.0 package leads to widespread credential theft via Python startup hooks

Dark Watch
On October 21, 2026, a compromised version of the LiteLLM 1.107.0 package was uploaded to the Python Package Index (PyPI), leading to significant credential...

Mirai botnet operators attempt to exploit PHP2Shell vulnerabilities, no confirmed breaches reported

Dark Watch
In a concerning development, operators of the Mirai botnet have begun attempting to exploit critical vulnerabilities in PHP2Shell, following the release of emergency patches...

Columbia, South Carolina, responds to cyberattack disrupting government systems

Dark Watch
The city of Columbia, South Carolina, is currently addressing a cyberattack that has disrupted several government systems, including the MyColaSC platform used for utility...

Fideuram loses €95 million to AI-powered voice impersonation fraud

Dark Watch
Fideuram, the private banking arm of Intesa Sanpaolo, has reportedly lost approximately €95 million (around $108 million) due to a sophisticated AI-powered voice impersonation...

Ransomware operators exploit PAN-OS CVE-2026-0257, targeting GlobalProtect VPN access

Dark Watch
Palo Alto Networks' Unit 42 has reported ongoing exploitation of the PAN-OS vulnerability CVE-2026-0257 by ransomware operators, including groups identified as Spikey Scorpius (also...

MITRE ATT&CK v20 adds techniques for AI abuse, MFA bypass, and water utility attacks

Dark Watch
MITRE recently unveiled version 20 of its ATT&CK framework, introducing significant updates that encompass techniques for AI abuse, multi-factor authentication (MFA) bypass, and attacks...

Moscow police arrest three suspected DataSuckers hackers linked to Dodo Pizza breach

Dark Watch
Russian authorities have detained three suspected members of the DataSuckers hacking group in connection with a cyberattack on Dodo Pizza, a popular restaurant chain....

China-linked Armory Castle exploits BeyondTrust zero-day vulnerability for remote server takeover

Dark Watch
The China-linked cyber espionage group known as Armory Castle has exploited a newly disclosed zero-day vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764, to...
123...185Page 2 of 185

Recent Articles

Cyber Warriors Conclave Chapter X — Beyond the Ballroom