ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Oct 16, 2026 · Cybersecurity Dive

    China-Nexus Espionage Actor Exploits BeyondTrust Tool in Zero-Day Campaign

    A China-linked espionage group is actively targeting a BeyondTrust support tool, exploiting a zero-day vulnerability to harvest credentials and sensitive information.

    What changed

    Recent intelligence has revealed that a China-nexus espionage actor is leveraging a zero-day vulnerability in a BeyondTrust support tool. This campaign is focused on credential harvesting and the extraction of sensitive data from affected systems.

    Who is affected

    Organizations utilizing BeyondTrust support tools are at heightened risk due to this ongoing campaign. The potential for credential theft and data compromise poses significant threats to operational integrity.

    The following groups are particularly vulnerable:

    • Enterprises using BeyondTrust for remote support and management.
    • Government agencies that rely on BeyondTrust tools for secure operations.
    • Healthcare organizations that may use these tools for remote assistance.
    • Any third-party vendors integrating BeyondTrust solutions into their services.

    What to do

    Security teams should prioritize immediate assessments of their BeyondTrust deployments. Implementing robust monitoring and response strategies is crucial to mitigate potential impacts from this threat.

    Recommended actions include:

    • Review and update security configurations for BeyondTrust tools.
    • Monitor for unusual access patterns or credential misuse.
    • Educate staff on recognizing phishing attempts and other social engineering tactics.
    • Engage with threat intelligence services for updates on this ongoing campaign.

    Original report

  2. Oct 16, 2026 · Dark Reading

    Ransomware Negotiator Arrest Highlights Need for Oversight

    The recent arrest of a prominent ransomware negotiator underscores the urgent need for enhanced oversight in vendor programs to prevent conflicts of interest.

    What changed

    The arrest of a well-known ransomware negotiator has raised significant concerns about the integrity of negotiation practices in the cybersecurity landscape. This incident highlights the potential for conflicts of interest and the necessity for rigorous oversight mechanisms.

    As ransomware attacks continue to escalate, the role of negotiators has become increasingly critical, making it essential to ensure that these individuals operate with transparency and accountability.

    Who is affected

    Organizations relying on third-party negotiators for ransomware incidents must reassess their vendor management practices. The implications of this arrest extend to various sectors, particularly those heavily targeted by cybercriminals.

    The following groups are particularly impacted:

    • Businesses engaging with ransomware negotiators for incident response.
    • Cybersecurity firms that provide negotiation services.
    • Insurance companies that cover ransomware payments.
    • Government agencies involved in cybersecurity and public safety.

    What to do

    Organizations should conduct a thorough review of their vendor relationships, particularly those involving ransomware negotiation services. Implementing stricter oversight and due diligence processes can mitigate risks associated with potential conflicts of interest.

    Additionally, fostering a culture of transparency and ethical practices within the cybersecurity community is crucial to maintaining trust and effectiveness in incident response.

    • Evaluate existing vendor contracts and negotiation practices.
    • Enhance due diligence processes for selecting negotiation partners.
    • Establish clear guidelines for ethical conduct in negotiations.
    • Consider training programs for internal teams on vendor oversight.

    Original report