ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Oct 16, 2026 · The Record

    Zero-Day Vulnerability in BeyondTrust IT Support Software Exploited by Suspected Chinese Espionage Group

    A new zero-day vulnerability in BeyondTrust IT support software is being exploited by a suspected Chinese state-backed group for espionage activities.

    What changed

    A zero-day vulnerability has been identified in BeyondTrust IT support software, which is reportedly being exploited by a suspected Chinese espionage group. This development raises serious concerns regarding the security of systems utilizing this software.

    The exploitation of this vulnerability allows attackers to conduct espionage operations, potentially compromising sensitive information and organizational integrity.

    Who is affected

    Organizations using BeyondTrust IT support software are at risk of being targeted by this espionage campaign. The implications of this vulnerability could be significant for various sectors.

    Entities that rely on IT support solutions for operational efficiency may find themselves exposed to unauthorized access and data breaches.

    • BeyondTrust IT support software users
    • Government agencies relying on IT support solutions
    • Private sector companies with sensitive data
    • Organizations in critical infrastructure sectors

    What to do

    Security teams should prioritize assessing their systems for the presence of BeyondTrust IT support software and evaluate their current security posture against potential exploitation.

    Immediate actions include monitoring for unusual activity, applying any available patches, and enhancing network defenses to mitigate risks.

    • Conduct a thorough review of IT support software in use
    • Implement monitoring for suspicious activities
    • Stay updated on vendor communications regarding patches
    • Enhance incident response protocols to address potential breaches

    Original report

  2. Oct 16, 2026 · Help Net Security

    Surge in Phishing Attacks Disguised as Business Opportunities

    A significant rise in phishing attacks leveraging RFQ communications has been observed, posing serious risks to businesses and their email security.

    What changed

    Recent research indicates a dramatic increase in phishing attempts disguised as legitimate business requests, particularly those related to requests for quotations (RFQs). This tactic has seen a 12-fold rise in malicious emails over the past year, highlighting a growing trend in cyber threats targeting business communications.

    The majority of these phishing emails lead to credential-stealing pages, putting sensitive company information at risk.

    Who is affected

    Businesses across various sectors are vulnerable to these phishing attacks, particularly those with active sales and procurement departments.

    Organizations that frequently engage in RFQ processes are at heightened risk, as attackers exploit the familiarity of such communications.

    • Companies in manufacturing and supply chain sectors.
    • Organizations with established procurement processes.
    • Businesses utilizing email as a primary communication tool for quotes and proposals.

    What to do

    Organizations should enhance their email security measures to detect and block phishing attempts. Regular training for employees on recognizing phishing tactics is essential.

    Implementing multi-factor authentication (MFA) can provide an additional layer of security against unauthorized access.

    • Conduct regular cybersecurity awareness training for all employees.
    • Utilize advanced email filtering solutions to identify and quarantine suspicious messages.
    • Encourage reporting of phishing attempts to IT departments for further investigation.

    Original report