TheGentlemen Ransomware Toolkit Found on Russian Proton66 Server

Wiz Research's first Shai-Hulud 2.0 report: ~700 trojanized npm packages (Zapier, ENS, PostHog, Postman), 25,000+ repos leaking stolen secrets, and a preinstall variant widening the blast radius.

An overview of ransomware as a criminal business model, tracing its economic lifecycle from ransom payments to RaaS toolkits, with guidance on prevention, detection, and attack simulation readiness.

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.

CrowdStrike identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript-based information stealer PhantomRaven.

Wiz details the Shai-Hulud npm worm — malicious releases harvested secrets with TruffleHog, dumped them to public GitHub repos and self-propagated via stolen npm tokens across 100+ packages.

Check Point reports a surge of COVID-19 themed domains and dark web sales, with malware campaigns (AZORult, Emotet, TrickBot) and APT36, BabyShark operations exploiting the pandemic.