Grivyonx Intelligence Hub
Zero-days, ransomware, data breaches and active exploitation, explained with practical defence advice.
A recent cyberattack on the Philippines Nuclear Research Institute has exposed critical infrastructure data after threat actors exploited outdated, unpatched software. The breach resulted in the theft of reactor databases, personnel files, and stored credentials.
By Gourav Rajput
A dark web marketplace is selling over 153 million stolen driver licenses from the U.S. and Canada. The FBI's New Orleans division has launched an official inquiry into the source of these illicit images, which originate from a major Louisiana identity verification provider.
By Gourav Rajput
Security researchers have raised urgent alarms after discovering that threat actors are actively exploiting a critical authentication bypass vulnerability in JFrog's Artifactory platform. The flaw, tracked as CVE-2026-82329, provides attackers with a direct pathway to obtain administrative privileges on compromised systems, potentially exposing sensitive software artifacts and internal infrastructure to further compromise.
By Gourav Rajput
Ransomware groups are increasingly recruiting insiders to bypass defenses, leading to costly breaches. Companies face millions in losses as malicious employees or contractors become a preferred vector for attackers.
By Gourav Rajput
Security researchers have observed active exploitation of CVE-2025-0768, a critical remote code execution vulnerability in the Langflow low-code AI development platform. The flaw allows unauthenticated attackers to execute arbitrary code on affected instances, posing severe risks to organizations building AI applications. This article examines the technical mechanics, real-world impact, and urgent mitigation steps required.
By Gourav Rajput
A severe authentication bypass vulnerability in JFrog Artifactory is being actively exploited by threat actors to generate administrative access tokens. WatchTowr researchers confirmed that attacks began within days of public disclosure, underscoring the urgency of immediate patching.
By Gourav Rajput
A sophisticated threat operation has been systematically exploiting vulnerabilities across Brazil's financial infrastructure, with researchers linking the campaign to hundreds of fraudulent transactions affecting multiple sectors. Security analysts have identified the group as Breeze Comet, formerly tracked as UNC5669, focusing specifically on manipulation of payment processing systems and banking applications.
By Gourav Rajput
Security researchers have uncovered a sophisticated supply chain attack involving 13 malicious Composer packages on Packagist. These packages inject harmful JavaScript into Vietnamese movie and comic streaming sites, targeting unpatched iPhones to steal cryptocurrency wallet recovery phrases. The attack combines mobile ad fraud, gambling redirects, and advanced spyware deployment, posing serious risks to both website operators and unsuspecting visitors who fail to update their iOS devices regularly.
By Gourav Rajput
A sophisticated cyber campaign known as ClickFix has successfully breached 31 organizations by leveraging the Polygon blockchain as a decentralized command-and-control infrastructure. Dubbed EtherHiding, this technique allows attackers to dynamically update malicious infrastructure, making detection significantly harder. Security experts warn that the abuse of public blockchains for malware operations signals a dangerous evolution in threat actor tactics. By embedding malicious payloads directly on-chain, attackers gain resilience against takedowns and a level of anonymity that traditional hosting cannot provide. The ClickFix operation highlights how emerging web technologies and decentralized systems are being repurposed for cybercrime at scale.
By Gourav Rajput
A sophisticated Iranian threat actor has been linked to an intricate campaign that weaponizes job recruitment processes. The group is leveraging malicious coding challenges to deliver cross-platform remote access trojans capable of compromising both Linux and macOS environments. Security researchers have uncovered two previously unknown malware families that demonstrate the group's evolving technical capabilities.
By Gourav Rajput
Astra has achieved a historic milestone by becoming the first OpenAI model to meet the Critical cybersecurity capability threshold under the Preparedness Framework. This breakthrough highlights significant advancements in AI safety and introduces new safeguards for future releases.
By Gourav Rajput
New research from VulnCheck uncovers that malicious hackers are actively exploiting two severe security flaws in Langflow and Ruby on Rails to conduct credential probing campaigns and establish command-and-control infrastructure. The findings underscore the growing urgency for organizations to patch these critical vulnerabilities immediately.
By Gourav Rajput
The TerminalFix campaign represents a alarming evolution in enterprise-targeted cyberattacks, leveraging ClickFix-style social engineering combined with PowerShell exploitation. This multistage threat employs reverse tunnels to penetrate organizational defenses, signaling a dangerous shift in how adversaries operate within corporate networks.
By Gourav Rajput
Recent high‑profile incidents have highlighted the importance of security guardrails, yet defenders often struggle to keep pace with attackers who ignore established rules. One prominent researcher has publicly reversed his stance, arguing that static controls alone are insufficient in today’s dynamic threat landscape.
By Gourav Rajput
A new security report details how threat actor Silver Fox embeds the ValleyRAT backdoor inside a genuine Chinese wallpaper application. By leveraging a trusted process and exploiting user exclusion habits, the malware evades detection and spreads unnoticed.
By Gourav Rajput
A sophisticated Chinese cyber espionage group known as Fire Ant has broadened its operations beyond VMware hypervisors to compromise Cisco IOS XR routers, TACACS authentication servers, and Linux management platforms. The intrusion, uncovered by incident‑response firm Sygnia, enables the attackers to harvest login credentials and effectively blind security logging systems, making detection far more difficult. This evolution signals a shift toward targeting the core routing and authentication layers that underpin high‑value enterprise networks.
By Gourav Rajput
U.S. Department of Justice revises its earlier statement, clarifying that its agencies were targeted—not victimized—by Chinese threat actors. The correction highlights the need for stronger cyber defenses and accurate threat attribution.
By Gourav Rajput
Microsoft has revealed details about TerminalFix, a new ClickFix variant that exploits fake Cloudflare CAPTCHAs to lure victims into executing malicious commands through Windows Terminal or PowerShell, deploying a reverse-tunnel backdoor in the process.
By Gourav Rajput
