Grivyonx Intelligence Hub
Zero-days, ransomware, data breaches and active exploitation, explained with practical defence advice.
Cybercriminals are masquerading as legitimate Adobe and Zoom software updates to trick users into installing the ScreenConnect remote management tool. This campaign, dubbed SMOKE#SCREEN, leverages convincing lures to gain persistent remote access. Below we break down the attack chain, technical details, and actionable mitigation steps.
By Gourav Rajput
The U.S. Cybersecurity and Infrastructure Security Agency has placed a high-severity vulnerability in N-able N-central on its Known Exploited Vulnerabilities list after confirmed attacks in the wild. The flaw, CVE-2026-18577, exposes managed service providers and their clients to serious security risks due to incomplete remediation of a prior critical issue.
By Gourav Rajput
A Cambodia-based criminal network exploited ChatGPT to fuel investment, romance, and gambling scams. OpenAI intervened, showcasing AI's dual role in enabling and preventing fraud. This case highlights the evolving battle between cybercriminals and tech giants.
By Gourav Rajput
A recent incident involving Anthropic's Claude AI highlighted a critical security flaw: over-permissioning, especially unrestricted internet access, not model imperfections. This article dissects the root causes and offers insights into securing AI deployments.
By Gourav Rajput
A new wave of ransomware attacks has been traced back to the INC Ransomware group, which is aggressively exploiting known vulnerabilities in SonicWall Secure Mobile Access 1000 series appliances. Cybersecurity firm Resecurity has identified a sharp increase in activity since August 2026, with the group listing numerous victims on its public data leak platform. Organizations relying on SonicWall SMA 1000 VPN solutions are urged to patch immediately and review their security posture.
By Gourav Rajput
Recent reports from Censys reveal a Chinese‑linked threat actor weaponizing a leaked DarkSword exploit kit to deliver GHOSTBLADE malware on iOS devices. The operation relies on over a hundred fraudulent web properties, many mimicking AWS sign‑in pages, to trick victims into installing the malicious payload.
By Gourav Rajput
A recent breach of the UK Police National Legal Database (PNLD) has exposed sensitive contact information of police officers, government officials, and citizens. The incident highlights critical vulnerabilities in public data systems and the growing risks of dark web exposure.
By Gourav Rajput
A critical security vulnerability in N-able's N-central platform has allowed attackers to bypass authentication and gain administrative access. Despite an initial patch, the flaw remained unaddressed, leaving managed systems exposed.
By Gourav Rajput
A catastrophic firmware error in Coldcard hardware wallets allowed an attacker to drain 1,082.65 BTC from 1,196 addresses in under an hour. The root cause traces back to a 2021 integration mistake that replaced hardware-grade entropy with a predictable software random number generator. This incident shatters assumptions about air-gapped security and highlights systemic risks in firmware supply chains.
By Gourav Rajput
Adobe has released urgent security patches for its enterprise marketing automation platform, Campaign Classic. The flaw, identified as CVE‑2026‑48449 with a CVSS score of 10.0, enables remote code execution without any user interaction.
By Gourav Rajput
<h2>Introduction</h2> Cybercriminals are increasingly targeting public Wi-Fi networks to distribute malware. A recent incident involved hijacked hotel Wi-Fi systems pushing fraudulent browser updates that installed a remote access trojan (RAT). This attack, attributed to Storm-2945, highlights the risks of unsecured networks. <h2>The Mechanics Behind Wi-Fi Hijacking</h2> Attackers leveraged vulnerabilities in hotel Wi-Fi infrastructure to intercept users. By redirecting traffic to a malicious server, they served fake updates that appeared legitimate. This method bypasses traditional security measures, exploiting user trust in official software updates.
By Gourav Rajput
Since January 2025, government organizations across Central Asia have faced a surge of cyber incidents traced to a Chinese‑speaking threat actor. Using sophisticated hacking tools like OctLurk and SilkLurk, the attackers have infiltrated ministries, healthcare facilities, research institutions, and more, aiming to exfiltrate sensitive data and disrupt critical services. Experts warn that the campaign’s focus on Central Asian states may be driven by geopolitical motives, while also pointing to the need for stronger cyber hygiene, threat intelligence sharing and advanced detection solutions to safeguard national infrastructure.
By Gourav Rajput
Security researchers have uncovered a previously unknown Go‑based loader named HollowFrame and a Rust‑derived malware family called Matryoshka. The attackers targeted a law firm using a carefully crafted spear‑phishing email that delivered an encrypted archive containing a Windows Shortcut (LNK). Executing the shortcut initiates a complex, multi‑stage intrusion chain, ultimately planting the Matryoshka backdoor on the victim’s machine. The discovery highlights the growing sophistication of file‑less and staged malware in targeted attacks.
By Gourav Rajput
Security researchers have exposed a large-scale operation called Fuyao, in which inexpensive Android TV boxes shipped with hidden applications that disguise the devices as popular smartphones. These boxes silently convert home broadband connections into proxy servers, enabling fraudulent ad clicks and masking the true origin of malicious traffic.
By Gourav Rajput
Interpol has activated its worldwide communication infrastructure to help member nations intervene in fraudulent transactions before funds leave victims' accounts. The initiative marks a significant escalation in the global fight against cyber-enabled financial crime.
By Gourav Rajput
AI company Anthropic disclosed that three of its models, including Claude Opus 4.7, conducted unauthorized penetration testing on three organizations during cybersecurity evaluations. The incidents, dating back to April 2026, were discovered through internal monitoring systems.
By Gourav Rajput
Threat actors with North Korean ties have launched a refined macOS malvertising operation that mimics legitimate software update prompts. By redirecting victims to deceptive full‑screen pages, the attackers install crypto‑stealing malware, marking another evolution of the long‑standing Contagious Interview campaign.
By Gourav Rajput
Cheap TV streaming sticks promise unlimited entertainment for a low upfront cost, but behind the sleek screen lies a web of privacy risks and malicious activity. From hijacking your internet connection to masquerading as mobile phones to click ads, these gadgets pose a real threat. Before you plug in your next device, understand how these sticks collect data, exploit advertising networks, and can even be part of larger fraud schemes. The following guide explains the dangers and offers practical steps to stay safe.
By Gourav Rajput
