🚀 CloudSEK has raised $19M Series B1 Round – Powering the Future of Predictive Cybersecurity
CATEGORIES

Adversary Intelligence

Articles in Blog Posts

June 23, 2026

THE 5060 SIEGE - Industrialized Attacks Against the SIP Telephony Ecosystem

Uncover how an 18-day honeypot captured 15 million automated attacks targeting telephony ecosystems in the "Copy of SIP Honeypot Report.pdf". Download the full report to expose active VoIP fraud networks and access 277,632 recovered attacker passwords.

Written by

Vikas Kundu

June 19, 2026

Inside the FortiBleed Open Directory: A Technical Analysis of What the Attacker Left Behind

An exposed attacker server has revealed FortiBleed’s complete operation—from credential harvesting and GPU-powered cracking to network intrusion and access sales. CloudSEK’s analysis separates verified compromises from inflated claims, uncovering what the attackers actually achieved.

Written by

June 17, 2026

Operation Escaneo: Infrastructure Exposure, TTP Analysis, and Attribution Assessment of an Advanced Intrusion Campaign Against Mexican Federal Agencies and Financial Institutions

An exposed attacker server revealed the inner workings of Operation Escaneo—a sophisticated campaign targeting Latin American governments and financial institutions. CloudSEK maps its custom tools, exploitation chain, persistence tactics and suspected links to MexicanMafia. Read the full investigation.

Written by

Koushik Pal

June 17, 2026

Bluekit Phishing as a Service (PhaaS)

BlueKit is turning phishing into a subscription business, offering 87 ready-made kits, automated account takeover and stealthy peer-to-peer infrastructure. CloudSEK’s investigation reveals how this mature PhaaS platform helps even low-skilled criminals target banks, cloud services and global brands.

Written by

Gagan Aggarwal

June 11, 2026

Chinese Origin Threat Actors Target FIFA World Cup 2026

As the FIFA World Cup 2026 begins, a highly sophisticated, Chinese-origin threat operation is targeting global football fans. Utilizing pixel-perfect website clones, a multi-tenant reseller network, and an active Man-in-the-Middle framework, these actors intercept payment details and bypass SMS-based two-factor authentication in real time to completely compromise accounts.

Written by

Gagan Aggarwal

June 10, 2026

Inside a WooCommerce Payment Skimmer: How Carders Moved From Phishing Pages to Checkout Backdoors

Cybercriminals are now targeting real e-commerce checkout pages, not just fake websites. This report reveals how a WooCommerce skimmer silently steals card details during genuine payments. Read the full report to understand the hidden risk.

Written by

Shobhit Mishra

Articles in Threat Intelligence

November 15, 2023

Critical CSRF Vulnerability in IBM CICS TX - CVE-2023-42027 Demands Immediate Action

CVE-2023-42027 IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multi platforms 8.1, 8.2, 9.1 are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts

November 6, 2023

CVE-2023-43792 baserCMS is a website development framework vulnerable to Code Injection attacks

CVE-2023-43792 is a code injection vulnerability in the mail form of baserCMS versions 4.6.0 to 4.7.6. This vulnerability allows an attacker to inject arbitrary code into the baserCMS application, which could then be executed by other users of the application.

November 6, 2023

CVE-2023-4197 Vulnerability in Dolibarr ERP CRM 18.0.1 Allows PHP Code Injection

CVE-2023-4197 Improper input validation in Dolibarr ERP CRM v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code

September 8, 2023

Hoze shell script dropped along with XMRig miners on misconfigured SSH Servers by Brute Forcing

CloudSEK’s Threat Intelligence Team uncovered a campaign, actively running from the past 1.8 years, that attacks and brute forces the SSH. 

September 4, 2023

3,20,000+ Patient Records From Ayush Jharkhand Gov. In Shared On Dark Web Hacking Forums

A hacker known as Tanaka has exposed over 320,000 patient records from ayush.jharkhand.gov.in, detailing personal and medical information. The 7.3 MB database leak includes sensitive data from the AYUSH ministry's site

August 28, 2023

Rogue Scripts Are Exploiting OTP Verification APIs To Send Heaps of OTP SMSes, Hold The Potential Of Triggering Service Disruptions.

Discover how CloudSEK's AI-powered XVigil platform identified concerning GitHub repositories mentioning Indian companies and their APIs.

Join 10,000+ subscribers

Keep up with the latest news about strains of Malware, Phishing Lures,
Indicators of Compromise, and Data Leaks.