Telegram Intel Intelligence
Live threat intelligence collected from criminal Telegram channels — real-time threat actor communications, malware distribution campaigns, and first-look intelligence before it hits mainstream reporting.
Telegram Intel — Archive & Latest
Storm-0940 ARTEX Autonomous AI Attack Framework + CL-STA-1178 Blinder Tunnel Campaign: OTX Pulse Analysis — APT Detection Pack for Finance and Critical Infrastructure
OTX pulses expose agentic AI-driven attacks on South Korean finance (Storm-0940/ARTEX), Iranian APT CL-STA-1178's Blinder Tunnel campaign in Iraq, and mass Langflow RCE scanning. Hunt now.
CL-STA-1178 Blinder Tunnel + Agent Tesla Q3 Surge: OTX Detection Pack for ShelbyLoader, GTA VI Lures, Langflow RCE and AWS Bedrock Key Testing
OTX shows CL-STA-1178 Blinder/ShelbyLoader, Agent Tesla email surge, GTA VI credential lures, Langflow RCE scans and AWS Bedrock key testing. High urgency.
N0N Ransomware Gang: 15 New Leak-Site Postings Claim Retail, Healthcare, and Technology Victims — Detection Rules and Hunt Queries
N0N has listed 15 organizations across retail, healthcare, and technology sectors in 3 days. Multi-source corroboration on 10 claims. Includes Sigma rules, KQL hunts, and response checklists.
K2F RAT via NIKKE Launcher Supply-Chain Compromise + GTA VI & Bank Phishing Credential Harvesting: OTX Pulse Analysis — Enterprise Detection Pack
CDN supply-chain compromise drops K2F credential stealer via NIKKE launcher; GTA VI phishing, fake bank-takedown cloaking, and AWS key validation campaigns active. Hunt now.
CWPdoor, Lindnor & ARTEX: OTX Pulse Analysis — Linux Backdoors, Ransomware Tooling and Autonomous Intrusion Frameworks
Three live OTX pulses reveal passive Linux backdoors in CWP, ransomware-linked security killers, and AI-driven infrastructure targeting financial institutions. Immediate detection advised.
BO Team Supply Chain Intrusion, Mirax Android DTO, and Storm-2603 ToolShell Fileless Attacks: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal BO Team hypervisor compromise via Log4Shell, Mirax Android banking takeover in META, and Storm-2603 fileless SharePoint ransomware. Hunt now.
Phexia macOS Infostealer, NIKKE K2F Supply Chain RAT & VAPOR PANDA ARTEX: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal Phexia macOS infostealer via ClickFix, NIKKE launcher supply-chain RAT, BO Team hypervisor compromise, GTA VI phishing, and VAPOR PANDA AI-driven espionage. Credential theft across all campaigns — hunt now.
N0N Ransomware Gang: 12 New Leak-Site Postings — Sector Targeting Analysis & Detection Rules
N0N has listed 12 organizations on its dark web leak site since 2026-11-03, including named US healthcare and retail entities. Sectors should validate exposure and hunt pre-encryption staging now.
Haiou Jailbreak Bundle: Prompt Adware Targets Codex LLM Gateways via Cobalt Strike & Ladon Tooling — OTX Pulse Analysis & Detection Pack
Check Point Research flags the Haiou jailbreak bundle: prompt adware that hijacks OpenAI Codex configs, weakens guardrails, and injects ads for a rogue LLM gateway. Hunt now.
SkyW4lker Device-Code Phishing Kit: Microsoft 365 OAuth Token Theft Campaign — OTX Detection Pack
SkyW4lker phishing kit abuses Microsoft device-code OAuth flow to hijack M365 sessions without passwords or MFA. 618 sandbox hits. US, UK, Canada, India targeted.
SkyW4lker Phishing Kit + K2F Launcher RAT + Bank Phish Cloaking Network: OTX Pulse Analysis — Enterprise Detection Pack
Device-code phishing, supply-chain RAT, GTA VI lures, and cloaked bank phishing networks drive credential theft against US enterprises, gaming platforms, and financial institutions.
MEDUSALOCKER Leak-Site Surge: 18 New Claimed Victims Posted in One Day — Sector Analysis & Detection Rules
MEDUSALOCKER listed 18 claimed victims on its leak site on 2026-11-04, spanning tech, manufacturing, education and legal services. Detection content inside.
Claude Code-Brand Cursor Extension SSH Backdoor + Fake-Takedown Bank Phishing: OTX Detection Pack
CRITICAL: trojanized Claude Code Cursor extensions drop macOS SSH persistence while 248 look-alike domains phish 189 US banks with fake suspended-page cloaking.
N0N Ransomware Gang: 20 New Leak-Site Claims in 72 Hours — Unverified Victim Postings, Detection Rules & Pre-Encryption Hunt Queries
N0N's leak site added 20 claimed victims across the US, Germany, Saudi Arabia and the UAE in ~48 hours. Here's what defenders should hunt for before encryption fires.
ClingSTUN IoT Botnet + Fake-Download Monetization Campaign: STUN C2 Abuse and Trojanized Installer Detection Pack
OTX pulses reveal ClingSTUN exploiting IoT CVEs with STUN-protocol C2 disguise, plus a fake-download campaign dropping WorldProxyPool and monetization payloads. Hunt now.
KeyHunter Operation: leepsmarts LLM API Key Theft & Academic Fraud Campaign — OTX Detection Pack
Chinese-speaking actor 'leepsmarts' harvested 2,233 LLM API keys from misconfigured cloud infra and ran academic fraud against 20 universities. URGENT: rotate exposed keys, hunt IOCs now.
KeyHunter LLM API Theft + Claude Code SSH Backdoor + Fake-Takedown Bank Phishing: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal LLM API key theft across cloud platforms, a malicious Claude Code Cursor extension with a persistent macOS SSH backdoor, and 248 bank-phishing domains using fake-takedown cloaking. Hunt now.
N0N Ransomware Gang: 15 Leak-Site Claims in 48 Hours — Victimology Analysis, Detection Rules & Pre-Encryption Hunt Content
N0N listed 15 organizations on its dark web leak site across Nov 3-4, concentrated in the US, Germany, Saudi Arabia, and the UAE. Sectors undisclosed; claims unverified. Detection content inside.
Gorbag Espionage on Ukraine, Rogue Gentlemen Affiliate 'Azazel' & XWorm RAT: OTX Pulse Detection Pack
OTX pulses track Gorbag's infostealer campaign against Ukrainian government, a rogue Gentlemen ransomware affiliate abusing GitLab CI/CD secrets, and XWorm RAT spread. Hunt now.
Gorbag GIFTEDCROOK/BeautyStealer Ukraine Espionage + Malicious Claude Code Extension SSH Backdoor + Gentlemen RaaS 'Azazel' GitLab CI/CD Credential Theft: OTX Detection Pack
OTX pulses expose a Russia-aligned Ukraine espionage crew, a trojanized Claude Code Cursor extension with SSH backdoor persistence, and a Gentlemen ransomware affiliate abusing GitLab secrets. Hunt now.
N0N Ransomware Gang: 16 Organizations Listed in 48-Hour Posting Surge — Targeting Analysis & Detection Rules
N0N's leak site added 16 organizations in 48 hours, concentrated in the US and Gulf states. All claims are unverified. Technology and unclassified-sector orgs in SA, US, AE, and MY should review the detection content inside.
BADBOX Supply Chain Compromise: Videostrong x.cpe Backdoor & Residential Proxy Botnet — OTX Pulse Analysis
Supply chain compromise of MECOOL Android boxes by Videostrong Technology infects 1.3M devices with x.cpe backdoor, MQTT C2, and proxyware SDKs.
Black October Campaign: AI Platform Credential Theft & LLMjacking — OTX Detection Engineering Pack
Coordinated breaches hit nine AI developer platforms; attackers steal env-var credentials, run LLMjacking ops. Hunt now: 31.57.201.201, 38.246.114.118.
N0N Ransomware Gang: 16 New Claims Posted on Dark Web Leak Site — Targeting Analysis & Detection Guidance
N0N ransomware gang has posted 16 new claims on its dark web leak site, primarily targeting organizations in Technology and undisclosed sectors across SA, US, AE, and MY.
StyleSmuggler PSK Agent RAT, Yoba Cryptominer Loader & AD CS ESC1/ESC8 Abuse: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal active exploitation of Magento stores via CVE-2026-75650 deploying PSK Agent RAT, signed-AI-app cryptomining (Yoba/XMRig), and human-operated AD CS ESC1/ESC8 intrusions. Retail and identity infrastructure at critical risk.
BITTER PapRAT Cyberespionage + BADBOX Supply Chain Compromise: OTX Pulse Analysis — Enterprise Detection Pack
BITTER APT deploys PapRAT against South Asian government/energy targets; BADBOX infects 1.3M Android devices via supply chain. Immediate IOC blocking and hunt guidance included.
ChatGPT Plus Billing Phishing, Teams Help Desk AD Hijack & AI Platform LLMjacking: OTX Pulse Analysis — Credential Theft Detection Pack
OTX pulses reveal converging credential-theft operations: fake ChatGPT billing pages with live OTP interception, Teams-based IT help desk impersonation leading to AD compromise via ESC1/ESC8, and LLMjacking across nine AI developer platforms.
N0N Ransomware Gang: 16 Organizations Named in Two-Day Posting Surge — Targeting Analysis & Detection Rules
N0N's leak site listed 16 organizations across the US, Saudi Arabia, UAE, and Malaysia in a 48-hour surge — mostly unverifiable claims. Technology and undisclosed-sector orgs should review edge-device and backup exposure now.
LLMJacking UNC6993 + AI Phishing Ops: OTX Pulse Analysis — Credential Theft Detection Pack
LLMJacking, AI billing phishing, Teams AD hijack, and AI platform credential breaches. Finance, retail, tech, transport targeted. Immediate identity and cloud billing controls required.
N0N Ransomware Gang: 12 New Leak-Site Claims Posted — US/UAE/Malaysia Targeting Analysis & Detection Engineering
N0N has listed 12 organizations on its dark web leak site across US, UAE, and Malaysia (claims unverified). Technology and professional services teams: review detections and IR priorities now.
Malicious Claude Code Extension in Cursor IDE + AD CS ESC1/ESC8 Exploitation: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose malicious Cursor IDE extensions deploying SSH backdoors and human-operated intrusions leveraging Teams phishing, Quick Assist abuse, and AD CS ESC1/ESC8 attacks. Enterprise detection and response guidance provided.
CyberStrikeAI LLM-Orchestrated C2 + VOLTA AI-Powered Infostealer: OTX Pulse Analysis — Credential Theft & LLMjacking Detection Pack
OTX pulses reveal AI-orchestrated attacks on education, VOLTA infostealer victim profiling via LLMs, ChatGPT billing phishing, Teams-based AD hijacking, and LLMjacking of 9 AI platforms. High urgency.
N0N Ransomware Gang: 7 Leak-Site Listings in 4 Days — US-Heavy Campaign Analysis, Hypothesized Initial Access Paths & Detection Engineering
N0N posted 7 victim claims in four days — 6 multi-source confirmed, 5 US organizations listed on 2026-11-02 alone. Technology and professional services firms should review the detection content now.
Kimsuky XenoRAT + FrostyNeighbor Wiper Campaign: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal Kimsuky spear-phishing delivering XenoRAT via LNK/PowerShell in South Korea and FrostyNeighbor (UNC1151) deploying VBScript wiper via GPO in Ukraine. High urgency.
Kimsuky XenoRAT LNK Spear-Phish + AI Platform LLMjacking: OTX Credential-Theft Detection Pack
OTX pulses show Kimsuky XenoRAT spear-phish against South Korea and credential theft/LLMjacking across nine AI dev platforms. High urgency: block IOCs, hunt LNK/PowerShell/AutoIt, rotate tokens.
N0N Ransomware Gang: 7 New Leak-Site Claims — Sector Targeting Analysis & Detection Rules
N0N posted 7 new claims (6 multi-source) across US, MY, and AE, targeting Technology and Professional Services. Includes Sigma, KQL, and hardening scripts for detection.
WHITEARMOR Ransomware Gang: 3 New Leak-Site Claims — Sector Targeting Analysis & Detection Rules
WHITEARMOR listed 3 organizations on its dark web leak site in 72 hours, spanning Technology, Transportation, and Other sectors in the US and PH. Unverified claims — defenders should hunt now.
PaperCut MF Zero-Day Intrusion Chain: Java Loader, Web Shell & AdaptixC2 via CVE-2026-82078 / CVE-2026-81578 — OTX Pulse Analysis & Enterprise Detection Pack
OTX pulse: threat actors exploited two PaperCut MF zero-days (CVE-2026-82078, CVE-2026-81578) against an Education-sector print server, deploying a Java loader, web shell, and trojanized Microsoft Copilot binary carrying AdaptixC2. Patch and hunt now.
PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 / CVE-2026-81578 — OTX Pulse Analysis
Zero-day exploitation of PaperCut MF 24.0.2 in Education: in-memory Java loader, web shell, trojanized Copilot binary delivering AdaptixC2, credential dumping. Patch and hunt now.
N0N Ransomware Gang: 7 New Organizations Named on Dark Web Leak Site — Sector Targeting Analysis & Detection Rules
N0N ransomware has listed 7 organizations on its leak site in the past week, spanning Technology and Professional Services across the US, Malaysia, and UAE. Unverified claims — defenders should prepare for VPN exploitation, lateral movement, and pre-encryption staging.
CISA KEV Flash: 10 CVEs Added — Ivanti Connect Secure & PHP Under Active Exploitation
CISA confirms active exploitation of 10 new CVEs targeting Ivanti Connect Secure, PHP, GitLab, Cisco ASA/FTD, VMware ESX, Adobe Commerce, Linux Kernel, and Google Brotli. Federal remediation deadlines in effect. Patch now.
AnimateClipper, ZigClipper & CryptoBandit Clipbanker Campaign: OTX Pulse Analysis — Clipboard Hijacking Detection Pack
Active clipbanker campaign (AnimateClipper, ZigClipper, Efimer, CryptoBandit) hijacking crypto payments via clipboard substitution and ClickFix lures. URGENT: block IOCs, hunt execution artifacts.
China Chopper & Godzilla WebShells on Zimbra: CVE-2026-73570 SNMP Command Injection — OTX Enterprise Detection Pack
Active unauthenticated command injection (CVE-2026-73570) against internet-facing Zimbra mail servers delivering China Chopper and Godzilla JSP webshells. High urgency: patch, hunt, and harden now.
GENESIS Ransomware Gang: 9 New Listings Posted — Sector Targeting Analysis & Detection Rules
GENESIS listed nine US and Canadian organizations across financial, professional services, healthcare, and manufacturing sectors on 2026-10-30. Claims are unverified.
BPFDoor/AVERAT Edge Network Implants + Kong RAT SEO Poisoning + Multi-Family Crypto Clippers: OTX Pulse Analysis
Critical OTX pulses reveal sophisticated edge device implants (BPFDoor/AVERAT) targeting telecoms, Kong RAT delivered via SEO poisoning, and widespread crypto clipboard hijackers. Immediate detection engineering required.
Psychedelic Stealer ClickFix Campaign: Fake CAPTCHA MSI Installer Targets Ukrainian Enterprises — OTX Detection Pack
Unattributed Russian-speaking operator uses ClickFix fake CAPTCHA to deliver Psychedelic Stealer via msiexec. 14% completion rate. Ukraine-targeted. HIGH urgency.
Psychedelic Stealer ClickFix Campaign + MadApe Device Code Phishing + CVE-2026-73570: OTX Enterprise Detection Pack
Critical OTX pulses reveal active ClickFix infostealer infections in Ukraine, unpatched Zimbra command injection, and Microsoft 365 device code phishing targeting global enterprises.
QILIN Ransomware Gang: 14 New Leak-Site Listings — Sector Targeting Analysis, Detection Rules & Response Playbook
QILIN has listed 14 organizations on its dark web leak site spanning manufacturing, transportation, energy, healthcare, and government across 8 countries. These remain unverified threat-actor claims — here is the detection and response guidance to act on.
AUDITTEAM Ransomware Gang: 4 New Listings Posted in 24 Hours — Dark Web Monitoring Brief
AUDITTEAM has listed four organizations on its dark web leak site, with suspected targets in the Netherlands and Singapore. Security teams should audit exposed remote access infrastructure and review backup isolation immediately.
Supply Chain Wallet Drainers, SEO-Poisoned RATs, and ClipBanker Infrastructure: OTX Pulse Analysis — Enterprise Detection Pack
Live OTX intelligence reveals active cryptocurrency theft campaigns using supply chain compromise, SEO poisoning delivering Kong RAT, and ClipBanker malware targeting financial transactions.
Showing 50 of 1630 reports. Archive expands automatically as new intel is generated.
Every Telegram Intel Report Includes SIGMA & KQL Detection Rules
Every intelligence briefing on this page includes at least one Sigma rule, a Microsoft Sentinel KQL hunt query, and an IOC check script — ready to drop into your SIEM. No paywall. No registration.