ThreatCluster.io (@threatcluster) header
ThreatCluster.io (@threatcluster) profile picture

ThreatCluster.io

@threatcluster

Threat intelligence as data: a REST API, free IOC and MISP feeds and an MCP server. Over 20,000+ sources and ransomware leak sites.

 Covent Garden, London
threatcluster.io
Joined July 2025
  • Tweets5.8K
  • Following640
  • Followers643
1.6KMedia
Photo by ThreatCluster.io (@threatcluster)Photo by ThreatCluster.io (@threatcluster)Photo by ThreatCluster.io (@threatcluster)Photo by ThreatCluster.io (@threatcluster)Photo by ThreatCluster.io (@threatcluster)Photo by ThreatCluster.io (@threatcluster)Photo by ThreatCluster.io (@threatcluster)Photo by ThreatCluster.io (@threatcluster)Photo by ThreatCluster.io (@threatcluster)Photo by ThreatCluster.io (@threatcluster)
SlippyNunchucks abuses Sogou Input Method to deploy DarkVigil malware SlippyNunchucks hijacked Sogou Input Method’s brand promotion mechanism via DNS hijacking to deliver DarkVigil (FDMTP) to Chinese-speaking users in 6 countries, patched by Tencent on 2026-10-30 threatcluster.io/cluster/sli…
Image from ThreatCluster.io (@threatcluster)
35
SlippyNunchucks hijacks Sogou Input Method SGTool.exe HTTP DNS traffic to drop DarkVigil implants in Chinese-speaking environments. IOCs (3): dev[.]soft-png-cdn[.]com sogou-cdn[.]com gfun[.]top Full set: threatcluster.io/cluster/sli…
SlippyNunchucks Exploits Sogou Input Method for Malware Distribution - ThreatCluster

SlippyNunchucks Exploits Sogou Input Method for Malware Distribution - ThreatCluster

The SlippyNunchucks threat actor has hijacked the Sogou Input Method's brand promotion mechanism to distribute the DarkVigil malware, also known as FDMTP. This operation began on July 1, 2026,...

threatcluster.io
39
Level Infinite's Nikke PC launcher ran attacker code from four tampered CDN JavaScript files for at least 37 days before partial cleanup IOCs (6): insightjs[.]com analytics[.]insightjs[.]com insightjs[.]org +3 more Full set: threatcluster.io/cluster/nik…
Nikke PC Launcher Compromised, Spreading Remote Access Malware - ThreatCluster

Nikke PC Launcher Compromised, Spreading Remote Access Malware - ThreatCluster

The PC launcher for 'Goddess of Victory: Nikke' has been compromised, allowing attackers to distribute remote access trojan (RAT) malware to users. The attack involved tampering with four JavaScript...

threatcluster.io
2
1
3
632
BITTER APT uses fake summit letters and spreadsheets to drop PapRAT Rust RAT into South Asian government and energy networks. IOCs (6): e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b +5 more Full set: threatcluster.io/cluster/bit…
BITTER Group Launches PapRAT Cyber Espionage Campaign in South Asia - ThreatCluster

BITTER Group Launches PapRAT Cyber Espionage Campaign in South Asia - ThreatCluster

A South Asian cyber espionage group known as BITTER has been observed targeting organizations in South Asia with a campaign utilizing a custom remote access Trojan (RAT) named PapRAT. This campaign,...

threatcluster.io
1
2
110
Freezer cyberattack impact rises as more European supermarkets confirmed hit The tally of European supermarkets hit by freezer hacks has risen from more than 100 stores to over 150 outlets after new incident counts across nine countries. threatcluster.io/cluster/cyb…
Image from ThreatCluster.io (@threatcluster)
49
Android XCPE botnet takedown severs access to over 10m devices The XCPE backdoor enrolled more than 1.3m Android TV set-top boxes from Videostrong into a botnet, and Google (@Google)’s C2 takedown is expected to cut access to at least 10m additional compromised devices. threatcluster.io/cluster/goo…
Image from ThreatCluster.io (@threatcluster)
1
103
CVE-2026-58115 exploited on Siemens SIMATIC IoT2050 Advanced gateways for Linux malware Attackers used the CVSS 10.0 Node-RED authentication bypass on SIMATIC IoT2050 Advanced to deploy persistent Linux backdoors and webshells from a single Brazil-based IP across 16 attempts. threatcluster.io/cluster/cri…
Image from ThreatCluster.io (@threatcluster)
1
5
5
312
DarkBlinders breached a Kurdish government cloud and exfiltrated 1 GB of data while the espionage campaign stayed active. IOCs (6): stark-meet[.]com stark-meet[.]website stark-meet[.]online moelcloud[.]online mfakuwait[.]online +1 more Full set: threatcluster.io/cluster/dar…
DarkBlinders Targets Israeli and Kurdish Government Entities in Espionage Campaign - ThreatCluster

DarkBlinders Targets Israeli and Kurdish Government Entities in Espionage Campaign - ThreatCluster

A cyber espionage campaign attributed to the Iran-aligned group DarkBlinders has compromised a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq....

threatcluster.io
60
Android TV XCPE botnet scale revised from 1.3m to 13m devices TrendAI™ Research says disruption of XCPE infrastructure could affect more than 13m pre‑infected Android TV devices, up from over 1.3m set-top boxes Google initially identified. threatcluster.io/cluster/goo…
Image from ThreatCluster.io (@threatcluster)
1
70
European supermarket fridge hacks enter a second wave on 2 November, echoing last month's France incident against hundreds of stores. - Dozens of outlets hit across seven EU countries after evaporators were flipped to defrost. - Same OT class, same 50°C spike, three weeks apart.
Image from ThreatCluster.io (@threatcluster)
2
118
Videostrong preloaded the XCPE backdoor into 1.3M+ Android TV boxes, forming a botnet run from its own firmware. IOCs (6): mqtt[.]anyevonline[.]com file[.]anyevonline[.]com extstb[.]anyevonline[.]com hiddeninplainsight[.]top +2 more Full set: threatcluster.io/cluster/goo…
Google Dismantles XCPE Botnet Targeting 1.3 Million Devices - ThreatCluster

Google Dismantles XCPE Botnet Targeting 1.3 Million Devices - ThreatCluster

Google, in collaboration with several partners, has dismantled the XCPE botnet that compromised over 1.3 million Android TV set-top boxes. The botnet, attributed to Videostrong Technology Co., was...

threatcluster.io
5
6
401
TraderTraitor drained $6.3B from Binance hot wallets by hijacking its cross-chain signer and firing pre-signed EIP-7702 delegations. IOCs (6): f0e8c29e3349d030a97f4a8673387c2e21858cccd1fb9ebbf9009b27743b2e5b +5 more Full set: threatcluster.io/cluster/rec…
Binance Hack: $6.3 Billion Theft Triggers Crypto Market Crisis - ThreatCluster

Binance Hack: $6.3 Billion Theft Triggers Crypto Market Crisis - ThreatCluster

On October 30, 2026, Binance, the world's largest cryptocurrency exchange, suffered a massive security breach resulting in the theft of approximately $6.3 billion in digital assets. The attack began...

threatcluster.io
2
133
15 new leak-site listings overnight, qilin busiest with 9. 19 new validated IOCs. Binance Hit by $6.3 Billion Cyberattack Linked to North Korea PHP2Shell Vulnerability Exposes 96% of Internal PHP Devices Binance Security Incident Estimated at $6.3 Billion with $3 Billion Frozen
Image from ThreatCluster.io (@threatcluster)
2
1
4
269
Every story, the leak-site list and who is moving, in today's edition. threatcluster.io/digest/arch…
Binance Hit by $6.3 Billion Cyberattack Linked to North Korea (+6 more)

Binance Hit by $6.3 Billion Cyberattack Linked to North Korea (+6 more)

Genians reported that 96% of devices running PHP on corporate internal networks are vulnerable to the PHP2Shell remote code execution flaw. This…

threatcluster.io
28
Campaign: New Malware NetamLoader Targets Government Windows Systems in Asia IOCs (6): openaigpt4v[.]com 67E3617F8709D34F806F8E02BADBA8A5 4F28622C5E60C01319BF48CF742FE1A5 CFB8B281BDF5D9390E64B10C312FB2C1 +2 more Full set: threatcluster.io/cluster/new…
New Malware NetamLoader Targets Government Windows Systems in Asia - ThreatCluster

New Malware NetamLoader Targets Government Windows Systems in Asia - ThreatCluster

Kaspersky's Global Research and Analysis Team (GReAT) has identified a sophisticated malware called NetamLoader, targeting a customized version of Windows 10 used by government entities in Asia. The...

threatcluster.io
59
Ransomware leak sites list 18 new victims today, down by more than half on the 7 day trend, with Qilin posting 10, including Community Medical Center in Nebraska. threatcluster.io/dark-web?ut…
Image from ThreatCluster.io (@threatcluster)
84
Wiz traced two stolen Amazon Bedrock keys from breached AI vendors to reseller-style abuse topping an estimated $100k in usage. IOCs (6): llm-routing[.]com xingjiabiapi[.]org 38[.]246[.]114[.]118 s3[.]xingjiabiapi[.]org +2 more Full set: threatcluster.io/cluster/mas…
Mass Credential Theft Targets AI Developer Platforms - ThreatCluster

Mass Credential Theft Targets AI Developer Platforms - ThreatCluster

In October 2026, at least nine AI developer platforms, including Fireworks AI and Railway, reported security incidents attributed to credential access attacks. These attacks primarily targeted...

threatcluster.io
71
84 new leak-site listings overnight, thegentlemen busiest with 50. Major Binance Hack Results in $6.3 Billion Theft, Recovery Efforts Underway Critical CVSS 10.0 GitLab Flaw Exploited on Alpine Linux Critical Linux Kernel Flaw Discovered by AI Poses Major Security Risk
Image from ThreatCluster.io (@threatcluster)
1
136
Every story, the leak-site list and who is moving, in today's edition. threatcluster.io/digest/arch…
Major Binance Hack Results in $6.3 Billion Theft, Recovery Efforts… (+7 more)

Major Binance Hack Results in $6.3 Billion Theft, Recovery Efforts… (+7 more)

A critical vulnerability in GitLab, rated CVSS 10.0, has been against Alpine Linux's GitLab server on October 20 and 21, 2026. The flaw, tracked as…

threatcluster.io
20
StepDrainer hijacked DNS and hosting for at least 12 DeFi domains and converted routine wallet connects into draining approvals IOCs (4): supswap[.]xyz fluxbeam[.]xyz stakepoint[.]app apexdefi[.]xyz Full set: threatcluster.io/cluster/ste…
StepDrainer Malware Targets 12 Crypto Websites in Coordinated Attack - ThreatCluster

StepDrainer Malware Targets 12 Crypto Websites in Coordinated Attack - ThreatCluster

On October 31, 2026, a coordinated wave of frontend attacks impacted at least 12 cryptocurrency websites, including StonkFun and Pickle Finance. Attackers used StepDrainer malware to redirect users...

threatcluster.io
72
Load more