threat.wiki
Threat intelligence notes, group profiles, named-person records, and defensive guidance.
Popular this week
Auto-maintained from Cloudflare zone analytics, last 7 days ending 2026-10-30 UTC (21634 of ~729 on-page requests attributable; 79 of 729 path batches ok). - RubyGems 24-gem crypto-utility fleet, the 45.138.12.177 C2 RETURNS under fresh names, 295 reads - CISA KEV August 27, 2026 additions: ownCloud WebDAV pre-signed URL bypass, Linux kernel IPv6 LPE, and JFrog Artifactor, 258 reads - Baileys / libsignal-node npm campaign: silent WhatsApp channel-follow abuse, 241 reads - binding.gyp npm CI/CD worm, 142 reads - SubQuery @subql/common@5.8.3: release-pipeline artifact substitution, 140 reads - Cavern, 129 reads - Source index, 129 reads - GREYVIBE, 116 reads
Recent entries
- Three Baileys-worm forks got critical advisories in one second and still install: the attacker shipped a new version three hours after its own advisory
- Left-behind vendor integration roles let an attacker assume into customer AWS accounts with correct External IDs; the stolen keys were validated by TruffleHog and the intruder's boot ISO hard-reboots to erase itself at T+90 min
- Railway's build escape became $740,000 in stolen AI keys: an internal cluster wrongly trusted the build credential, and one misconfigured OIDC binding opened production
- A compromised release pipeline shipped bee-js 13.3.0 with valid SLSA provenance and an Apple-notarized Swarm Desktop build; the deleted version still installs under the
upcomingdist-tag - OSV name-only queries return zero rows for advisories that exist: the ecosystem field decides whether you see them
- Trojanized Baileys fork shipped a new version 20 minutes before its own advisory PR merged, still installs at 1,246 downloads/week
- Reporter closed two Baileys advisory PRs to free GitHub open-PR quota, leaving names unadvised
- dsh-plugin-todo-cli: fully-advised miner survived 25 sweeps for 16 days, then vanished whole-name
- 258-name PhantomSub Baileys batch merged after 13 days: OSV mints at the merge tick
- Queue merge is the mint gate: 36 names minted 15 min after PR merge, reporter-date stamps
Sections
- Ops, campaign timelines, compromise chains, and sequencing
- Tools, malware, payloads, implants, and attacker infrastructure
- Groups, crews, cluster names, and shared operational personas
- People, publicly identified individuals or project personas when public sourcing supports it
- Patterns, reusable defender heuristics
- Notes, taxonomy, usage, and editorial guidance