CY-TOP-001Electronic Wallet Balance Theft — Jordan & Palestine | MFICY-DOM-001 | ACTIVE | 2 | 8 | 1 Topics1 Domains | 5 | ACRIP-MFI-20261029-002 | — |
|
CY-TOP-002Pirated Software & Gaming Malware — MENA Credential Theft Exposure | MCICY-DOM-002 | ACTIVE | 1 | 10 | 1 Topics3 Domains | 3 | ACRIP-MCI-20261029-001 | — |
|
CY-TOP-003VOLTA / AI-Assisted Infostealer Victim Prioritization | MCICY-DOM-002 | ACTIVE | 1 | 3 | 1 Topics3 Domains | 2 | ACRIP-MCI-20261031-002 | — |
|
CY-TOP-004NIK C2 — AI-Integrated Windows Command-and-Control Framework | MCICY-DOM-002 | ACTIVE | 1 | 4 | 1 Topics3 Domains | 2 | ACRIP-MCI-20261031-003 | — |
|
CY-TOP-005Yoba / Fake AI Desktop Installer Campaign | MCICY-DOM-002 | ACTIVE | 1 | 2 | 2 Topics3 Domains | 2 | ACRIP-MCI-20261101-004 | — |
|
CY-TOP-006CyberDakait — Multi-Family Android Banking Fraud Cluster (India) | MFICY-DOM-001 | ACTIVE | 1 | 3 | 1 Topics3 Domains | 2 | ACRIP-MFI-20261101-001 | — |
|
CY-TOP-007LiteLLM 1.107.0 — Release-Pipeline & Official Artifact Compromise | SCSECY-DOM-007 | ACTIVE | 1 | 6 | 0 Topics3 Domains | 4 | ACRIP-SCSE-20261101-001 | — |
|
CY-TOP-0301Ivanti Connect Secure — Active Zero-Day Exploit Chain & Root Compromise | VEICY-DOM-003 | ACTIVE | 1 | 3 | 0 Topics2 Domains | 4 | ACRIP-VEI-20261101-001 | — |
|
CY-TOP-0801ARTEX — Multi-Actor Offensive Infrastructure & Attribution Boundaries | TAICY-DOM-008 | ACTIVE | 1 | 7 | 2 Topics5 Domains | 5 | ACRIP-TAI-20261101-001 | — |
|
CY-TOP-AIS-001Agentic Offensive Frameworks in Real Intrusions — ARTEX & Multi-Agent Attack Automation | AISCY-DOM-006 | ACTIVE | 1 | 4 | 3 Topics5 Domains | 5 | ACRIP-AIS-20261101-001 | — |
|
| AISCY-DOM-006 | ACTIVE | 1 | 4 | 3 Topics3 Domains | 4 | ACRIP-AIS-20261101T130700Z-A6E9C31F | — |
|
CY-TOP-AIS-CF2B1127Cursor Marketplace Claude Code Extension Supply-Chain Compromise & Persistent SSH Backdoor | AISCY-DOM-006 | MERGED | 1 | 0 | 3 Topics2 Domains | 0 | ACRIP-AIS-20261101T101040Z-CF2B1127 | — |
|
CY-TOP-CSS-001ConnectWise Cloud Backup — Multi-Tenant Application Identity Compromise & Downstream Cloud Control-Plane Abuse | CSSCY-DOM-005 | ACTIVE | 1 | 4 | 0 Topics3 Domains | 5 | ACRIP-CSS-20261101-001 | — |
|
| CSSCY-DOM-005 | ACTIVE | 1 | 4 | 2 Topics4 Domains | 4 | ACRIP-CSS-20261101T130600Z-9F31C2A7 | — |
|
| CSSCY-DOM-005 | ACTIVE | 1 | 3 | 5 Topics3 Domains | 4 | ACRIP-XCORR-20261102-B0C70C26 | — |
|
CY-TOP-IAS-001Help-Desk Impersonation → AD CS Certificate-Backed Identity Takeover | IASCY-DOM-004 | ACTIVE | 1 | 7 | 1 Topics1 Domains | 3 | ACRIP-IAS-20261101-001 | — |
|
CY-TOP-IAS-7C4A91D2Passkey-Themed Help-Desk Vishing → Cloud Identity Persistence & SaaS Exfiltration | IASCY-DOM-004 | ACTIVE | 1 | 4 | 1 Topics2 Domains | 2 | ACRIP-IAS-20261101T100800Z-7C4A91D2 | — |
|
CY-TOP-IAS-D4B81F63BeyondTrust Remote Support — Authentication Bypass → Identity-Broker / Credential-Vault Compromise | IASCY-DOM-004 | ACTIVE | 1 | 5 | 2 Topics2 Domains | 3 | ACRIP-IAS-20261101T130700Z-D4B81F63 | — |
|
CY-TOP-MCI-7F3A9C21MDaemon/ClamAV Zero-Click RAR Exploitation — HELLAGE/HELLTAG Backdoors in Ukraine | MCICY-DOM-002 | ACTIVE | 1 | 5 | 0 Topics2 Domains | 3 | ACRIP-MCI-20261101T100700Z-7F3A9C21 | — |
|
CY-TOP-MCI-D2A9F4C7WardenStealer / CallbackBeaver — AI-Agent Credential Theft at Operational Scale | MCICY-DOM-002 | ACTIVE | 1 | 5 | 2 Topics5 Domains | 4 | ACRIP-MCI-20261101T143400Z-D2A9F4C7 | — |
|
CY-TOP-MFI-5D92B4E1Indian NBFC Payment/Disbursement API Fraud — Trusted-Infrastructure Payout Abuse | MFICY-DOM-001 | ACTIVE | 1 | 4 | 3 Topics2 Domains | 4 | ACRIP-MFI-20261101T143100Z-5D92B4E1 | — |
|
CY-TOP-MFI-7A41C9E2Android FreeNet / Zero-Rating Free-Riding — SNI/HTTP Tunneling & Hidden-Network Claim Separation | MFICY-DOM-001 | ACTIVE | 1 | 9 | 0 Topics2 Domains | 4 | ACRIP-MFI-20261101T181300Z-7A41C9E2 | — |
|
| MFICY-DOM-001 | ACTIVE | 1 | 3 | 2 Topics1 Domains | 3 | ACRIP-MFI-20261101T100700Z-A7F31C9D | — |
|
CY-TOP-SCSE-C7A29E4BClaude Code Cursor Marketplace Trojan — Trusted Extension Identity & Persistent SSH Backdoor | SCSECY-DOM-007 | ACTIVE | 2 | 7 | 1 Topics4 Domains | 3 | ACRIP-AIS-20261101T101040Z-CF2B1127 | — |
|
CY-TOP-SCSE-D84F6A21Gheist — Stolen GitHub Tokens, Actions Secret Exfiltration & Private/Enterprise Supply-Chain Exposure | SCSECY-DOM-007 | ACTIVE | 1 | 4 | 2 Topics4 Domains | 4 | ACRIP-SCSE-20261101T143100Z-D84F6A21 | — |
|
CY-TOP-TAI-6D2F91A4DPRK-Nexus PHP2Shell — Low-and-Slow Scanning, Rotating Infrastructure & Attribution Boundaries | TAICY-DOM-008 | ACTIVE | 1 | 6 | 1 Topics1 Domains | 3 | ACRIP-TAI-20261101T143000Z-6D2F91A4 | — |
|
CY-TOP-TAI-B8C4D2E1TraderTraitor — Binance US$6.3B+ Theft, Cross-Chain Extraction & Laundering Infrastructure | TAICY-DOM-008 | ACTIVE | 1 | 7 | 0 Topics1 Domains | 3 | ACRIP-TAI-20261101T101330Z-B8C4D2E1 | — |
|
CY-TOP-VEI-5E8A14C3Siemens SIMATIC IoT2050 Advanced — CVE-2026-58115 Exploitation Delta & Unauthenticated Maximum-Privilege RCE | VEICY-DOM-003 | ACTIVE | 1 | 4 | 0 Topics2 Domains | 4 | ACRIP-VEI-20261101T143100Z-5E8A14C3 | — |
|
CY-TOP-VEI-B7C4E291GitLab CVE-2026-97229 — Actively Exploited CI/CD Regex RCE & Runtime Patch-Provenance Risk | VEICY-DOM-003 | ACTIVE | 1 | 5 | 1 Topics3 Domains | 4 | ACRIP-VEI-20261101T100800Z-B7C4E291 | — |
|