Threat Advisories:

Echoes Over UDP: MuddyWater’s Covert Backdoor Strikes Microsoft December 2025 Patch Tuesday Roundup China-Linked Operators Breach Japanese Shipping Networks ShadyPanda’s Seven-Year Operation Built a Browser Extension Spy Empire React2Shell Flaw in React Server Components Under Active Attack ValleyRAT’s Stealthy Job-Lure Campaign Arkanix Stealer’s Fast-Evolving Design Driving Widespread Compromise Water Saci Campaign: Multi-Stage Malware Spreading via WhatsApp Web The Admin Shortcut: King Addons Flaw Under Fire Serpents in Disguise: MuddyWater’s Hidden ToolsetExposed Operation Hanoi Thief: When Fake CVs Become Cyber Weapons CVE-2025-61757: Oracle Identity Manager Pre-Auth RCE Under Active Attack ShadowPad Gatecrashes the Enterprise by Hijacking WSUS Vulnerability Shai-Hulud 2.0 Fuels Global NPM Supply-Chain Compromise StealC V2 Spreads via Malicious Blender Files The Windows Update Deception: How ClickFix Lures Unleash Stealthy Stealers Cl0p Ransomware Surge 2025: Operational Patterns and Key Mitigations ShadowRay Strikes Back: Inside the Multi-Purpose Ray Cluster Takeover November 2025 Linux Patch Roundup CVE-2025-11001 Turns a Simple Unzip into a System-Level Ambush

Hive Pro recognized in Gartner® Magic Quadrant™ for Exposure Assessment Platform, 2025 Watch platform in action

Book a Demo Threat Digest - Subscribe

Buhti Ransomware Operation Repurposes Leaked Encryptors

Threat Level – Red | Vulnerability Report

Buhti ransomware, linked to Blacktail threat actors, employs leaked code of LockBit and Babuk variants. By exploiting vulnerabilities like PaperCut NG, they exfiltrate data and distribute ransomware. The addition of a custom Golang exfiltration tool heightens the evolving threat.

What’s new on HivePro

Get through updates and upcoming events, and more directly in your inbox