PolySwarm 🇺🇸

Day 1 at #RSAC 2026 and PolySwarm is on the ground in San Francisco. We’re meeting with teams tackling today’s evolving threat landscape. If you’re here this week, let’s connect. polyswarm.io/rsa-2026

Great energy at #RSAC this week ⚡ Awesome connecting with builders, defenders, and innovators pushing cybersecurity forward. The conversations around threat intel and collaboration have been 🔥 If you’re here, come find us and say hi 👋 #CyberSecurity #ThreatIntel #PolySwarm

CL-STA-1087, a long-running #espionage campaign, is targeting Southeast Asian military orgs with custom backdoors and credential harvesting. @Unit42_Intel reported on this activity. See our analysis + related samples: blog.polyswarm.io/china-linked-e…

RSAC opens its annual flagship event today in San Francisco at the Moscone Center. RSAC Conference convenes the world’s top cybersecurity, govt., and business leaders to learn, explore current and future trends to create a safer society. spr.ly/6010B6Z0wa

Recent #Iran developments suggest states with degraded #cyber capabilities may choose to pivot. #Cuba presents a similar flashpoint, leveraging geography to monitor telecom, maritime, and military comms despite limited offensive cyber power. blog.polyswarm.io/threat-spotlig…

🚨 NEW: Bitrefill reveals it was hit by a cyberattack on March 1 linked to Lazarus Group, with attackers draining crypto wallets and accessing 18,500 purchase records.

Iranian #cyber actors are expanding operations targeting U.S. organizations while exploiting internet-connected cameras across the #MiddleEast for intelligence and battlefield awareness. Another layer in #Iran’s hybrid #warfare strategy. Read more: blog.polyswarm.io/footholds-live…

Recent maritime navigation anomalies in the Persian Gulf and Strait of #Hormuz suggest the use of GNSS #spoofing and other electronic #warfare techniques disrupting vessel positioning systems and AIS tracking data. Check out our blog for more info. blog.polyswarm.io/electronic-war…

#Iranian drone strikes damaging multiple Amazon Web Services (#AWS) data centers in the United Arab Emirates & Bahrain demonstrate how modern conflicts increasingly target digital #infrastructure that underpins global computing. blog.polyswarm.io/hybrid-warfare…

Our latest Threat Bulletin continues coverage of the ongoing hostilities involving Iran, examining the evolving #ThreatIntelligence landscape across #CyberSecurity, #Geopolitics, and regional #RiskIntelligence in the #MiddleEast. blog.polyswarm.io/cyber-strategy…

#PromptSpy is the first documented Android #malware to integrate generative AI, specifically @Google's Gemini, into its execution flow for dynamic, context-aware persistence. @ESET recently reported on it. Read our blog for more info & related samples. blog.polyswarm.io/promptspy-andr…

#Threatactors conducted a widespread supply chain poisoning operation, named #ClawHavoc. Koi recently reported on this activity. Check out our blog for more info and #PolySwarm’s related samples. blog.polyswarm.io/the-clawhavoc-…

#Massiv is an emerging #Android banking #Trojan family capable of enabling credential theft, message interception, and full device takeover. @ThreatFabric recently reported on it. Details + related samples on our blog: blog.polyswarm.io/massiv-android…

A targeted intrusion into a #FinTech entity in the #cryptocurrency sector was attributed to #UNC1069, a North Korea-nexus financially motivated threat actor. @Mandiant recently reported on this activity. Check out our blog for more info & related samples. blog.polyswarm.io/unc1069-uses-n…

Private and secure threat intelligence, redefined. #CyberSecurity #ThreatIntel #MalwareAnalysis

Operation #Neusploit is linked to #FancyBear exploiting #ZeroDay CVE-2026-21509 in Microsoft RTF files to deploy MiniDoor and Covenant Grunt implants targeting Central & Eastern Europe. @Zscaler recently reported on the activity. Our analysis 👇 blog.polyswarm.io/fancy-bear-lev…

#LabyrinthChollima has split into three distinct entities since 2018: Golden & Pressure Chollima (#CryptoTheft) & a core espionage group. @CrowdStrike recently reported on the shared #Malware frameworks & how they reflect #DPRK cyber operations. blog.polyswarm.io/labyrinth-chol…

Researchers have identified #PeckBirdy, a versatile JScript-based #C2 framework, deployed since 2023 in campaigns linked to China-aligned #APT actors. @trendaisecurity recently reported on it. Check out our blog for more info & PolySwarm samples. blog.polyswarm.io/china-nexus-th…

A new #ransomware family, #Osiris, emerged in Nov 2025, targeting a major food service operator in SE Asia. @symantec and Carbon Black recently reported on Osiris. Check out our blog for more info and PolySwarm’s related samples. blog.polyswarm.io/osiris-ransomw…

@ApeBored31952 Were you previously in there?

@PolySwarm It’s expired :(

Speed matters in incident response. PolySwarm supports rapid triage so analysts can focus on what is real. #IncidentResponse #SOC #InfoSec