The IT Nerd

The SOCRadar Threat Research Unit (STRU) identified, with high confidence, exploitation of CVE-2025-25249, a heap-based buffer overflow vulnerability in FortiOS and FortiSwitchManager cw_acd daemon. Successful exploitation delivers PivotC2, a Node.js RAT designed specifically as a FortiGate post-exploitation tool. PivotC2 supports features such as interactive shells, tunneling, network scanning, and configuration harvesting.

Based on the observed inline comments and usage guidance, the actors highly likely leveraged AI to develop the RAT. Active exploitation has been observed since at least July 2026 and is still ongoing. The threat actors targeted more than 30,000 IP addresses, leading to the exploitation and infection of 178 devices with PivotC2.

For full details, the analysis of this post-exploitation RAT can be read here: https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/

QKS Group announced today that it has named SOCRadar as a leader in theSPARK Matrix™: Digital Threat Intelligence Management, 2026.

QKS Group defines Digital Threat Intelligence Management as technology that offers unified insight into external threats to organizational digital-facing assets. The technology aggregates and processes threat intelligence from multiple sources and provides comprehensive information about threat actors to enable improved investigation, threat hunting, and cyber defense.

SOCRadar differentiates itself within the DTIM landscape through a comprehensive, intelligence-driven platform that unifies digital risk protection, threat intelligence, and external attack surface management under a single operational framework. Its ability to correlate threat actor activity, brand exposure, dark web intelligence, and asset-level vulnerabilities provides organizations with enriched, contextual visibility beyond traditional threat monitoring. By integrating automation, analyst-ready insights, and continuous monitoring across deep and dark web, social media, and open sources, the platform enables faster threat prioritization and response. Supported by a globally scalable delivery model and localized intelligence coverage, SOCRadar allows enterprises to proactively mitigate external threats, strengthen digital resilience, and streamline security operations without increasing tool sprawl or operational complexity.

The QKS Group SPARK Matrix™ includes a detailed analysis of the global market dynamics, major trends, vendor landscape, and competitive positioning. The study also provides a competitive analysis and ranking of the Digital Threat Intelligence Management, 2025 providers in the form of the SPARK Matrix™. The study also provides strategic information for users to evaluate different vendor capabilities, competitive differentiation, and market positions.

Additional Resources:

• For more information about SOCRadar, visit Here.
• SPARK Matrix™ Digital Threat Intelligence Management, 2026

SOCRadar Threat Research Team has released a new report on Operation HookedWing, a persistent 4-year phishing campaign that has not been publicly documented until now.

The campaign has been compromising organizations across multiple sectors and countries. The SOCRadar Threat Research team has identified that the campaign operates a custom phishing kit which, at the time of publication, has not been attributed to any known threat actor.

Key Findings:

• First public documentation of this kit and campaign dates back to 2022, with no prior references found in any consulted open sources.
• More than 4 years of continuous activity, with active infrastructure documented up to the time of publication.
• Over 2,000 victims and more than 500 organizations were identified through analysis of recovered logs.
• Multi-infrastructure and multi-vector approach involving abuse of legitimate hosting platforms, combined with the compromise of real corporate servers.
• Use of github.io along with other platforms for landing pages, combined with dynamically injected PHP to load the form.
• Deliberate targeting of key sectors such as Aviation, Government, Energy, and Critical Infrastructure

More info here: Operation HookedWing: 4-Year Multi-Sector Attack Analysis

 The SOCRadar threat labs team has published a highly in-depth analysis on the pro-Russia hacktivist group NoName057(16) and its DDoSia Project. 

DDoSia is a custom denial-of-service tool used to disrupt online services for governments, public institutions, media outlets, and organizations that support Ukraine or otherwise oppose Russian political interests. 

According to the analysis — which breaks down noName057(16)’s tactics, M.O., recruitment, collaboration efforts, as well as the DDoSia Project’s capabilities, attack vectors, and victimology — DDoSia operates as a voluntary botnet that allows people with limited technical skills to contribute to this propaganda machine. 

Overall, NoName057(16) demonstrates a high level of organization and adaptability. As long as the Russia–Ukraine conflict and related geopolitical tensions continue, the group is likely to remain active and further enhance its operational capabilities.

For full details, here’s the analysis: https://socradar.io/blog/noname05716-and-ddosia-project-analysis-russia/