Senior Threat Intelligence Reporter

Daniel Okafor, page 3

Daniel tracks ransomware crews, initial access brokers and state-aligned intrusion sets. He previously worked as a SOC analyst and still writes his own detection rules.

72 articlesUpdated 28 Sep 2026Page 3 of 3

RansomwareNation-state activityDetection engineeringLinkedIn

Articles by Daniel Okafor

ThreatsCloud & SaaSCritical
TrueConf Enterprise Video Server Remote Code Injection Flaw Weaponized in Enterprise Attacks
CISA warns of active exploitation targeting enterprise video conferencing systems via CVE-2026-72530, an unauthenticated remote code injection flaw on TrueConf port 4307.
Daniel Okafor15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Critical Gitea Git Diffpatch Code Injection Flaw Weaponized to Compromise Repositories
CISA issues binding remediation directive on CVE-2026-60004, a critical code injection defect in Gitea's git diffpatch parser enabling remote command execution on self-hosted repositories.
Daniel Okafor15 Sep 20268 min read
ThreatsCloud & SaaSCritical
Linux Kernel IPv6 Privilege Escalation Flaw Weaponized for Local Root Compromise
CISA added CVE-2026-53362 to its KEV catalog, warning of active privilege escalation exploits targeting the Linux Kernel IPv6 networking subsystem across major enterprise distros.
Daniel Okafor15 Sep 20268 min read
ThreatsEnergy & UtilitiesHigh
AVEVA Pipeline Integrity Monitor Vulnerabilities Threaten Critical Energy Infrastructure
CISA issued an energy sector ICS advisory warning of memory corruption and authentication defects in AVEVA Pipeline Integrity Monitor supervising oil and gas transport.
Daniel Okafor14 Sep 20268 min read
ResearchCloud & SaaS
CISA, NSA, and FBI Warn Critical Infrastructure of Advanced AI Model Extraction Campaigns
A joint cybersecurity advisory from CISA, NSA, and FBI alerts defense contractors and cloud vendors to sophisticated state-sponsored AI model extraction campaigns.
Daniel Okafor14 Sep 20269 min read
ThreatsTelecom & MediaHigh
Cisco Fixes High-Severity Memory Corruption Flaw in Carrier-Grade IOS XR Routing Core
Cisco resolved CVE-2026-20274, an unauthenticated memory corruption flaw in IOS XR software that enables crash-loops or remote code execution in telecommunications cores.
Daniel Okafor14 Sep 20267 min read
ThreatsCloud & SaaSCritical
Citrix NetScaler CVSS 9.3 authentication bypass CVE-2026-19490 under active in-the-wild exploitation
CISA and threat researchers warn that CVE-2026-19490 in Citrix NetScaler ADC and Gateway is under active exploitation, granting unauthenticated access to perimeter gateways.
Daniel Okafor14 Sep 20266 min read
ThreatsCloud & SaaS
GitHub adds a merge gate for pull requests with unresolved secret alerts
GitHub’s new ruleset can block pull-request merges until selected secret-scanning alerts are resolved, adding a review-stage guard beyond push protection.
Daniel Okafor13 Sep 20265 min read
ThreatsCloud & SaaSCritical
Cisco Secure FMC authentication bypass CVE-2026-20079 exploited by Qilin ransomware affiliates
Threat actors and Qilin ransomware affiliates are actively weaponizing CVE-2026-20079 in Cisco Secure FMC to bypass web authentication and achieve root command execution.
Daniel Okafor13 Sep 20266 min read
ThreatsIndustrial & OTCritical
MikroTrick exploit chain compromises MikroTik RouterOS devices as ScreenConnect client flaw hits KEV
CERT Polska discloses MikroTrick, an unauthenticated exploit chain hijacking MikroTik RouterOS devices, while CISA adds a dangerous ScreenConnect client condition to KEV.
Daniel Okafor12 Sep 20266 min read
ThreatsGov & DefenceCritical
North Korean actors deploy trojanized HAProxy 'TED' backdoor inside South Korean enterprise networks
Rapid7 Labs uncovers TED, an elusive Linux implant compiled directly into HAProxy load balancers at automotive and media firms, hiding C2 and manipulating live traffic.
Daniel Okafor12 Sep 20266 min read
ThreatsCloud & SaaSHigh
PaperCut issues superseding maintenance releases as attackers deploy AI agent swarms against 440+ servers
PaperCut shipped consolidated maintenance updates after automated AI agent swarms compromised over 440 print management servers, bypassing earlier emergency hotfixes.
Daniel Okafor11 Sep 20266 min read
ThreatsIndustrial & OTCritical
SonicWall SMA1000 Zero-Day Chain Hit CISA KEV in Three Days. Patching Is the Easy Part
SonicWall disclosed two actively exploited SMA1000 flaws on 1 September; CISA set a 5 September federal deadline. The harder problem is proving an appliance you cannot instrument is clean.
Daniel Okafor11 Sep 20265 min read
ThreatsCloud & SaaSHigh
LiteLLM and Kestra in KEV: exploited AI tooling is now a vulnerability management problem
CISA added 15 CVEs to the KEV catalog in six working days, including exploited flaws in LiteLLM and Kestra — AI tooling that most asset inventories never see.
Daniel Okafor10 Sep 20266 min read
ThreatsGov & DefenceCritical
Surge in Enterprise Exploits: 12 Critical Zero-Days Weaponized in a Single Week Across Citrix, Cisco and Fortinet
Twelve fresh entries hit the Known Exploited Vulnerabilities catalog, covering Citrix NetScaler, Cisco FMC, Fortinet FortiOS, Adobe Commerce, N-able N-central and Chrome.
Daniel Okafor10 Sep 20266 min read
ResearchEducation & Academia
Eight new ransomware brands in one week: why tracking group names has stopped working
One tracker logged 315 leak-site posts from 40 groups in a single August week, eight of them new. Brand-based detection cannot keep pace. Here is what to instrument instead.
Daniel Okafor10 Sep 20266 min read
ThreatsCloud & SaaSCritical
N-able N-central Pre-Auth RCE Flaw Under Active Exploitation (CVE-2026-86218)
CISA issued an emergency KEV addition for CVE-2026-86218, an unauthenticated static code injection flaw in N-able N-central RMM servers actively exploited against MSP networks.
Daniel Okafor8 Sep 20265 min read
ThreatsGov & DefenceHigh
Gunra ransomware: what AA26-222A actually gives your detection engineers
Six agencies detailed Gunra's Fortinet entry, its forticloud-sync backdoor and an MFA bypass planted in a VDI server. Here is how to turn that into detection coverage.
Daniel Okafor8 Sep 20266 min read
ThreatsIndustrial & OTCritical
PAN-OS authentication bypass CVE-2026-0257 puts firewall management planes at risk
A newly catalogued authentication bypass in Palo Alto Networks PAN-OS lets an unauthenticated attacker reach management functionality. Here is the exposure and the fix.
Daniel Okafor8 Sep 20266 min read
ThreatsBanking & FintechHigh
Slim Spider Targets Brazilian Instant Payments (Pix) and Crypto Custody Infrastructure
CrowdStrike revealed Slim Spider, a financially motivated cybercrime group abusing cloud IMDS credentials to penetrate Brazilian instant payment (Pix) and crypto custody systems.
Daniel Okafor8 Sep 20266 min read
ResearchTelecom & Media
Salt Typhoon has compromised networks in more than 80 countries, researchers say
The Chinese state-aligned group has moved well beyond telecoms into transportation and government, in what is now one of the broadest espionage campaigns on record.
Daniel Okafor7 Sep 20268 min read
ThreatsTelecom & MediaCritical
Cisco Nexus 9000 Silicon One Switches Exposed to Unauthenticated Root RCE
Cisco disclosed CVE-2026-20212 (CVSS 9.8), an unauthenticated root code execution flaw on Silicon One-based Nexus 9000 datacenter switches due to open debugging ports.
Daniel Okafor3 Sep 20265 min read
NewsCloud & SaaS
HostDZire ransomware encrypts ESXi virtual disks across three countries
An August attack compromised multiple VMware ESXi nodes at hosting provider HostDZire, encrypting virtual disks beyond recovery across India, the Netherlands and the US.
Daniel Okafor2 Sep 20266 min read
NewsGov & Defence
Rhysida ransomware hits Berlin Senate network as public sector attacks accelerate
The Rhysida group claimed an attack on Berlin’s Senate network, part of a run of incidents that also struck a national tax authority and a justice ministry within two weeks.
Daniel Okafor1 Sep 20265 min read