Latest security threats

The newest cybersecurity stories — exploited vulnerabilities, malware campaigns, cyberattacks and more — clustered from public reporting by ThreatCluster. The list updates automatically while the page is open. The live list needs JavaScript.

About this feed

• Stories come from ThreatCluster's free public feed and are shown with attribution under the CC BY 4.0 license. We check ThreatCluster for new stories every 15 minutes.
• Headlines and summaries are written by ThreatCluster's AI without human review and can contain mistakes. Each story links to its ThreatCluster page, which lists the original reporting.
• Only cybersecurity stories are shown. Other news in ThreatCluster's feed, such as reports on armed conflict, is left out by an automatic word filter, which can occasionally leave out a relevant story too.
• Text is shown as plain text in English. We shorten long summaries, remove web addresses, and write bare domain names as example[.]com so they can't be opened by accident.
• This feed is separate from our ransomware claim data: stories never change claim counts, groups, corroboration or email alerts.

Check a domain or IP address

See whether a domain or IPv4 address is in ThreatCluster's feed of confirmed indicators from the last 30 days, and why it was reported. What you enter is checked on our server against a cached copy of the feed. It is not sent to ThreatCluster, stored, or logged. A result that is not in the feed does not mean it is safe. The check needs JavaScript.

For ransomware leak-site claims, see the live tracker and the weekly ransomware signals.

Explore the tracker

• Live ransomware tracker overview
• Ransomware group directory
• Victim-claim directory
• Ransomware activity by country and sector
• Weekly ransomware signals
• Monthly State of Ransomware reports
• Latest security-threat news stories
• Data quality and screening dashboard
• Free vendor check for ransomware claims
• Free email alerts for watched companies
• Methodology and evidence model
• Glossary of tracker terms

Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.