Hirudo is an Android banking remote access trojan that combines credential theft with live remote control capabilities. It is distributed via shopping and entertainment apps acting as droppers, which install the trojan behind fake update prompts. The malware replaces legitimate banking apps with patched versions that disable internal security checks. The campaign targets eight Indonesian banking apps covering seven banks, embedding a hooking engine in the replacements. Distribution uses legitimate advertising infrastructure including Amazon CloudFront. Targeting extends beyond Indonesia to China, India, Mexico, Morocco, Thailand, and Malaysia. Backend data from August 2026 revealed thousands of stolen credentials and device records. No CVE or official patch information is available.
Gigabud is an Android remote access banking trojan active since 2022, attributed to GoldFactory group, targeting victims across Southeast Asia, South Asia, Middle East, Africa and Latin America. The malware now utilizes Vwork, a weaponized fork of the open-source app cloning application Shelter, to evade detection by creating isolated work profiles. After initial Gigabud infection, Vwork is installed to clone banking applications into the work profile, hiding malicious activity from signature-based detection in application security SDKs. Between February and July 2026, approximately 1,469 compromised devices and 1,281 potentially compromised logins were observed in Indonesia alone, with estimated losses of roughly $960,939. The infection chain involves social engineering through phishing sites delivering fake apps disguised as legitimate services, followed by credential theft through overlays and remote-controlled fraudulent transactions executed within cloned banking apps.
Beginning in August 2025, a sophisticated intrusion was discovered where attackers used log poisoning techniques to deploy a web shell on vulnerable phpMyAdmin panels. The threat actors exploited misconfigured web applications to plant China Chopper web shells, controlled via AntSword, before deploying Nezha, an open-source monitoring tool, to facilitate remote command execution. This led to the deployment of Ghost RAT on compromised systems. Analysis revealed over 100 compromised machines, predominantly located in Taiwan, Japan, South Korea, and Hong Kong. The attackers demonstrated technical proficiency through multi-stage operations, utilizing AWS and VPS infrastructure, with indicators pointing to China-nexus threat actors. The campaign highlights increasing abuse of legitimate publicly available tools to achieve malicious objectives while maintaining plausible deniability.
The 13-country effort, named Operation Ramz, targeted cyber threats in the Middle East and North Africa region. The post 201 Arrested in Crackdown on Cybercrime in Middle East, North Africa appeared first on SecurityWeek .
Active since September 2025, Yurei is a double extortion ransomware campaign. The operators run their own Tor data leak site with a low number of victims listed at the time of writing. It is reportedly derived from Prince Ransomware, an open-source ransomware family written in Go. Check Point researchers noted that all samples were first submitted to VirusTotal from Morocco, and that one sample did not include a ticket ID, indicating that this could be a test build, possibly uploaded by the developer themselves. Yurei ransomware samples also contained a link to SatanLockv2, based on the presence of the PDB path string “D:\satanlockv2” present in the Yurei samples.
MuddyWater APT has launched Operation Olalampo, targeting organizations in the MENA region. The campaign involves new malware variants, including a Rust backdoor called CHAR, downloaders GhostFetch and HTTP_VIP, and an advanced backdoor GhostBackDoor. Notably, the group is using Telegram bots for command-and-control, revealing insights into their post-exploitation tactics. The operation, first observed on January 26, 2026, shows tactical and technical overlaps with previous MuddyWater activities. Key discoveries include potential AI-assisted malware development and infrastructure reuse dating back to October 2025. The campaign aligns with ongoing geopolitical tensions and provides valuable information on the threat actor's evolving techniques.
A series of attacks targeting financial organizations across Africa has been observed since July 2023. The threat actor, tracked as CL-CRI-1014, uses open-source and publicly available tools like PoshC2, Chisel, and Classroom Spy to establish attack frameworks, create tunnels for network communication, and perform remote administration. They forge file signatures to disguise their toolset and mask malicious activities. The attackers are suspected to be acting as initial access brokers, creating footholds in financial institutions to sell access on darknet markets. Their playbook includes lateral movement techniques such as creating remote services, executing through DCOM, and using PsExec. The threat actor also employs evasion methods like using packers and signing tools with stolen signatures.
