Between July and August 2026, a phishing campaign targeted organizations primarily in Japan and other East and Southeast Asian countries. Attackers sent phishing emails in Japanese and Korean, impersonating product damage complaints to trick victims into visiting fake document-sharing sites. These sites delivered ZIP files containing malware executables with double extensions and DLLs using advanced loader techniques. The final malware payloads belonged to the PureRAT and PureLogs families. The campaign employed frequent changes in loader structures and multiple evasion methods to avoid detection. Infrastructure analysis revealed consistent patterns and identifiers across campaigns.
SectopRAT (also known as ArechClient2) is a .NET-based remote access trojan (RAT) that provides a range of functions through multiple control commands. These include collecting sensitive data from the victim’s device, capturing screens, remotely managing processes and files, controlling bots, and other forms of remote device management.
A social engineering campaign targeting security professionals uses fake consultancy offers and job opportunities to exploit trust. Attackers create sparse social media profiles claiming to be consultants, offering $300 for simple consultations on topics like digital transformation. The initial phone call serves as screening to identify targets with valuable access or knowledge. If successful, targets are asked to provide increasingly sensitive information through written reports, requiring them to abuse trusted access, probe internal systems, or leverage professional relationships. Similar variants include fake recruiters offering prestigious positions while requiring installation of trojanised software. These attacks exploit professional flattery and overconfidence, manipulating security practitioners into compromising their most valuable asset: professional integrity and trusted relationships within the industry.
A threat actor exploited a path traversal vulnerability (CVE-2025-4632) in Samsung MagicINFO 9 Server to gain unauthorized access to endpoints. They deployed a rogue AnyDesk remote access tool, created a local administrator account, and disabled Microsoft Defender protections. Instead of deploying a pre-compiled cryptominer, the actor compiled a Monero cryptominer directly on the compromised endpoint using multiple compilers and utilities. The miner connected to the C3Pool mining service and ran under explorer.exe with suspicious arguments. This on-endpoint compilation generated significant endpoint detection and response (EDR) telemetry, increasing detectability despite attempts at stealth.
RemotePanel and BoundSiphon are two previously undocumented .NET malware components delivered via a ClickFix infection chain. RemotePanel masquerades as the Windows Time service to establish persistent remote access, offering operators PowerShell control, file and process management, screen access, modular hidden VNC, and fleet management. It uses a BNB Smart Chain contract to dynamically resolve its active command and control server, enabling infrastructure rotation without rebuilding the RAT. BoundSiphon operates primarily in memory, targeting browser credentials, sessions, cryptocurrency wallets, password manager data, and documents protected by Chromium App-Bound Encryption. The modular design separates persistent access from data theft, allowing operators to swap components independently while maintaining operational capabilities. No known active exploitation or patches are reported.
The domain third-party[.]com, historically used as a documentation placeholder similar to example.com, has been compromised and now serves ClickFix lures to Windows users while displaying harmless content to other operating systems. Since at least June 2026, Windows visitors receive a fake Cloudflare verification page that poisons the clipboard with a malicious PowerShell command, instructing users to press Win+R and paste the payload. The domain appears in over 1,500 files across 1,700+ repositories from trusted sources including Chromium, Sanity, and Vercel. Unlike example.com, third-party[.]com is not IANA-reserved, allowing adversaries to register and weaponize it. The attack leverages social engineering to bypass security tools by using signed Windows binaries, making detection difficult through traditional scanning methods.
Threat actors are recompiling open source software, specifically the 7zip self-extracting archive stub, to embed a reflective loader that evades detection. The malicious code is inserted into the ExtractArchive function of the 7zip SFX module, making it difficult for analysts to identify since they typically focus on configuration files and embedded executables rather than the decompression stub itself. Samples are validly signed by Animated Productions, LLC and contain legitimate installers like foobar2000. The loader beacons to C2 servers, downloads DLLs, and reflectively loads encrypted payloads. Variants also abuse other open source libraries like the NSIS plugin EmbedHtml. Files feature bloated certificates and suspicious characteristics including installers wrapped within installers, requiring persistent analysis to uncover the hidden malicious functionality.
A sophisticated PowerShell-based backdoor named TASK#STOMP has been discovered that specifically targets business documents while maintaining persistent remote access to compromised systems. The infection begins with VBScript execution, establishing persistence through scheduled tasks and startup folder entries. The malware deploys two primary PowerShell payloads that scan fixed drives for Word, PDF, PowerPoint, Excel, and archive files modified within the past year, excluding files larger than 500MB. It employs filesystem watchers for continuous collection of new documents. Additional capabilities include screenshot capture, Wi-Fi password theft, clipboard monitoring, and arbitrary command execution. The backdoor communicates with two command-and-control domains and uses compiled C helpers to bypass TLS certificate validation, enabling connections to servers with invalid certificates.
North Korea-linked threat actors, identified as Opal Sleet, are conducting Operation Conflict Compass targeting Ukrainian diplomatic entities, think tanks, and NGOs. The campaign uses spear-phishing emails with malicious ZIP attachments containing LNK files disguised as PDFs themed around Russia-Ukraine peace plans and geopolitical issues. Execution of these LNK files downloads VBScript from GitHub, which establishes persistence via scheduled tasks and deploys VelvetCake, a PowerShell-based task runner. VelvetCake connects to command-and-control servers to download and execute scripts that perform reconnaissance, collect system information, enumerate security software, and capture screenshots. The campaign also uses trojanized Zoom installers and infrastructure in South Korea and Ukraine. Activity has been observed since early August 2026.
CARBONATO is a Docker botnet discovered by ThreatDown researchers that targets exposed Docker daemons on port 2375. It operates by distributing trojanized cryptocurrency wallet applications and running a botnet infrastructure. The botnet uses a modified Hermes Agent, an open-source AI framework, to execute commands via Telegram, maintain persistence, and harvest credentials. The campaign infrastructure spans multiple hosting providers and has been active from October 2024 through August 2026. No CVE identifiers or official patches are associated with this threat. The severity is medium due to credential theft and botnet control capabilities.
AvisLoader is a newly discovered Windows malware loader that uses the Tox encrypted peer-to-peer messaging network for command-and-control communications, making traditional domain-based takedowns ineffective. The infection begins with a ClickFix social engineering technique, where victims are tricked into copying and executing malicious commands disguised as document verification steps. The loader is delivered through Cloudflare infrastructure and includes various stealth capabilities such as shortcut modification for persistence, UAC bypass attempts via UACME method 41, and process-hiding functionality through API hooking. Operators manage infected systems through a web-based Command Center that enables client management, task configuration, and payload distribution over the Tox network. The malware's architecture allows operators to maintain control by simply copying their Tox save file when relocating infrastructure, with clients automatically following without requiring domain updates.
In September 2026, the Chinese threat actor UTA0565 exploited unpatched zero-day vulnerabilities in Google Chrome and Microsoft Windows through phishing campaigns targeting Asian government entities. The attacker used fake domains impersonating legitimate organizations to deliver an exploit chain leveraging CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. Successful exploitation resulted in deployment of CLEANGULP, a previously undocumented malware family with backdoor capabilities including command execution, file operations, and beacon object file execution. CLEANGULP communicated with command-and-control servers using encrypted HTTP traffic with custom encoding. Multiple Chinese APT groups shared access to this exploit kit, indicating coordinated cyber espionage activity during the vulnerability window. Patch status is not yet confirmed; organizations should monitor vendor advisories and apply patches once available.
Over a five-month period, multiple malicious campaigns operated through a single bulletproof hosting provider, AS202412 registered to OMEGATECH LTD in Seychelles. These campaigns used disposable domains, fake CAPTCHA pages to trick victims into executing commands, and compromised legitimate websites. The infrastructure included cloud storage, blockchain-resolved command and control addresses, and trojanized installers. Although many victims did not proceed beyond the lure page, successful infections deployed information stealers and remote access tools with persistence mechanisms that survive system reboots.
A new variant of the PamStealer malware targets macOS users by masquerading as a fake Wavel cryptocurrency wallet application. It uses a complex server-side decryption process involving a custom utility and live ECIES key exchange, preventing offline payload decryption. The malware, rewritten in Swift, steals credentials from seventeen browsers, extracts keychain data, collects system fingerprints, and harvests user files including shell history and account photos. It maintains persistence through multiple redundant mechanisms and suppresses notifications by terminating background task management processes.
This analysis covers infostealer distribution trends during August 2026, focusing on distribution channels, detection rates, and disguise techniques. Primary infostealers identified include Remus, Vidar, LummaC2, and ACRStealer, distributed through crack software disguises, SEO poisoning, and file-hosting platforms like Mega and Mediafire. Malware disguised itself as legitimate companies, with Microsoft Corporation being the most frequently impersonated. Distribution methods included DLL side-loading using python37.dll and python36.dll, and exploitation of Renpy game development tool. Email campaigns delivered Formbook disguised as Turkish bank statements and AgentTesla as business quote requests from Indian companies. EXE files constituted 97.3% of execution types. The stolen information poses risks for dark web trading and secondary attacks, emphasizing the need for cautious handling of untrusted links, avoiding illegal software, enabling two-factor authentication, and maintaining updated security soluti...
A suspected Chinese-speaking threat actor linked to Red Heron conducted extensive exploitation campaigns from May to September 2026. The attacker exploited multiple vulnerabilities in WordPress (CVE-2026-63030, CVE-2026-60137) to breach a western government organization, stealing over 18,000 sensitive records including credentials and personally identifiable information. Additionally, the actor exploited CVE-2026-7273 in ZyXEL GS1900 switches, compromising 996 devices across 48 countries and exfiltrating configurations and credentials. The adversary demonstrated sophisticated capabilities such as custom tool development possibly using large language models, privilege escalation, and systematic data exfiltration via PowerShell-based techniques.
A sophisticated six-month campaign targeting quantitative and DeFi developers through malicious npm packages disguised as legitimate mathematics libraries. The operation employs encrypted loaders that trigger only when specific cryptographic operations are performed, specifically when solving linear equations with predetermined matrices. Command and control infrastructure uses Ethereum Sepolia testnet smart contracts as dead drops, alongside a secondary Slack channel, enabling encrypted tasking of compromised systems. The threat actors manufactured millions of fake downloads using GitHub Actions workers to establish false credibility. Fourteen smart contracts were deployed across five operator wallets, managing over 1,000 encrypted taskings to enrolled victims. The campaign demonstrates advanced operational security with disposable accounts, encrypted payloads sealed under ephemeral keys, and infection markers hidden in license files.
This document analyzes multiple cybersecurity incidents involving various threat actors and malicious campaigns. The analysis covers sophisticated attack methodologies including exploitation of vulnerabilities, deployment of specialized malware tools, and targeting of critical infrastructure across multiple sectors. The campaigns demonstrate advanced persistent threat capabilities with focus on data exfiltration, system compromise, and lateral movement within targeted networks. Key observations include the use of social engineering tactics, exploitation of remote access vulnerabilities, and deployment of custom malware frameworks. The threat landscape encompasses government, technology, financial, and defense sectors with significant emphasis on supply chain attacks and credential harvesting operations.
Vidar is an information stealer first observed in 2018 that has continuously evolved its string obfuscation techniques to evade detection and analysis. Between May and September 2026, the malware progressed from basic XOR encryption to ChaCha20-based algorithms, and most recently implemented a custom virtual machine executed via a lightweight bytecode interpreter combined with custom stream ciphers that change per build. The VM uses 14 opcode handlers with simple primitives including XOR, addition, rotation, and substitution. Version 2.0 introduced this VM approach, while versions 2.2 and later added ARX-based custom stream ciphers using FNV-1a hashing and golden ratio constants. These per-build variations in opcodes, constants, and substitution tables significantly hinder static and automated analysis capabilities.
This analysis covers updates to Hangro, North Korea's state VPN and mail product, which operates on infrastructure spanning North Korea, Russia, and China. The July 2026 deployment introduced a new certificate hierarchy with cryptographic anomalies, including signature verification failures. The infrastructure includes network assignments linked to Silibank in Chinese address space and Russian Far East networks. Hangro evolved from a commercial email gateway to a certificate-bound VPN service used by trade representatives. The mail systems support bulk transfers with large message limits and intermittent connectivity features.
