In late August, an organization was compromised by INC ransomware affecting at least 175 endpoints. The attack unfolded over several weeks with a 17-day gap, indicating involvement of an initial access broker and a separate ransomware affiliate. Early activity included scheduled tasks with randomized names and lateral movement via RDP using compromised credentials. After the pause, attackers deployed AnyDesk for remote access, used Bring Your Own Vulnerable Driver (BYOVD) techniques to disable security controls, and executed ransomware using Impacket tools. Two ransom notes were found: the standard ransom demand and a secondary data leak threat note listing stolen files and threatening to contact media, employees, and partners within 48 hours to pressure the victim.
A sophisticated multi-stage infection chain was discovered through analysis of a system exhibiting frequent PowerShell execution alerts. The attack leveraged multiple layers of obfuscation and concealment techniques, including Registry-based payload storage, DNS TXT record exploitation, and data hidden within image and WAV audio files. The threat actors employed various evasion methods such as security control tampering and in-memory execution to avoid detection. Rather than writing payloads directly to disk, attackers reconstructed malicious code from distributed sources including Registry entries and steganographically encoded data in media files. The ultimate objective of this elaborate infection chain was to deploy cryptocurrency mining operations covertly on compromised systems while maintaining persistent access through multiple redundant mechanisms.
In April 2026, a manufacturing organization in the Middle East was targeted by a ransomware attack leveraging Active Directory Group Policy Objects (GPOs) without deploying ransomware binaries on endpoints. Attackers with domain admin privileges created malicious GPOs linked at the domain root to distribute ransom notes, modify user interface elements, enforce logon banners, and disable local administrator accounts across all domain-joined workstations. The attack did not encrypt files but focused on operational disruption and data exfiltration. Initial access was obtained via compromised VPN credentials. The attackers delayed activation by one day to evade detection by file-based security tools, exploiting trusted Active Directory infrastructure for domain-wide impact.
The Lazarus subgroup TraderTraitor conducted targeted campaigns in 2026 against cryptocurrency-related and non-cryptocurrency entities, including a notable $292 million theft from KelpDAO via LayerZero. A smaller IT services provider in India was also compromised through social engineering involving fake job interview lures with weaponized Terraform projects. Malicious GitHub repositories with typosquatted domains delivered macOS backdoors FLATROOF and ROOFDECK during terraform init execution. These backdoors facilitated reconnaissance, credential theft, and cloud environment escalation. After public disclosure of the LayerZero attack, attackers deployed an updated ROOFDECK backdoor and removed earlier implants, continuing activity until June 2026 before abandoning the intrusion due to low value from the smaller target.
ChainScript is a Node.js remote access trojan (RAT) identified by Blackpoint's Adversary Pursuit Group. It masquerades as legitimate software such as Spotify, Zoom Workplace, and Microsoft Teams via malicious Windows Installer packages. The malware uses a Polygon blockchain smart contract to dynamically discover its command and control (C2) infrastructure, allowing operators to rotate backend services without rebuilding agents. ChainScript offers extensive remote access features including shell access, file operations, screenshots, payload deployment, cryptocurrency wallet discovery, remote JavaScript execution, self-updating, and cleanup. Multiple builds with different names share the same core architecture.
A Lazarus group cyberespionage campaign targeted a Spanish aerospace company by impersonating Meta recruiters on LinkedIn and sending trojanized coding challenges. The attack used spearphishing via LinkedIn Messaging to deliver malicious executables disguised as C++ programming tests. The campaign deployed multiple malware tools including LightlessCan, a new backdoor with enhanced stealth and command capabilities, NickelLoader downloader, and miniBlindingCan variant. DLL side-loading was used to load payloads, and the attack aimed to steal aerospace technology and know-how, aligning with North Korean strategic interests.
WeaselBiscuit is a JavaScript infostealer malware distributed through 11 malicious npm packages. It executes a detached Node.js process, retrieves payloads from Npoint URLs, and communicates with a command-and-control server at 103.170.217.184:8787. The malware profiles infected hosts, steals Chrome extension storage related to wallet signing states, captures clipboard contents, and logs Windows keystrokes on command. It is a stripped-down variant of DPRK-linked BeaverTail and OtterCookie malware families, lacking wallet draining, password decryption, screenshot capture, and remote shell capabilities. Numeric campaign identifiers in package names are used for infection tracking. Attribution to DPRK is suggested but not definitive.
Fraudulent organizations in Korea are exploiting private Home Trading System (HTS) software to distribute ransomware to victims. The unauthorized HTS program called 'UBP Asset' impersonates the legitimate Swiss financial institution Union Bancaire Privee (UBP) and has been used in investment scams since at least September 2025. Attackers lure victims through social media platforms like Telegram and KakaoTalk, convincing them to install the fraudulent HTS and deposit funds. The latest campaign involves distributing KRSID ransomware through the HTS update mechanism, which encrypts files using AES-256 and RSA-2048 algorithms. Previous campaigns used similar private HTS programs to distribute Quasar RAT. Victims not only lose their investment funds but also have their systems compromised and files encrypted for ransom demands.
The PolinRider campaign compromises developer GitHub accounts to inject malicious code into development versions of popular packages, including visanduma/nova-two-factor on Packagist. It targets multiple ecosystems such as npm, PyPI, Go modules, Packagist, and Chrome extensions by abusing Git-based collaboration workflows rather than directly compromising package registries. The attackers use advanced techniques like rewriting Git history, hiding payloads in configuration and font files, and triggering execution via IDE tasks. PHP projects are specifically targeted with obfuscated JavaScript executed through shell_exec calls. The campaign is attributed to North Korean actors focusing on cryptocurrency theft.
LabubaRAT is a custom 64-bit Rust-based remote access trojan targeting Windows systems. It masquerades as legitimate NVIDIA software to evade detection and offers extensive remote control capabilities including command execution, file operations, screen capture, and SOCKS5 proxying. The malware is part of a malware-as-a-service framework managed via a backend called LabubaPanel hosted on German infrastructure. It uses its own JavaScript execution for delivery and employs evasion techniques such as impersonation of NVIDIA components and abuse of Microsoft build utilities. First observed in July 2026, it is unsigned and designed for persistence and stealth.
An Israeli influence-for-hire company called BlackCore has been identified conducting digital manipulation campaigns across multiple countries. The company operates through a sophisticated infrastructure offering services including discourse dominance, organic engagement manipulation, and counter-operations. Researchers identified a specific campaign involving a 14-week training program delivered to Angolan government employees in early 2026, which included the creation and deployment of fake social media personas and coordinated inauthentic behavior. The operation utilized AI-generated profile pictures, fake news outlets like 'Agita News', and coordinated amplification tactics across Facebook, Instagram, and TikTok. BlackCore's promotional materials openly advertised their capabilities to conduct deceptive influence operations on behalf of government clients, demonstrating how influence-for-hire services have become accessible to state actors seeking to manipulate online discourse.
Analysis reveals HEAVYGRAM, a multi-stage Windows backdoor attributed to Iran-linked threat actor Handala Hack, deployed since Fall 2023 targeting Iranian dissidents, journalists, and government opponents. The surveillance tool uses Telegram bot API for command-and-control operations, enabling remote command execution, screen capture, data exfiltration, and persistent access. Victims receive social-engineered files masquerading as legitimate applications like Telegram, KeePass, or Pictory. The implant supports DLL side-loading, registry persistence, and system reconnaissance. Infrastructure analysis identified 29 samples utilizing networks of Telegram bots and groups for operations. The malware aligns with activity disclosed by U.S. Department of Justice regarding Iran's Ministry of Intelligence and Security infrastructure seizures, with tradecraft including Vultr Object Storage and Persian-language decoys targeting specific victim profiles including academics and media personnel.
A significant supply chain attack compromised Brevo's infrastructure on September 14, 2026, affecting over 100,000 customer websites. Attackers injected malicious code into Brevo's JavaScript assets and widgets, delivering two distinct payloads: a WordPress plugin backdoor automatically installed when site administrators visited their own sites while logged in, and ClickFix overlays targeting regular visitors. The attack vector involved modification of Brevo's CDN-hosted files and creation of malicious subdomains under sendibt1.com. Evidence suggests attackers gained access to Brevo's Cloudflare account, allowing them to modify DNS records and rewrite content dynamically. The malicious activity lasted approximately four hours, from 16:05 to 20:12 UTC. Brevo's prominent clients include eBay, Louis Vuitton, Michelin, and Amnesty International, amplifying the attack's potential impact significantly.
SparroWocky is a sophisticated C++ backdoor used by the China-aligned FamousSparrow APT group since August 2025. It targets governmental organizations in Latin America with advanced evasion and modular capabilities. The backdoor uses reflective loading, call stack spoofing, encrypted communications, and host process camouflage to avoid detection. It replaces a previous backdoor called SparrowDoor and incorporates open-source projects within its codebase. The threat actor's focus aligns with geopolitical interests in monitoring Latin American governmental responses to US pressures.
Settra is a ransomware variant first observed in June 2026 that targets organizations via VPN access or compromised credentials. It achieves persistence by deploying MeshAgent RMM and encrypts files with .locked or .locked_wip extensions, dropping ransom notes named RESTORE_FILES.txt. The ransomware also inhibits recovery by clearing Windows event logs and disabling Windows recovery options using reagentc and diskpart utilities. One incident involved Bring Your Own Vulnerable Driver (BYOVD) tactics using the vulnerable driver gdrv.sys. Attackers made an operational security error by misspelling the Windows Defender Event Log path, preventing its deletion. The attacks affected consumer services, retail, and manufacturing sectors and used different command and control IP addresses.
A cluster of command and control servers linked to the SpiceRAT malware family has been active from late 2025 through August 2026, targeting energy and government entities across Central Asia. The infrastructure uses shared TLS certificates, domain registrations, and a cloned corporate webpage to support multiple RAT families, including SpiceRAT, NodeEdgeRAT, NomadRAT, and BloodAlchemy. Notably, a TLS certificate impersonating Uzbekistan's railway authority was issued by a Chinese state-affiliated certificate authority. Domains spoof various Central Asian government organizations, indicating a focused regional targeting campaign. Passive DNS data shows the infrastructure has been operational since mid-2022, suggesting a long-term espionage operation. The infrastructure shares characteristics with known China-nexus threat actors FamousSparrow and IndigoZebra. No known exploits in the wild or patches are applicable as this is an active threat infrastructure rather than a software vulnerability.
Noodle RAT is a modular remote access trojan with distinct Windows and Linux versions, used since at least mid-2016 by Chinese-speaking threat actors. It has been involved in espionage and cybercrime campaigns targeting multiple Asia-Pacific countries. The malware features shared command-and-control infrastructure and modular capabilities, with the Windows variant operating as an in-memory backdoor and the Linux variant providing reverse shell and proxy functionalities. Multiple threat groups have deployed Noodle RAT, which appears to be actively maintained and possibly commercially available.
In August 2026, the Pakistan-nexus threat actor APT36 launched Operation RapidRust, targeting government and defense organizations in India and Afghanistan with an updated arsenal of custom tools. The campaign introduced RUSTYSHADE, a Rust-based backdoor leveraging private GitHub repositories for command-and-control with AES-256-GCM encryption. Additional tools included RUSTYMOVE for USB-based lateral movement to air-gapped networks, PSNATCH and BASHNATCH for file exfiltration from Windows and Linux systems respectively. The attackers registered typosquatted domains impersonating Indian news outlets to stage malicious PowerShell scripts. Post-compromise activities revealed systematic network reconnaissance, credential harvesting, and lateral movement attempts, with operations conducted exclusively on weekdays between 4:00-11:00 UTC, demonstrating disciplined operational security and sustained targeting of South Asian government infrastructure.
This threat involves illegal online gambling infrastructure that spans multiple cybercrime categories, including money laundering, scams, and espionage. It includes over 1.7 million Chinese-language casino domains linked to triad-aligned syndicates, thousands of scam gambling websites targeting global users with rigged games and withdrawal fraud, and China-aligned APT groups deploying the PeckBirdy malware framework via fake casino and adult websites. These operations exploit hosting providers in the U.S. and Europe while using bulletproof hosting in Asia. The campaigns have increased sharply since 2023, with PeckBirdy domains evading detection on VirusTotal. The visual similarity of these sites complicates detection efforts.
The KREMLIN toolkit is a Brazilian banking malware operation active since May 2025, targeting Brazilian financial institutions via malicious Chrome browser extensions. It manipulates Chromium's integrity checks by forging Secure Preferences and HMACs to evade detection. The malware intercepts credentials, session tokens, and sensitive banking data through keylogging and request interception. The operation uses Ethereum smart contracts for dynamic command and control configuration and has evolved through multiple campaigns delivering different remote access trojans. Over 1,500 infections have been temporarily disrupted, with the vast majority of victims located in Brazil.
