Star Blizzard is a Russian espionage group linked to the Federal Security Service Centre 18, targeting government, defense, NGOs, and academia mainly in the UK, US, Ukraine, and NATO countries. The group uses spear-phishing, impersonation, and relationship building to steal credentials and conduct hack-and-leak operations. Since 2024, they have expanded to deploying endpoint malware including SPICA, YESROBOT, MAYBEROBOT, and CosmicPulse backdoors. Their tactics evolved from targeted to bulk phishing campaigns using fake CAPTCHA lures and exploiting iOS devices with the DarkSword exploit kit. They also use compromised WordPress sites for infrastructure and rapidly develop new malware variants after exposure. Recent campaigns have targeted over 100 organizations with the RedFlick delivery chain, showing increased scale and sophistication.
In September 2026, the Chinese threat actor UTA0565 exploited unpatched zero-day vulnerabilities in Google Chrome and Microsoft Windows through phishing campaigns targeting Asian government entities. The attacker used fake domains impersonating legitimate organizations to deliver an exploit chain leveraging CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. Successful exploitation resulted in deployment of CLEANGULP, a previously undocumented malware family with backdoor capabilities including command execution, file operations, and beacon object file execution. CLEANGULP communicated with command-and-control servers using encrypted HTTP traffic with custom encoding. Multiple Chinese APT groups shared access to this exploit kit, indicating coordinated cyber espionage activity during the vulnerability window. Patch status is not yet confirmed; organizations should monitor vendor advisories and apply patches once available.
Educational institutions continue to be the most targeted sector globally, experiencing an average of 4,696 weekly cyberattacks per organization between January and July 2026, representing an 8% increase year-over-year and more than double the cross-industry average. The back-to-school period sees intensified malicious activity, with July 2026 recording 4,848 weekly attacks. Threat actors are registering thousands of education-themed domains, with one in every 226 newly registered domains being malicious. APAC leads with 7,452 weekly attacks, while Europe and Latin America show the fastest growth at 18% and 42% respectively. Attackers deploy phishing campaigns impersonating retailers, schools, and Microsoft 365 to steal credentials and financial information from students, educators, and families during peak enrollment periods.
The 2026 FIFA World Cup presents a concentrated attack surface spanning three nations, 16 cities, and billions of viewers. Cybercriminals have already launched phishing campaigns, fraudulent ticket sales, and brand impersonation schemes targeting governments, sponsors, broadcasters, transportation providers, and telecommunications companies. Financially motivated actors are exploiting tournament-related interest through credential theft and payment fraud. Hacktivist and state-aligned groups, including pro-Iranian actors like Handala and CyberAv3ngers, may conduct DDoS attacks, website defacements, or espionage operations amid heightened geopolitical tensions involving Iran, the United States, and Russia. Ransomware groups such as Qilin, DragonForce, Akira, and Play may target organizations reliant on continuous service availability. Thousands of FIFA-themed domains have been registered, many exhibiting characteristics associated with fraud campaigns. Organizations throughout the ecosystem face elevated ris...
BTMOB is an Android remote access trojan that evolved from SpySolr malware and poses significant threats beyond traditional banking trojans. The malware combines phishing-led delivery with an APK builder interface that enables rapid payload generation without coding skills. Distributed through fake app stores impersonating streaming services, cryptocurrency platforms, and government agencies, BTMOB abuses Android Accessibility Services to gain elevated permissions. Marketed as malware-as-a-service with a reported $5,000 lifetime license, it provides adversaries with capabilities to exfiltrate sensitive data, capture screenshots, record device activity, and establish remote control. The tool's customizable phishing lures have been adapted for specific regions, including campaigns impersonating Argentine tax authorities, making it a rapidly evolving threat with global reach.
Two distinct phishing campaigns have been identified targeting companies in Greece, Spain, Slovenia, Bosnia and Central American countries to deliver FormBook data-stealing malware. The first campaign uses RAR attachments containing legitimate executables like Sandboxie ImBox.exe, TikTok desktop, Adobe PDF Preview Handler, and XZ Utils, exploiting DLL side-loading with malicious DLL files. The second campaign deploys heavily obfuscated JavaScript that drops encrypted PNG files, uses PowerShell with Base64 encoding, and leverages a custom .NET loader called Mandark to inject the payload into RegAsm process. Both campaigns deliver the same FormBook executable that employs advanced evasion by manually mapping ntdll.dll in memory to bypass user-mode monitoring and perform direct syscalls, enabling credential theft and data collection from browsers while avoiding detection mechanisms.
