In September 2026, attackers targeting a U.S. retailer shifted from error-prone manual commands to AI-generated PowerShell scripts, enabling rapid and effective exploitation. The AI-assisted attacks included credential harvesting from SolarWinds Orion software and lateral movement across servers. These attacks were financially motivated, focusing on point-of-sale systems to extract passwords and credentials. The intrusion was linked to earlier attacks in 2026 that lacked AI assistance, indicating recent integration of AI capabilities. Similar AI-assisted attacks increased across multiple sectors and countries throughout 2026.
Melofee is a Linux implant malware that has evolved over three years to include a modular architecture with hot-loadable components for shell access, file management, and command execution. It incorporates a kernel rootkit based on the Reptile project to enhance stealth and supports multiple communication protocols with RC4 encryption. The malware infrastructure uses fake certificates impersonating legitimate entities and shows code similarities with Windows implants linked to Chinese state-sponsored groups. Its modular design allows dynamic loading of up to eleven specialized modules via a common plugin interface.
SilkParasite is a cyberespionage operation assessed with medium confidence as China-nexus that targeted government bodies across Central Asia. Seven remote access tool families were deployed, five of which were previously undocumented: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. The toolset is small, modular, and professionally engineered with traces of AI-assisted development. Initial access occurred through malicious Microsoft Office documents delivered via spear-phishing, using regionally tailored lures impersonating government ministries. The operation leveraged DLL sideloading as the primary delivery mechanism and used Google Drive for command-and-control communications to hide within trusted services. Infrastructure analysis identified connections to China Unicom's backbone network, and operational patterns suggest a functioning software organization with maintained build pipelines and careful operational security.
Between February 2024 and April 2026, multiple cyberespionage actors, suspected to be China-nexus and India-nexus threat groups, conducted sustained intrusions into Pakistani law enforcement organizations, particularly Balochistan Police. The compromised infrastructure included network appliances and servers hosting web applications managing criminal records, biometric data, hotel registrations, and citizen complaints. A suspected China-nexus actor weaponized the Complaint Management System web application by deploying custom implants disguised as portal updates, targeting both police personnel and citizens. China's likely motivation stems from concerns over the safety of Chinese nationals in Pakistan, particularly regarding attacks by separatist groups. India's suspected interest relates to its adversarial relationship with Pakistan, with Balochistan Police offering intelligence on security operations in a strategically sensitive province. The attackers deployed PlugX, ShadowPad, Cobalt Strike, Remcos, an...
Mustang Panda orchestrated two concurrent espionage campaigns targeting Indian government entities and hydropower infrastructure between May and June 2026. The campaigns leveraged DLL sideloading via legitimate executables to deploy newly identified malware including SHARDLOADER, MINIRECON, and ZOHOMURK. MINIRECON represents an evolution of Toneshell with WebSocket-based command-and-control capabilities, while ZOHOMURK abuses Zoho WorkDrive cloud services for C2 communications and data exfiltration. Distribution occurred through spear-phishing with lures themed around India-Taiwan cooperation agreements and hydropower projects. The activity demonstrates code overlaps with previous tooling, infrastructure proximity to known operations, and targeting patterns aligned with Chinese strategic intelligence collection priorities. Multiple compromised government systems were identified, with coordination conducted through CERT-In for victim notification and remediation.
Cisco Talos uncovered 'DKnife', a sophisticated gateway-monitoring and adversary-in-the-middle (AitM) framework comprising seven Linux-based implants. Used since 2019, DKnife performs deep-packet inspection, traffic manipulation, and malware delivery via routers and edge devices. It targets various devices, including PCs, mobile devices, and IoT, delivering ShadowPad and DarkNimbus backdoors. The framework primarily targets Chinese-speaking users, with evidence suggesting China-nexus threat actors as operators. DKnife's capabilities include DNS hijacking, Android application update hijacking, Windows binary hijacking, anti-virus traffic disruption, and user activity monitoring. A link to the WizardNet campaign was also discovered, indicating a shared development or operational lineage.
UAT-7290, a sophisticated threat actor active since 2022, is targeting critical infrastructure entities in South Asia, particularly telecommunications providers. The group's arsenal includes malware families like RushDrop, DriveSwitch, SilentRaid, and Bulbature. UAT-7290 conducts extensive reconnaissance before intrusions, using one-day exploits and SSH brute force to compromise edge devices. The actor is believed to be a China-nexus APT, sharing similarities with APT10 and other known Chinese threat groups. UAT-7290 has recently expanded its targeting to Southeastern Europe and may establish Operational Relay Boxes for other China-nexus actors. Their malware suite primarily focuses on Linux systems but can also utilize Windows-based implants.
Ink Dragon, a Chinese threat actor, is conducting a sophisticated espionage campaign targeting government entities in Europe, Southeast Asia, and South America. The group exploits IIS misconfigurations to gain initial access and deploys a custom ShadowPad IIS Listener module to create a victim-based relay network, turning compromised servers into nodes of a distributed mesh. They use a new variant of the FinalDraft malware and platform-native tools to maintain stealth and blend into normal enterprise telemetry. Their operations are characterized by disciplined playbooks and advanced software engineering, enabling persistent and covert intrusions. The campaign poses a medium severity threat due to its targeted nature and stealth capabilities, with no known public exploits yet. European organizations, especially government sectors running IIS servers with potential misconfigurations, are at risk. The threat actor’s relay network complicates detection and response efforts, increasing the potential impact on confidentiality and operational integrity. Mitigation requires focused IIS hardening, network segmentation, and advanced telemetry analysis to detect anomalous relay behaviors.
Salt Typhoon is a Chinese state-sponsored threat actor targeting major telecommunications providers globally by exploiting vulnerabilities in various network devices. This analysis monitors exposures of internet-facing devices linked to Salt Typhoon activity over six months, including Sophos Firewalls, Cisco IOS XE WebUIs, Ivanti Connect Secure, and Fortinet FortiClient EMS systems. Overall exposure decreased by 25%, with Sophos Firewall interfaces showing the largest reduction, while Cisco IOS XE exposure increased. Most exposures are concentrated in the United States, except for Sophos XG Firewall exposures in Germany. The persistence of exposed devices suggests ongoing challenges in remediation and organizational response.
