Intel Exchange

Storm-2570 is a versatile ransomware affiliate utilizing consistent post-compromise tools like MeshAgent, ntdsutil, and s5cmd to deploy multiple ransomware families including Qilin and DragonForce.

The Pakistan-nexus threat actor APT36 (Transparent Tribe) is conducting Operation RapidRust targeting government and defense sectors in India and Afghanistan using new Rust-based backdoors and USB propagation tools.

Threat actors are actively exploiting CVE-2025-25249, a critical heap overflow in Fortinet's CAPWAP daemon, to deploy the PivotC2 remote access tool for network reconnaissance and lateral movement.

A suspected Russian-speaking threat actor is using AI-powered agents to exploit a critical PaperCut NG/MF vulnerability chain (CVE-2026-81578 and CVE-2026-82078) to target the education sector globally.

The China-linked hacking group QTFY (associated with Nanjing Xinjiuwei Network Technology) utilizes the QScan and QTRouter distributed systems to exploit IoT devices and target critical infrastructure globally.

Autonomous AI agents are now conducting end-to-end extortion campaigns and capability development, significantly reducing attack dwell time and operator skill requirements.

DragonForce is a ransomware service ecosystem deploying Windows lockers that use ChaCha8 encryption and target SMB shares to maximize network impact.

State-sponsored and crimeware actors are actively exploiting Cisco Secure Firewall Management Center vulnerabilities to deploy Cyclops Blink, Qilin ransomware, and custom web shells.

Infrastructure Destruction Squad (BLACKNET-00) utilizes functional Firebase exposure scanners, weak ransomware builders, and ICS reconnaissance tools to target critical infrastructure and commercial sectors.

Russian-speaking threat actors are exploiting a heap-based buffer overflow (CVE-2025-25249) in FortiGate devices to deploy PivotC2, an AI-assisted Node.js RAT for network tunneling and credential theft.