Intel Exchange

An unidentified ransomware-related threat actor is using SloppyRAT, a new multi-stage malware, to establish network footholds via ClickFix lures and blockchain-based C2 resolution.

A malicious LNK file disguised as an OIC invitation uses PowerShell to download an archive that installs PlugX via DLL side-loading through a Jarte-derived application.

Kimsuky (APT-C-55) utilizes multi-stage PowerShell and C# malware delivered via disguised installers to target South Korean institutions for intelligence theft.

Anthropic identifies multi-vector misuse of Claude AI models by state-sponsored actors (Russia, China, Iran), financially motivated groups (ShinyHunters), and commercial entities for cyber operations, surveillance, and conventional weapons development.

Transparent Tribe (APT-C-56) utilizes ISO/ZIP-based lure files and LNK execution chains to deploy CrimsonRAT and a custom Golang-based remote access trojan against Indian and South Asian targets.

The Iran-linked threat actor Handala Hack uses the HEAVYGRAM Telegram-based backdoor and CRUDEEXCLUDE utility to target dissidents and journalists for surveillance and data exfiltration.

LausivLoader utilizes a multi-stage infection chain involving JavaScript, PowerShell, and .NET, leveraging environment variable inheritance for inter-process data handoff and steganography to deliver final payloads.

Russian enterprises are facing sophisticated multi-stage attacks from NightEagle, Hacking Cat, and Toy Ghouls involving custom backdoors, wipers, and tunneling tools.

Oldphantomoftheopera and Phantom Softwares operate Phantom Stealer, a Malware-as-a-Service infostealer targeting Windows systems through multi-stage in-memory execution and obfuscated PowerShell to harvest credentials and cryptocurrency data.

A suspected Russian-speaking threat actor is using AI-powered agents to exploit a critical PaperCut NG/MF vulnerability chain (CVE-2026-81578 and CVE-2026-82078) to target the education sector globally.