Intel Exchange

APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.

The MALFEX threat actor is using malicious npm packages like 'imgdecode' to deliver a native Windows DLL loader that injects shellcode and a remote access tool into developer workstations.

Play (or Playcrypt) is a sophisticated ransomware group utilizing double extortion, custom information stealers like Grixba, and exploitation of vulnerabilities in FortiOS and Microsoft Exchange to target global organizations.

IronChain is a destructive malware build packaged with PyInstaller that utilizes multiple kernel drivers for process termination and persistence while intentionally discarding encryption keys to prevent data recovery.

The PAYLOAD ransomware family hijacked Active Directory Group Policy Objects to deliver ransom notes and disable host security domain-wide without endpoint binaries.

Settra ransomware targets consumer services and manufacturing sectors using MeshAgent RMM for persistence and Bring Your Own Vulnerable Driver (BYOVD) to disable security tools.

The threat actor zdn2pwn utilizes XHOPELESS v1.0, a sophisticated multi-phase wiper designed to permanently brick Windows systems by corrupting UEFI firmware, destroying disk partitions, and disabling all recovery mechanisms.

DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.

China-nexus actor Fire Ant is compromising Cisco Nexus switches and IOS XR routers to harvest credentials and establish covert tunnels into critical infrastructure.

Silver Fox threat actor is distributing the ValleyRAT backdoor by masquerading as signed adware applications to exfiltrate sensitive data from targets in China and India.