Intel Exchange

Mustang Panda and other Chinese APTs utilize the PlugX RAT for espionage and credential theft, leveraging DLL side-loading and USB propagation.

German law enforcement and suspected state actors are bypassing end-to-end encryption by leveraging linked-device features to clone messenger accounts on WhatsApp, Signal, and Telegram.

The Pakistan-nexus threat actor APT36 (Transparent Tribe) is conducting Operation RapidRust targeting government and defense sectors in India and Afghanistan using new Rust-based backdoors and USB propagation tools.

Suspected state-sponsored actors and cybercriminals, including Midnight Blizzard and ShinyHunters, are utilizing generative AI frameworks like PentAGI to automate the cyber kill chain, reconnaissance, and malware development against global targets.

Gamaredon, a Russian FSB-operated group, uses a multi-stage modular framework (GammaPhish, GammaLoad, GammaWorm, GammaSteel) to maintain persistent access and exfiltrate sensitive documents from Ukrainian government and critical infrastructure.

Salty Spider's long-standing Sality P2P botnet has been disrupted through a global sinkholing operation targeting its peer-to-peer communication and payload delivery infrastructure.

The StopAndProtect operation abuses compromised WordPress sites to distribute a multi-component toolkit for file encryption, data theft, and lateral movement via social engineering.

The Russia-aligned Gamaredon group significantly updated its arsenal in 2025, deploying six new PowerShell tools and leveraging legitimate cloud services and tunnels to target Ukrainian military and government institutions.

The Gentlemen ransomware, operated by the Phantom Mantis group (LARVA-368), has evolved from a RaaS affiliate into an independent operation featuring AI-assisted development and a self-propagating worm module.

LCRYX is a multifunctional VBS-based ransomware and worm that performs extensive registry tampering, security software termination, and network-wide self-propagation.