Intel Exchange

BabylonRAT is an open-source Remote Access Trojan (RAT) capable of credential theft, keylogging, and DDoS attacks, recently used in campaigns targeting public institutions in Malaysia.

The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.

PIVOTPIPE is a newly discovered .NET malware that reimplements Cobalt Strike Beacon features with custom evasion techniques, including AMSI bypassing and indirect syscalls.

SilverFox threat actors have upgraded their malware delivery chain from open access and whitelisting to a sophisticated cloud-based blacklist mechanism to evade detection by security researchers.

A suspected Russian-speaking threat actor is using AI-powered agents to exploit a critical PaperCut NG/MF vulnerability chain (CVE-2026-81578 and CVE-2026-82078) to target the education sector globally.

A threat actor designated TH-3BB targeted Thai ISP 3BB and Jasmine International using CVE-2024-21762 for initial access and MeshCentral for persistent command-and-control.

Suspected Chinese threat actor Red Heron is exploiting CVE-2026-60004 in Gitea to deploy the JITTERLY implant and SIXZUT rootkit for source code theft and lateral movement.

KATARU is a newly observed IoT malware family that utilizes Linux local privilege escalation exploits and encrypted C2 to conduct DDoS attacks.

UNC3569 is exploiting a one-click RCE vulnerability (CVE-2026-51990) in Sogou Input Method to deploy the GRAYRABBIT backdoor using a chained attack involving protocol handler injection and an outdated Chromium engine.

An unidentified threat actor is conducting a global phishing campaign using Vercel-hosted lures to deliver legitimate, signed RMM tools for remote system access.