Intel Exchange

APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.

An extensive phishing campaign impersonating the U.S. District Court targets over 100,000 companies using personalized lures to deliver the LodaRAT remote access trojan via malicious ISO files.

The NEBULA campaign utilizes seven malicious npm packages disguised as NebulaAI SDKs to deliver a customized KNTRAT remote-access trojan using stealthy syscall-based execution.

China-based threat actors are deploying RatHat, a sophisticated Android Trojan that leverages generative AI for UI automation and ADB self-pairing for persistent shell access.

Kothamine Agent is a C/C++ remote access Trojan distributed via malicious npm packages that leverages Tailscale’s tailcat tool for encrypted C2 communication to bypass network detection.

The Pakistan-nexus threat actor APT36 (Transparent Tribe) is conducting Operation RapidRust targeting government and defense sectors in India and Afghanistan using new Rust-based backdoors and USB propagation tools.

Researchers at Forever Security demonstrated 'BragJack', a technique using malicious browser extensions to hijack AI assistants in Chrome, Edge, Comet, Opera Neon, and Claude by manipulating trusted domains and network traffic.

Suspected Russian clusters UNC6293, UNC7005, and UNC5976 are abusing legitimate authentication flows like OAuth and app passwords to target individuals in government, defense, and academia.

Russian-speaking operators are using custom platforms like camview and open-source scanners to exploit vulnerabilities in IP cameras and routers across Ukraine and Europe to build proxy networks.

Midnight Blizzard sub-cluster Storm-2945 is conducting the CaptiveCrunch campaign, leveraging traffic manipulation in hospitality networks to deliver custom Go and PowerShell malware and conduct device code phishing.