Intel Exchange

Settra ransomware targets consumer services and manufacturing sectors using MeshAgent RMM for persistence and Bring Your Own Vulnerable Driver (BYOVD) to disable security tools.

Threat actors are using fake Grand Theft Auto VI (GTA6) installers to distribute a multi-component malware package including RATs, infostealers, and a wiper.

Op nKe y is a c o n f i g u r a b l e r a n s o m w a r e k i t u t i l i z i n g D i s c o r d w e b h o o k s f o r C2 c o m m u n i c a t i o n a n d m a s q u e r a d i n g a s l e g i t i m a t e W i n d o w s s e r v i c e s.

Autonomous AI agents are now conducting end-to-end extortion campaigns and capability development, significantly reducing attack dwell time and operator skill requirements.

DPRK cyber operations serve as an 'all-purpose sword' for revenue generation, espionage, and sanctions evasion through a complex hierarchy of state agencies and IT worker units.

A China-nexus threat actor is actively exploiting a critical path traversal flaw in VMware vCenter (CVE-2026-59310) to deploy the linuxFile backdoor and Babuk-derived ransomware across hypervisors.

DragonForce is a ransomware service ecosystem deploying Windows lockers that use ChaCha8 encryption and target SMB shares to maximize network impact.

State-sponsored and crimeware actors are actively exploiting Cisco Secure Firewall Management Center vulnerabilities to deploy Cyclops Blink, Qilin ransomware, and custom web shells.

Infrastructure Destruction Squad (BLACKNET-00) utilizes functional Firebase exposure scanners, weak ransomware builders, and ICS reconnaissance tools to target critical infrastructure and commercial sectors.

Indonesian threat actors are deploying Mantax Otax, a hybrid Android malware that combines AES-256 ransomware with extensive spyware capabilities to extort victims through double extortion.