Intel Exchange

2CLoader is a sophisticated new malware loader identified in August 2026 that uses indirect system calls and environment spoofing to deliver information stealers like Vidar and Remus.

China-nexus actors UAT-11587 and UNC6384 are targeting government, diplomatic, and policy organizations across Asia and Europe using the novel Rust-based Antino backdoor and PlugX RAT via complex multi-stage infection chains.

SilverFox actors are targeting Malaysian users via WhatsApp lures that deliver ValleyRAT using DLL side-loading of a signed KuGou Technology executable.

Water Hydra (EvilNum) has transitioned from complex zero-day exploits to social engineering-driven campaigns using .PIF files and non-standard protocol handlers to deliver the DarkMe RAT.

TASK#STOMP uses a VBScript-orchestrated execution chain to deploy a multi-stage PowerShell backdoor focused on automated document exfiltration, credential theft, and remote access.

The Russian-aligned Lunex Malware-as-a-Service platform utilizes a complex four-stage attack chain, including BYOVD-based EDR neutralization, to deploy a sophisticated information stealer and C2 agent.

The Go-based ClosedQuorum malware utilizes multiple commercial AI models to autonomously select post-compromise actions, including credential dumping and process injection, without human operator intervention.

Adversary Pursuit Group identified ChainScript, a Node.js RAT that utilizes Polygon smart contracts for resilient C2 infrastructure rotation and delivery via ClickFix lures.

The Iranian Ministry of Intelligence and Security (MOIS) uses HEAVYGRAM (aka CHOSEN BRICK) malware to target dissidents and journalists via social engineering and Telegram-based command-and-control.

Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.