Intel Exchange

AsyncRAT is delivered through a complex five-stage infection chain involving obfuscated PowerShell, a signed AutoIT interpreter, and memory-only .NET loaders to evade detection.

A suspected Russian-speaking threat actor is using AI-powered agents to exploit a critical PaperCut NG/MF vulnerability chain (CVE-2026-81578 and CVE-2026-82078) to target the education sector globally.

Suspected state-sponsored actors and cybercriminals, including Midnight Blizzard and ShinyHunters, are utilizing generative AI frameworks like PentAGI to automate the cyber kill chain, reconnaissance, and malware development against global targets.

An unsigned GlobalProtect-themed MSI deploys a backdoor that utilizes Cloudflare Workers for configuration and Google Sheets for C2 communication, specifically targeting victims in Myanmar.

REVSTEALER is a comprehensive Windows infostealer using Polygon smart contracts for resilient C2 infrastructure and delivering specialized modules for crypto-mining and reverse proxying.

Suspected Silver Fox actors are targeting Latin American banking and financial sectors using fake DocuSign and NFe tax lures to deliver a custom HVNC backdoor for persistent remote control.

Infrastructure Destruction Squad (BLACKNET-00) utilizes functional Firebase exposure scanners, weak ransomware builders, and ICS reconnaissance tools to target critical infrastructure and commercial sectors.

BlackSuit ransomware operators conducted a 9-day intrusion starting with VPN brute-force attacks on non-MFA accounts, followed by lateral movement via RDP and data staging before enterprise-wide encryption.

Threat actors are exploiting ScreenConnect to deploy a four-stage VBScript chain that propagates across active remote sessions, ultimately delivering miners and backdoors.

APT28 and MuddyWater utilize ClickFix variants to compromise organizations via social engineering, deploying multi-stage payloads including steganography and Python-based reverse tunnels for internal network pivoting.