Intel Exchange

Seedworm (MuddyWater) conducted a global espionage campaign in early 2026 using Node.js loaders and DLL sideloading to target manufacturing, government, and financial sectors.

UNC5142 utilizes EtherRAT and the AI-generated TukTuk framework to conduct data exfiltration and deploy The Gentlemen ransomware via decentralized and SaaS infrastructure.

China-nexus threat group UAT-8302 targets government entities in South America and southeastern Europe using a suite of shared and custom malware including NetDraft, CloudSorcerer, and VSHELL.

China-aligned actor SHADOW-EARTH-053 targets government and defense sectors in Asia using DLL sideloading, multiple tunneling tools, and exploitation of CVE-2025-55182.

Threat actors including GOLD ENCOUNTER and campaigns STAC4713/STAC3725 are abusing QEMU virtualization to hide backdoors and deploy PayoutsKing and 3AM ransomware.

JanelaRAT is an evolving variant of BX RAT targeting financial and cryptocurrency institutions in Latin America through DLL side-loading and sophisticated overlay attacks.

The Iranian threat actor MuddyWater (MOIS) is leveraging Russian-speaking TAG-150's CastleRAT and ChainShell malware platforms to target Israeli infrastructure and aerospace sectors.

The threat actor UAT-10362 is targeting Taiwanese NGOs and universities with a modular Lua-based stager called LucidRook and a reconnaissance tool named LucidKnight.

The Russia-aligned actor Pawn Storm (APT28) is deploying the PRISMEX malware suite via zero-day exploits and advanced steganography to target the Ukrainian defense supply chain and NATO logistics hubs.

Multiple China-aligned threat actors, including Stately Taurus and clusters CL-STA-1048/1049, are targeting a Southeast Asian government using a diverse toolkit of USB-propagated malware, novel loaders, and remote access Trojans.