Intel Exchange

Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.

SafePay ransomware actors target global critical infrastructure by exploiting edge device vulnerabilities and using legitimate administrative tools for data exfiltration and hybrid encryption.

Qilin (aka Agenda) is a high-volume Russian-speaking RaaS operation targeting global manufacturing and healthcare sectors through credential abuse and advanced EDR evasion.

China-nexus actors UAT-11587 and UNC6384 are targeting government, diplomatic, and policy organizations across Asia and Europe using the novel Rust-based Antino backdoor and PlugX RAT via complex multi-stage infection chains.

The Go-based ClosedQuorum malware utilizes multiple commercial AI models to autonomously select post-compromise actions, including credential dumping and process injection, without human operator intervention.

The researcher Nightmare Eclipse (aka MSNightmare) has released multiple proof-of-concept exploits targeting Windows Defender, Kaspersky, Avast, CrowdStrike, and NVIDIA drivers to achieve local privilege escalation or denial-of-service.

The PAYLOAD ransomware family hijacked Active Directory Group Policy Objects to deliver ransom notes and disable host security domain-wide without endpoint binaries.

Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.

LausivLoader utilizes a multi-stage infection chain involving JavaScript, PowerShell, and .NET, leveraging environment variable inheritance for inter-process data handoff and steganography to deliver final payloads.

DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.