ills3c Intel&Coffee

KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.

Qilin and INC ransomware groups are exploiting CVE-2026-0257 in PAN-OS to bypass MFA and pivot into VMware virtualization environments for offline credential dumping.

Chinese-speaking and English-speaking threat actors are using the Cairn AI penetration testing tool to automate vulnerability discovery and web shell deployment against global e-commerce and retail targets.

A new ClickFix variant uses browser cache smuggling to bypass Windows Run dialog character limits and deploy in-memory .NET credential stealers.

Threat actor CL-UNK-1211 and other groups are leveraging AI agents and LLM-generated code to discover zero-days and orchestrate rapid exploitation campaigns against Linux infrastructure.

The Lazarus Group is targeting South Korean sectors by exploiting mandatory financial security software to deploy a sophisticated malware framework featuring post-quantum encryption.

Threat actors are increasingly deploying autonomous AI agent frameworks like CyberStrikeAI and ARTEX to industrialize the attack lifecycle, targeting organizations in Japan and globally.

OrbitalVoyage is an Android RAT distributed via a TikTok-themed dropper that uses a VPN black-hole technique to disable security cloud checks during installation.

UNC7017 targeted AOMEI Technology update infrastructure using brief configuration tampering windows to deliver CROSSROAD and SHINYROAD malware.

Ransomware groups including Qilin and Settra are exploiting CVE-2026-0257 to bypass authentication in Palo Alto Networks GlobalProtect for unauthorized internal network access.