Ankit Mehta

China-linked threat actor Storm-3069 uses NeedyMantis, a modular post-compromise framework, to maintain long-term access via DLL sideloading and custom encrypted archives.

AgtaBackup RAT uses deceptive Microsoft Store pages to deploy legitimate RMM tools as a bridge for a custom .NET backdoor targeting Windows systems.

SilverFox actors are targeting Malaysian users via WhatsApp lures that deliver ValleyRAT using DLL side-loading of a signed KuGou Technology executable.

The PAYLOAD ransomware family hijacked Active Directory Group Policy Objects to deliver ransom notes and disable host security domain-wide without endpoint binaries.

Exploitation of CVE-2026-65660 allows unauthenticated attackers to achieve Remote Code Execution on SharePoint servers by bypassing SafeControls type-checks using attribute injection in ToolPane markup.

Threat actors registered the common documentation placeholder third-party[.]com to serve ClickFix social engineering lures that trick Windows users into executing malicious PowerShell commands.

The threat actor 'General Boss' operates BigBear 2.0, an Evilginx2-based Phishing-as-a-Service framework targeting Microsoft 365 accounts globally using AiTM techniques to bypass MFA.