Ethan Andrews

Blackpoint APG identified Miraak, a modular post-exploitation framework using PostgreSQL/Timescale for C2 communication and featuring Cobalt Strike BOF compatibility.

Chinese-speaking threat actor TA4922 is utilizing PackClient, a modular C2 framework sold on Telegram, to target organizations in China and India with tax-themed phishing lures.

Russian state-sponsored actor BlueDelta utilized macro-enabled Word documents to deploy HOOKEDGE, a batch-script backdoor abusing legitimate webhook services for C2 and exfiltration targeting European government entities.

Zhibotong (ZBT) electronics routers and white-labeled variants contain multiple pre-installed surveillance implants enabling unauthenticated root access, DNS hijacking, and credential exfiltration.

Adversaries are using AI-assisted scripts and the snap7.dll library to target Internet-exposed Siemens S7 PLCs for reconnaissance and potential disruption across U.S. critical infrastructure.

Certighost (CVE-2026-54121) is a critical improper authorization vulnerability in AD CS allowing low-privileged users to impersonate Domain Controllers by abusing unverified directory referrals.

ClickFix campaigns are deploying PavinLoader, a multi-stage .NET loader that uses EtherHiding and MSBuild to deliver Amatera Stealer and other payloads.

SynkLoader is a modular Windows malware family distributed via Microsoft Teams phishing that uses a bundled Python environment and in-memory components to facilitate credential theft, tunneling, and remote access.

The SysScan refund scam uses fraudulent Microsoft-branded security scans to deceive users into uninstalling antivirus software and providing remote access credentials.

Threat actors associated with the Beamglea campaign are abusing the npm registry and unpkg mirrors to host malicious HTML files that simulate Cloudflare CAPTCHA pages to distribute ClickFix phishing malware.