Arnold Chan

REVSTEALER is a comprehensive Windows infostealer using Polygon smart contracts for resilient C2 infrastructure and delivering specialized modules for crypto-mining and reverse proxying.

StyleSmuggler is an unauthenticated zero-day RCE vulnerability in Magento and Adobe Commerce being exploited to deploy persistent Rust-based implants and backdoors.

DragonForce is a ransomware service ecosystem deploying Windows lockers that use ChaCha8 encryption and target SMB shares to maximize network impact.

State-sponsored and crimeware actors are actively exploiting Cisco Secure Firewall Management Center vulnerabilities to deploy Cyclops Blink, Qilin ransomware, and custom web shells.

LiteLLM vulnerabilities (CVE-2026-59821, CVE-2026-59822) enable unauthenticated attackers to bypass security controls, achieve root-level RCE, and exfiltrate cloud IAM credentials.

Threat actors are increasingly using infostealers like Lumma and Vidar to harvest session tokens and API keys for AI services to bypass MFA and hijack high-cost compute resources.

An advanced threat actor, PoisonedRefresh, is exploiting CVE-2025-53521 in F5 BIG-IP systems to deploy a sophisticated Linux rootkit that injects in-memory PHP webshells.

Indonesian threat actors are deploying Mantax Otax, a hybrid Android malware that combines AES-256 ransomware with extensive spyware capabilities to extort victims through double extortion.

A Chinese-speaking operator uses the PEEP toolkit, a RedExt derivative, to transform Chromium browsers into persistent host-level backdoors via native-messaging bridges.

Suspected Silver Fox actors are targeting Latin American banking and financial sectors using fake DocuSign and NFe tax lures to deliver a custom HVNC backdoor for persistent remote control.