Arnold Chan

Infrastructure Destruction Squad (BLACKNET-00) utilizes functional Firebase exposure scanners, weak ransomware builders, and ICS reconnaissance tools to target critical infrastructure and commercial sectors.

Threat actors are actively exploiting critical arbitrary file upload vulnerabilities in Super Forms and Elementor Pro plugins to deploy the Mushr00w PHP uploader and seize control of WordPress sites.

Russian-speaking threat actors are exploiting a heap-based buffer overflow (CVE-2025-25249) in FortiGate devices to deploy PivotC2, an AI-assisted Node.js RAT for network tunneling and credential theft.

The CL-CRI-1171 threat actor operates a mature Pay-Per-Install (PPI) marketplace that leverages SEO poisoning and trojanized YouTube gaming content to distribute OfferLoader and a variety of secondary payloads including Insomnia RAT and ARKTunnel.

BlackSuit ransomware operators conducted a 9-day intrusion starting with VPN brute-force attacks on non-MFA accounts, followed by lateral movement via RDP and data staging before enterprise-wide encryption.

The Hagaseca cluster uses THost9, a multi-stage Android RAT and ADB worm that leverages accessibility services and exposed ADB ports to infect physical and containerized Android environments.

The Kim Sooki threat actor utilizes the Syslogk Linux rootkit to achieve persistence and concealment by hooking kernel APIs to hide processes, network connections, and files.

A suspected Chinese-speaking threat actor is targeting systems in South Korea to install remote control and proxy tools, including Radmin, UltraVNC, and SoftEther VPN, to weaponize infected hosts as proxy nodes.

An unidentified actor compromised Coder's Cloudflare-managed registry infrastructure to distribute malicious Terraform modules that steal infrastructure credentials and API keys.

DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.