Arnold Chan

The Brazilian threat actor Exilware utilizes the BraZetsu framework and Hestia Control Panel infrastructure to operate an initial access marketplace targeting Latin American organizations.

Financially motivated actors are leveraging ARTEX, an open-source agentic AI pentesting tool, to automate breaches and data exfiltration from South Korean financial institutions.

Russian-speaking threat actor Azazel, an affiliate of the Gentlemen ransomware group, utilizes stolen CI/CD secrets and novel MCP-based C2 channels to target global sectors and host stolen data on an independent leak site, LEAKNED.

Unidentified threat actors hijacked country-code top-level domain registries for Ghana, Sierra Leone, and American Samoa to obtain unauthorized HTTPS certificates and intercept traffic.

The P7 variant of DarkSword targets iOS 18.x devices using chained vulnerabilities to exfiltrate keychain data, cryptocurrency wallets, and Apple Notes via a sophisticated two-way C2 architecture.

The PoeLLM malware campaign targets exposed AI/LLM services like LiteLLM and Ollama for cryptomining and lateral scanning using a novel GitHub-based steganographic C2 mechanism.

Mustang Panda uses a diplomatic-themed OIC invitation LNK to deliver the PlugX RAT through multi-stage PowerShell execution and DLL side-loading.

A coordinated campaign of 16 malicious Firefox extensions masquerades as Rabby and OKX wallets to intercept and exfiltrate recovery phrases and private keys.

The Iranian state-aligned actor CL-STA-1178 is conducting the 'Blinder Tunnel' campaign targeting Iraqi critical infrastructure using trojanized coding challenges and living-off-the-cloud TTPs.

Akira ransomware affiliates utilize RDP for initial access, ProcDump for credential theft, and GOST tunnels for persistence before deploying Rclone for exfiltration and encrypting data.