Arnold Chan

The MALFEX operator has conducted a two-year npm supply-chain campaign, deploying Overlord RAT and the movinlike stealer via multi-arm delivery packages, some of which remain active despite partial registry seizures.

DragonForce ransomware group is utilizing legitimate Microsoft Teams TURN servers and MQTT brokers for redundant, stealthy C2 communication.

ShinyHunters has evolved from a credential-theft crew into a resilient extortion brand and SaaS supply-chain threat, most recently exploiting PeopleSoft zero-days and third-party OAuth tokens.

An operator identified as Zaib Ali uses a massive npm typosquatting campaign to discover infrastructure and a custom FastAPI framework called VHX Harvester to hijack GPU resources on the vast.ai marketplace.

An attacker-controlled ScreenConnect client is being distributed via phishing emails as a legitimate, signed executable to gain remote access to victim systems.

China-based threat actors are deploying RatHat, a sophisticated Android Trojan that leverages generative AI for UI automation and ADB self-pairing for persistent shell access.

Storm-3168 (JADEPUFFER) utilizes compromised service principals to automate resource discovery, destruction, and credential theft across Microsoft Azure environments.

The CSuite operation targets US and European organizations using sophisticated phishing lures to steal Microsoft 365 sessions and deploy legitimate RMM tools like ScreenConnect for persistent endpoint access.

China-nexus threat actors, including Storm-3069, utilize the modular NeedyMantis malware to maintain long-term access in telecommunications, government, and education sectors following initial compromise.

UNC6240 (ShinyHunters) is conducting mass exploitation of CVE-2026-35273 in Oracle PeopleSoft using WAF bypass techniques to deploy SIDEEYE backdoors and MeshCentral agents for extortion.