Intelligence Feed

1w ago · securelist

In Q2 2026, mobile threats continued to evolve with a notable presence of banking Trojans, particularly variants of Mamont and Creduz. Attackers increasingly used malicious loaders distributed through Google Play, including trojanized apps like a PDF reader and the Cleanova app, to deliver banking malware such as Anatsa. These loaders employed sophisticated evasion techniques, including conditional payload delivery based on installation source telemetry, to bypass app store reviews and target specific users.

5d ago · securelist

The HoneyMyte APT group, also known as Mustang Panda, has upgraded its CoolClient backdoor with a kernel-mode Windows rootkit to enhance stealth and persistence. The new variant uses a signed kernel driver, msagent.sys, deployed as a Windows service to hide malicious processes, files, registry keys, and network connections. The malware chain begins with DLL sideloading via a renamed Sangfor executable (defender.exe), establishes persistence through scheduled tasks and registry entries, performs UAC bypass using RPC techniques, and injects into synchost.exe before deploying the driver. The driver communicates with user-mode components via IOCTLs and employs minifilter and registry callbacks to protect its artifacts.

6d ago · securelist

In May 2026, the Armored Likho (aka Eagle Werewolf) threat actor group expanded its cyber-espionage operations targeting individuals and organizations in Russia through a fake donation app dropper written in Rust using the Tauri framework. The campaign delivers a new Rust-based toolkit called Still Toolkit, consisting of two components: Still Sync, which steals Telegram session data and exfiltrates chat logs and media via the Telegram API, and Still Audio, an audio surveillance implant that records microphone input when voice activity is detected. The malware uses gRPC and FlatBuffers for C2 communication, leverages the SeBackupPrivilege for file access, and employs a Dead Drop Resolver via a GitHub repository to retrieve updated C2 addresses.

1w ago · securelist

In July 2026, the APT group Head Mare exploited two previously unknown vulnerabilities in unpatched TrueConf servers (versions 5.3.x through 5.5.5) to gain SYSTEM-level access and deploy web shells. The attackers replaced legitimate TrueConf client installers with malicious versions containing the PhantomCore backdoor, which was used to compromise video conference participants. A second backdoor, PhantomGraph, composed of SysExcSvc.dll and SysReadSvc.dll, was also deployed to establish persistence and execute commands via Base64-encoded PowerShell scripts. The group targeted Russian organizations across multiple sectors, using compromised servers and phishing to distribute malware. Kaspersky has detected the activity and provided indicators and detection rules.

1w ago · securelist

Project CAV3RN is a modular espionage framework targeting entities in Israel, continuing to evolve with sophisticated command-and-control (C2) capabilities. The framework uses a multi-transport C2 module that leverages DNS A-record responses to dynamically select between direct HTTPS connections and Google Apps Script relays for C2 communications. It employs DNS-based channel selection and can rotate Google Apps Script deployment IDs via DNS queries, enhancing resilience and evasion. The infrastructure includes a local DLL broker for component orchestration and runtime upgrades, indicating a high level of operational maturity.

1w ago · securelist

In Q2 2026, multiple ransomware groups remained active, with Qilin emerging as the most prolific based on victims listed on data leak sites. Microsoft disrupted a malware-signing-as-a-service operation run by the threat actor Fox Tempest, which was used by several ransomware groups including Rhysida, Akira, and Qilin. CISA added a Windows local privilege escalation vulnerability (CVE-2026-33825, BlueHammer) to its KEV catalog due to active exploitation in ransomware attacks. Check Point attributed zero-day exploitation of a critical vulnerability in its Remote Access VPN (CVE-2026-50751) to the Qilin ransomware group. Additionally, the PayoutsKing group was observed using QEMU to deploy hidden Alpine Linux-based virtual machines as a stealthy backdoor technique.

2w ago · securelist

Threat actors are leveraging legitimate cloud platforms such as Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS to host phishing infrastructure and bypass multi-factor authentication (MFA). The attack uses a multi-stage adversary-in-the-middle (AitM) technique involving contact harvesting, transparent proxy initialization via service workers, and browser-in-the-browser (BitB) spoofing to intercept credentials and session tokens. Phishing pages are hosted on trusted domains with good reputations, making detection difficult and enabling large-scale, low-cost deployment of malicious sites.

2w ago · securelist

SecureList analyzed cyber incidents at Brazilian educational institutions from 2025 to 2026, identifying ransomware attacks and insider threats. Two major ransomware families observed were LockBit 3 and DragonForce, with attackers using leaked LockBit builders and valid credentials for initial access. In one case, LockBit was deployed via PsExec after disabling defenses using a batch script; in another, DragonForce was delivered via AnyDesk. An insider used a custom Python keylogger to capture credentials on shared machines, storing logs in hidden files later retrieved via USB.

2w ago · securelist

The article discusses the challenges of detecting advanced network attacks like Kerberoasting and DNS tunneling using traditional signature-based tools, and promotes Kaspersky's Network Anomaly Detection (NAD) technology in the KATA platform as a more effective alternative. It explains how NAD rules can identify anomalous behavior by analyzing deviations from baseline network activity. However, no specific threat incident, malware, vulnerability, or concrete IoCs are reported.

1mo ago · securelist

OkoBot is a sophisticated malware framework targeting cryptocurrency users, active since January 2026. It uses a multi-stage infection chain initiated by the malicious PowerShell script TookPS, delivered via fake software repositories or phishing. The framework deploys over 20 malicious payloads through an SSH tunnel, enabling UAC bypass, browser extension injection, keylogging, screen recording, and seed phrase theft from Ledger and Trezor wallets. The campaign remains active and has infected hundreds of victims across more than 25 countries, with evidence suggesting Russian-speaking threat actor involvement.

2w ago · securelist

Kaspersky researchers identified a cyber-espionage campaign targeting government and public sector organizations in Central Asia since January 2025, using two custom backdoors: OctLurk and SilkLurk. Both backdoors are heavily obfuscated, deployed via customized loaders that use victim-specific data for decryption, and support plugin-based post-compromise activities including credential theft, keylogging, remote access, and data exfiltration. The same threat actor, assessed as Chinese-speaking, operates both backdoors and has deployed secondary payloads such as PlugX and Impacket's secretsdump. Infrastructure overlap with the TrustFall (MystRodX/SilentRaid) campaign suggests coordinated multi-platform operations.

4w ago · securelist

The GoSerpent campaign is a sophisticated and evolving threat targeting government and diplomatic entities in Southeast Asia since at least 2021, with ongoing activity observed through 2026. The primary malware, GoSerpent, is a Go-based backdoor that enables remote access, SOCKS5 proxying, and deployment of additional tools for data collection and credential dumping. In 2026, attackers expanded their toolkit with Stowaway, a new Go-based RAT, and TmcLoader/TmcPayload, a stealthy two-stage payload used for exfiltrating data collected by earlier stages. The attack chain demonstrates high operational integration, using credential dumping tools like Mimikatz and QuarksDumpLocalHash to enable lateral movement and exfiltration of archived sensitive files via network shares.

4w ago · securelist

The HelloNet campaign is an active APT attack that began in May 2026, leveraging the ViPNet update system to deploy malicious components on targeted Russian organizations in government, energy, transport, education, and logistics sectors. Attackers achieve persistence via DLL sideloading by placing a malicious wtsapi32.dll in the ViPNet Update System directory, which is loaded by the legitimate itcsrvup64.exe process. The malware includes multiple components: HelloInjector (a loader), HelloProxy (a proxy and payload launcher), and HelloBackdoor (a Rust-based backdoor). The attackers use SSH tunnels via renamed PuTTY binaries and conduct reconnaissance using standard Windows commands. Attribution to a Chinese-speaking APT group is considered low-confidence due to potential false flags.

4w ago · securelist

Project CAV3RN is a modular cyberespionage framework targeting entities in Israel, with activity observed since December 2025. A newly identified .NET Native AOT communication module, AzureCommunication.dll, replaces previous HTTP/WebSocket-based C2 by using Microsoft Graph to exchange commands and results via Outlook calendar events. If authentication fails, the module recovers configuration data through DNS AAAA record queries to actor-controlled nameservers. The framework demonstrates advanced resilience and operational continuity through fallback mechanisms and use of legitimate cloud services.

4w ago · securelist

Two ransomware incidents in Colombia and Mexico involved attackers exploiting misconfigured RDP and MSSQL services to deploy BitLocker for data encryption and extortion. In the first case, attackers accessed an internet-facing RDP service, encrypted a critical 8TB drive, and printed ransom notes via corporate printers, demanding $3,000. In the second case, the 'XEntry Team' exploited a misconfigured MSSQL server with xp_cmdshell enabled, gained OS-level command execution, deployed RMM tools (including Mesh Agent and Tactical RMM), and used Group Policy Objects to mass-deploy BitLocker encryption across domain-joined systems. Victims were notified via blue screen messages and printed ransom notes. Both attacks leveraged built-in Windows tools to avoid reliance on traditional ransomware, indicating a shift toward low-cost, high-impact extortion using native encryption and remote management utilities.

3w ago · securelist

Mirage Kitten, an APT group also known as UNC1549, is conducting cyber-espionage operations targeting aerospace, defense, telecommunications, and government sectors in the Middle East and Africa. The group uses spear-phishing and fake recruitment portals to deploy new malware tools, including NightLedger, a Windows backdoor that performs reconnaissance, command execution, and data exfiltration, and two WebSocket-based tunneling tools, BridgeHead and ArcBridge, which enable covert C2 communications and SOCKS5 tunneling through compromised hosts. The infrastructure includes domains hosted on Azure and Cloudflare, with targeting logic based on username checks to avoid execution in unintended environments.

2w ago · securelist

The GenieLocker ransomware, attributed to the financially motivated threat actor Toy Ghouls (also known as Bearlyfy, Labubu, Laboo.boo), has been active since March 2026 and targets organizations primarily in the Russian Federation, especially in the manufacturing sector. The ransomware is a custom-built encryption Trojan with variants for Windows, Linux, and ESXi, reducing the group's reliance on third-party ransomware. It uses stolen credentials via an OpenVPN connection for initial access, conducts discovery and credential dumping using tools like Mimikatz, moves laterally via RDP and SSH, and deploys the ransomware using PsExec and PAExec. The malware encrypts files using XChaCha20-Poly1305 and stores encrypted keys protected with Curve25519-XSalsa20-Poly1305, with no evidence of data exfiltration, indicating a single-extortion model.