XWorm

Multiple active threats were reported, including ransomware groups Qilin and Settra exploiting a PAN-OS authentication bypass vulnerability (CVE-2026-0257). A cryptocurrency wallet drainer kit called Noir uses DNS TXT records hosted on Cloudflare Pages to locate backend infrastructure. A new Rust-based remote access trojan, CikaBika Bot, leverages Discord for C2 communications. The KGB RAT malware, advertised on cybercrime forums, combines data theft with psychological harassment features. Adobe Experience Manager cloud instances are vulnerable to an unauthenticated RCE chain. Samsung patched a critical unauthenticated RCE in its QA-Board tool, while NVIDIA's Linux GPU driver has a privilege escalation and container escape flaw.

Aeternum is a recently discovered C++ botnet loader that uses the Polygon blockchain for decentralized command-and-control (C2) operations. The malware retrieves encrypted or plaintext instructions from smart contracts on the blockchain by querying public RPC endpoints, enabling resilient and low-cost infrastructure resistant to takedowns. Three distinct malware samples were analyzed: the initial Aeternum loader, a Python-based downloader, and a multi-component payload combining XWorm RAT, XMRig cryptocurrency miner, and data exfiltration tools. The threat leverages Telegram APIs and GitHub repositories for secondary C2 and payload delivery, while using weak encryption schemes that allow decryption via contract address and payload analysis.

Breeze Comet, a financially motivated threat actor active since 2023 and previously tracked as UNC5669, has targeted Brazilian financial, retail, and e-commerce organizations to conduct fraudulent transactions via payment systems like Pix, STR, and Boleto. The group gains initial access through password spraying, social engineering via WhatsApp, and exploitation of vulnerable JBoss AS servers to deploy web shells. They use a suite of custom backdoors such as LIGHTPAINT, MILDFROST, KICKPLATE, and BOATBEAM, along with tools like COBALTSPIN for lateral movement and SOCKS5 tunneling, to maintain persistence and execute hundreds of fraudulent transactions. The actor leverages compromised government websites for C2 infrastructure, disables Windows Defender via PowerShell, and uses LLMs to accelerate malware development, indicating a shift toward more sophisticated, infrastructure-level financial attacks.

Cruciferra, a sophisticated crypter service linked to a China-based cybercrime group, is being used to deliver remote access trojans (RATs) and information stealers via phishing campaigns. It leverages advanced evasion techniques such as BYOVD, Process Ghosting, and API unhooking to avoid detection and hinder analysis. The threat targets multiple sectors including finance, healthcare, and government, primarily through tax-themed and social engineering lures. The malware establishes persistence via registry modifications and executes payloads in memory to minimize forensic traces.