Threat Research

Noodle RAT is a modular remote access trojan targeting both Windows and Linux systems. Active since at least 2016, it has been used by Chinese-speaking threat actors for espionage and cybercrime campaigns across the Asia-Pacific region, including India, Thailand, Japan, Malaysia, and Taiwan....

Researchers uncovered GOLD OGRE, a cybercriminal group operating Aur0ra ransomware, using agentic AI tools such as Cursor and models from Anthropic, xAI, and Moonshot to automate post-exploitation activities....

Throughout 2026, the financially motivated North Korean threat group TraderTraitor (also tracked as UNC4899, PUKCHONG, and Jade Sleet) conducted campaigns targeting cryptocurrency-related organizations. In April, the group was linked to a major attack involving KelpDAO, resulting in the theft of approximately $292 million....

Researchers uncovered MR ROBOT, an Android Banking Trojan-as-a-Service operation targeting Indian bank customers through fake banking, Aadhaar/KYC update, utility-billing, and government-service applications....

A rental Android spyware kit named uCreator hijacks Telegram and WeChat accounts by embedding malicious code into modified versions of the legitimate apps. It targets users who install tampered apps distributed outside official app stores or run WeChat inside the operators’ container application....

The financially motivated threat cluster CyberDakait has been targeting India’s financial services sector since July 2025 using seven Android malware families distributed through smishing and vishing campaigns impersonating bank representatives....

Threat actors are actively exploiting CVE-2026-102785, an unauthenticated remote code execution vulnerability affecting YOOtheme Pro versions 5.0.0–5.0.52 used with WordPress and Joomla. Attackers use automated scanning to deploy JPEG/PHP polyglot webshells in the WordPress uploads directory, enabling remote command execution and file uploads....

The Threat Response Team investigated a suspicious alert involving an unexpectedly executed PDF, uncovering a multistage campaign delivering a previously undocumented Sirius Backdoor variant. The attack began with a phishing email containing a ZIP archive with a PDF that used malicious /OpenAction and /Launch objects to trigger a Base64-encoded PowerShell command....

Researchers analyzed SkyW4lker, also known as SkyW4lker x365 Sentinel, a phishing kit targeting Microsoft 365 accounts through OAuth device-code phishing. The campaign uses password-protected email attachments, CAPTCHA gates, decoy pages, and obfuscated JavaScript to trick victims into authenticating through legitimate Microsoft pages....

Researchers identified Hidden Hawk, an operation abusing domain shadowing to promote illegal Indonesian gambling brands through compromised school and government subdomains across Bangladesh, India, and Mexico....

In April 2025, eMudhra issued eight intermediate CA certificates, including six for TLS and two for code signing, with dangerously weak P-384 private keys. The private keys used extremely small values, some below 256, with one set to just 4, making them recoverable from public certificates in less than a second....

A suspected North Korean (DPRK)-linked campaign is progressing from reconnaissance to targeted scanning of global PHP infrastructure, exploiting CVE-2026-109618 and CVE-2026-109619, critical unauthenticated remote code execution vulnerabilities in PHP core....

Hirudo is an Android banking remote access trojan (RAT) that steals banking credentials and allows attackers to control infected devices remotely. It spreads through shopping and entertainment apps that trick users into installing the malware through fake update prompts....

The threat actor BUGSTER used jailbroken AI tools, including the Hermes Agent framework powered by DeepSeek V4, to plan and execute multiple cybercrime activities, including credential theft, data exfiltration, VoIP fraud, Wi-Fi password cracking, cryptocurrency reconnaissance, and command-and-control operations....

Researcher uncovered a global AI-assisted hacking campaign combining a customized ARTEX penetration-testing framework, AI coding assistants, and automation scripts to target organizations across multiple countries and industry sectors....