Threat Research

The XCPE backdoor infected more than 1.3 million Android set-top boxes worldwide. The investigation linked the operation to Videostrong Technology, which allegedly used compromised devices to distribute malware, conduct ad fraud, steal data, and provide residential proxy services for criminal affiliates....

BITTER is a suspected South Asian cyberespionage group active since at least 2013, known for targeting government, energy, and engineering organizations. Labs recently identified a campaign targeting South Asian entities using malicious PowerShell scripts and a custom remote access trojan (RAT) named PapRAT....

Researchers identified CyberStrikeAI, an open-source LLM-orchestrated Command-and-Control (C2) framework, being abused in attacks against educational organizations across Africa and Latin America....

Researchers identified BlackApex, DarkApex, SPY, and XXX101, a family of AI-assisted, vibe-coded Phishing-as-a-Service (PhaaS) kits with more than 70 observed instances targeting Microsoft 365 accounts....

: The team has recently identified multiple incidents in which threat actors abused mobile device management (MDM) applications to conduct malicious activities. Rather than exploiting software vulnerabilities, attackers misused legitimate MDM tools to gain access to managed devices....

INJ3CTOR3 has upgraded its FreePBX toll-fraud campaign by adding credential theft to its existing JOMANGY webshell. The malware now steals sensitive SIP trunk, AMI, database, and mail-relay credentials and sends them to attacker-controlled servers every minute. This allows attackers to continue making unauthorized calls even after the infected PBX is cleaned or rebuilt....

Noodle RAT is a modular remote access trojan targeting both Windows and Linux systems. Active since at least 2016, it has been used by Chinese-speaking threat actors for espionage and cybercrime campaigns across the Asia-Pacific region, including India, Thailand, Japan, Malaysia, and Taiwan....

Researchers uncovered GOLD OGRE, a cybercriminal group operating Aur0ra ransomware, using agentic AI tools such as Cursor and models from Anthropic, xAI, and Moonshot to automate post-exploitation activities....

Throughout 2026, the financially motivated North Korean threat group TraderTraitor (also tracked as UNC4899, PUKCHONG, and Jade Sleet) conducted campaigns targeting cryptocurrency-related organizations. In April, the group was linked to a major attack involving KelpDAO, resulting in the theft of approximately $292 million....

Researchers uncovered MR ROBOT, an Android Banking Trojan-as-a-Service operation targeting Indian bank customers through fake banking, Aadhaar/KYC update, utility-billing, and government-service applications....

A rental Android spyware kit named uCreator hijacks Telegram and WeChat accounts by embedding malicious code into modified versions of the legitimate apps. It targets users who install tampered apps distributed outside official app stores or run WeChat inside the operators’ container application....

The financially motivated threat cluster CyberDakait has been targeting India’s financial services sector since July 2025 using seven Android malware families distributed through smishing and vishing campaigns impersonating bank representatives....

Threat actors are actively exploiting CVE-2026-102785, an unauthenticated remote code execution vulnerability affecting YOOtheme Pro versions 5.0.0–5.0.52 used with WordPress and Joomla. Attackers use automated scanning to deploy JPEG/PHP polyglot webshells in the WordPress uploads directory, enabling remote command execution and file uploads....

The Threat Response Team investigated a suspicious alert involving an unexpectedly executed PDF, uncovering a multistage campaign delivering a previously undocumented Sirius Backdoor variant. The attack began with a phishing email containing a ZIP archive with a PDF that used malicious /OpenAction and /Launch objects to trigger a Base64-encoded PowerShell command....

Researchers analyzed SkyW4lker, also known as SkyW4lker x365 Sentinel, a phishing kit targeting Microsoft 365 accounts through OAuth device-code phishing. The campaign uses password-protected email attachments, CAPTCHA gates, decoy pages, and obfuscated JavaScript to trick victims into authenticating through legitimate Microsoft pages....