Threat Research

: UAT-6275 (also tracked as TAG-193 by Recorded Future) targeted government organizations across CIS countries, with additional interest in water resources and energy sectors. Between June 2025 and August 2026, the group used four infection chains involving macro-enabled documents, PowerShell downloaders, GitHub-hosted scripts, and WinRAR exploitation of CVE-2025-8088....

Threat actors tracked as CL-STA-0954 (UNC5820) compromised a telecommunications managed service provider by exploiting CVE-2024-47575 (FortiJump) on a centralized FortiManager appliance, stealing configurations, credentials, cryptographic material, and network topology data for more than 500 managed FortiGate firewalls....

This campaign uncovered a phishing campaign using fake Calendly booking pages impersonating Meta Careers to lure job seekers into fraudulent interviews and steal their personal information....

This campaign demonstrates how Threat Actors can abuse trusted tools and legitimate Windows components to evade traditional detection. The attack combines LNK execution, Deno-based scripting, DLL side-loading, in-memory execution, and scheduled-task reuse....

Apex Accelerator is a fraudulent Web3 venture capital operation targeting cryptocurrency startups and founders through offers of free AI credits, coding tools, and security audits. The campaign distributes backdoored npm packages and code repositories, delivering CloudSyncD malware for macOS and a custom Windows information stealer that exfiltrates data through Telegram....

The Casbaneiro banking trojan (also known as Metamorfo and Ponteiro) was observed alongside a malicious Chromium extension, with both infrastructures remaining active. Initial access involved a phishing email that tricked victims into installing a remote-access client, enabling attackers to execute PowerShell commands on compromised systems....

: Midnight Mimosa is an Android malware campaign involving a persistent, preinstalled system application that compromises devices before users switch them on for the first time. Operating with system-level privileges, it silently installs disguised apps, performs hidden advertising and click fraud, collects device information, and turns infected phones into residential proxy no...

Researchers identified nine malicious Chrome extensions disguised as harmless utilities, including note-taking apps, stopwatches, and password generators, that impersonate cryptocurrency wallets to steal digital assets....

Researchers identified a new Go-based Windows malware family, named C2Agent, designed to leverage AI for operations on infected systems. The malware uses its command-and-control (C2) server to prompt Large Language Models (LLMs) to perform various tasks. C2Agent functions as a Model Context Protocol (MCP) client and communicates with a legitimate MCP server....

Researchers uncovered UAT-11985, an APT spear-phishing campaign targeting individuals affiliated with Taiwan-based research organizations through AI-assisted event invitations and institutional impersonation....

On October 4, 2026, two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, were disclosed in the AhsayCBS backup utility. From October 7, Team observed attackers exploiting these flaws for remote code execution, targeting five organizations by October 8....

BraZetsu, a Python-based Windows malware framework compiled with Nuitka, is attributed with high confidence to the Brazilian threat actor Exilware and linked to the Infected Marketplace, which sells access to compromised Windows hosts....

Chinese government-linked cyber threat actors, enabled by Integrity Technology Group, combine automated scanning, large-scale botnets, and hands-on exploitation to compromise organizations worldwide, including U.S. critical infrastructure....

Research documents the evolution of MATCHBOIL, a custom C# downloader used by the Russia-aligned UAC-0099 APT group to deliver payloads and establish persistence on compromised systems. Between 2024 and 2026, the malware evolved with advanced .NET obfuscation, sandbox and anti-analysis checks, and modified persistence mechanisms, including scheduled tasks and registry Run keys....

In July 2026, ThreatLabz uncovered a supply-chain attack involving a malicious Terraform provider designed to run attacker-controlled code when initialized. The compromised provider retrieves a Bash loader from a Terraform-themed spoofed domain, which deploys tailored malware based on the victim’s operating system and CPU architecture....