Intel Exchange

Kimsuky leverages AI agents like opencode and HeadlessChrome to mass-produce decoy documents while evolving its GitHub-based LNK execution framework with enhanced evasion and persistence.

Suspected Silver Fox (Yinhu) threat actors are targeting Chinese-speaking users and multinational operations in China using high-fidelity spoofed vendor sites to deliver persistent implants like ValleyRAT.

A suspected Chinese-speaking threat actor is targeting systems in South Korea to install remote control and proxy tools, including Radmin, UltraVNC, and SoftEther VPN, to weaponize infected hosts as proxy nodes.

DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.

APT28 and MuddyWater utilize ClickFix variants to compromise organizations via social engineering, deploying multi-stage payloads including steganography and Python-based reverse tunnels for internal network pivoting.

China-nexus actor Fire Ant is compromising Cisco Nexus switches and IOS XR routers to harvest credentials and establish covert tunnels into critical infrastructure.

Mirage Kitten targets aviation and FinTech sectors in the Middle East and Africa using cross-platform Node.js and JavaScript RATs delivered via trojanized coding challenges.

SynkLoader is a modular Windows malware family distributed via Microsoft Teams phishing that uses a bundled Python environment and in-memory components to facilitate credential theft, tunneling, and remote access.

The gaiadeqi.com campaign utilizes highly obfuscated JavaScript droppers to deliver credential-stealing trojans disguised as VLC Media Player installers.

ClickLock is a macOS information stealer and backdoor that uses social engineering and process-killing loops to coerce users into surrendering administrative credentials.