Intel Exchange

Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.

Chinese threat actors UTA0560 and JungleBamboo exploited a 'patch-gap' zero-day chain in Chrome and Windows to deploy the GRIMWEDGE backdoor and LONGTALE credential stealer.

The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.

An unsigned GlobalProtect-themed MSI deploys a backdoor that utilizes Cloudflare Workers for configuration and Google Sheets for C2 communication, specifically targeting victims in Myanmar.

Gamaredon, a Russian FSB-operated group, uses a multi-stage modular framework (GammaPhish, GammaLoad, GammaWorm, GammaSteel) to maintain persistent access and exfiltrate sensitive documents from Ukrainian government and critical infrastructure.

The suspected APT29 group (Cloaked Ursa) launched the Spring Ring campaign targeting over 150 employees with Microsoft Teams-based voice phishing to deploy RMM tools and custom PowerShell RATs.

SynkLoader is a modular Windows malware family distributed via Microsoft Teams phishing that uses a bundled Python environment and in-memory components to facilitate credential theft, tunneling, and remote access.

ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.

The Iranian threat actor Phosphorus is using a novel PowerShell backdoor dubbed PowerLess that evades detection by executing within a .NET context rather than a standalone process.

Sapphire Sleet (DPRK) compromised popular Rust crates including arrayref and append-only-vec by injecting a malicious typosquatted dependency, proc-macro1, to execute a second-stage backdoor at build time.