Intel Exchange

The China-linked threat actor Silver Fox (UTG-Q-1000) is utilizing SEO poisoning and counterfeit installers to deliver a modular Rust-based RAT called MODBEACON featuring gRPC-encrypted communications.

QuimaRAT is a cross-platform Java-based Remote Access Trojan sold as a service, targeting Windows, Linux, and macOS environments through modular encrypted plugins.

The WP-SHELLSTORM campaign targets WordPress and Joomla installations at scale using automated exploit scanners and webshells for access brokerage.

IRGC-affiliated actors utilize GigaWiper, a modular Golang-based backdoor combining disk wiping, fake ransomware, and surveillance capabilities against Israeli targets.

The threat actor Nightmare Eclipse released the RoguePlanet zero-day exploit (CVE-2026-50656) targeting a race condition in Microsoft Defender to achieve SYSTEM privileges on Windows 10 and 11.

UAT-7810, a China-nexus infrastructure specialist, builds Operational Relay Box (ORB) networks targeting SOHO and enterprise systems using the LEASH malware family for secondary espionage actors.

Silver Fox (UTG-Q-1000) distributors are deploying MODBEACON, a modular Rust-based implant using gRPC over HTTP/2 for C2 communication, targeting technology, education, and state-owned enterprises.

Adversaries use advanced sleep obfuscation techniques like Ekko and FOLIAGE to encrypt implants in-memory between callbacks, evading traditional YARA and memory attribute scanning.

A China-nexus threat actor is targeting Indian taxpayers and government infrastructure using a multi-stage infection chain to deploy DcRAT via fake tax utility lures.

UAT-7810, a China-nexus threat actor, is expanding its LapDogs Operational Relay Box (ORB) network by compromising networking devices using an updated suite of custom Linux and Java-based malware.