Intel Exchange

Longlegs (aka Storm-2603), a China-nexus threat actor, is deploying Warlock ransomware against critical infrastructure and government sectors by exploiting SharePoint 'ToolShell' vulnerabilities.

2CLoader is a sophisticated new malware loader identified in August 2026 that uses indirect system calls and environment spoofing to deliver information stealers like Vidar and Remus.

Unattributed threat actors are leveraging legitimate MSP360 RMM and ConnectWise ScreenConnect installers via phishing to establish persistent remote access and deploy post-compromise tools.

China-nexus actors UAT-11587 and UNC6384 are targeting government, diplomatic, and policy organizations across Asia and Europe using the novel Rust-based Antino backdoor and PlugX RAT via complex multi-stage infection chains.

An operator identified as Zaib Ali uses a massive npm typosquatting campaign to discover infrastructure and a custom FastAPI framework called VHX Harvester to hijack GPU resources on the vast.ai marketplace.

Lazarus Group is distributing Graphalgo malware via malicious Terraform providers and Go modules to target infrastructure developers and cryptocurrency assets.

China-nexus threat actors, including Storm-3069, utilize the modular NeedyMantis malware to maintain long-term access in telecommunications, government, and education sectors following initial compromise.

China-linked threat actor Storm-3069 uses NeedyMantis, a modular post-compromise framework, to maintain long-term access via DLL sideloading and custom encrypted archives.

UNC6240 (ShinyHunters) is conducting mass exploitation of CVE-2026-35273 in Oracle PeopleSoft using WAF bypass techniques to deploy SIDEEYE backdoors and MeshCentral agents for extortion.

FomoPeek versions 1.1 and 1.2 utilized kernel exploits and sandbox escapes to steal cryptocurrency private keys and sensitive data from iOS devices.