Intel Exchange

The MemGhost framework automates stealth memory injection into persistent AI agents like OpenClaw, enabling long-term compromise via a single adversarial email.

A sophisticated VBScript-based Java malware loader delivers Quima RAT by leveraging native Windows utilities for payload extraction and automated JRE installation.

CrashStealer is a native C++ macOS information stealer that impersonates Apple crash-reporting tools and uses notarized droppers to harvest credentials, keychain data, and crypto wallets.

A logistics-themed spear-phishing campaign deploys CrySome RAT via a multi-stage chain involving UAC bypass, AMSI patching, and the WinDefCtl utility to disable endpoint defenses.

QuimaRAT is a cross-platform Java-based Remote Access Trojan sold as a service, targeting Windows, Linux, and macOS environments through modular encrypted plugins.

UAT-7810, a China-nexus infrastructure specialist, builds Operational Relay Box (ORB) networks targeting SOHO and enterprise systems using the LEASH malware family for secondary espionage actors.

UAT-7810, a China-nexus threat actor, is expanding its LapDogs Operational Relay Box (ORB) network by compromising networking devices using an updated suite of custom Linux and Java-based malware.

Threat actors are using vishing and Microsoft Teams screen-sharing to impersonate corporate IT support and deploy the blockchain-anchored EtherRAT malware.

China-nexus actor UAT-7810 is expanding its LapDogs Operational Relay Box network using new malware families like LONGLEASH and DOGLEASH to target networking and IoT devices.

China-nexus threat actors are exploiting public-facing phpMyAdmin panels via log poisoning to deploy Nezha monitoring agents and Ghost RAT malware.