Intel Exchange

The North Korean WaterPlum group uses fake job interviews and malicious development tools to compromise IT professionals, stealing over $10.7 million in cryptocurrency.

The Gentlemen threat actor group is utilizing the cross-platform TukTuk C2 framework and BYOVD techniques to neutralize EDR solutions while targeting global technology and healthcare sectors.

Purple Ghosts compromised over 14,000 Dahua cameras globally using an authentication-bypass chain and P2P relay exploitation to install persistent backdoors and harvest credentials.

The RevStealer infostealer uses trojanized Electron applications and blockchain-based C2 failover to target credentials, cryptocurrency wallets, and browser data on Windows systems.

The SideCopy APT is targeting Indian academic institutions using weaponized LNK files and mshta.exe to deploy ReverseRAT via fileless .NET deserialization.

Chinese threat actors UTA0560 and JungleBamboo exploited a 'patch-gap' zero-day chain in Chrome and Windows to deploy the GRIMWEDGE backdoor and LONGTALE credential stealer.

The Pakistan-nexus threat actor APT36 (Transparent Tribe) is conducting Operation RapidRust targeting government and defense sectors in India and Afghanistan using new Rust-based backdoors and USB propagation tools.

Transparent Tribe (APT-C-56) utilizes ISO/ZIP-based lure files and LNK execution chains to deploy CrimsonRAT and a custom Golang-based remote access trojan against Indian and South Asian targets.

The Iran-linked threat actor Handala Hack uses the HEAVYGRAM Telegram-based backdoor and CRUDEEXCLUDE utility to target dissidents and journalists for surveillance and data exfiltration.

China-aligned actor FamousSparrow is targeting Latin American governments with SparroWocky, a sophisticated C++ backdoor featuring advanced anti-analysis and modular execution capabilities.