Ethan Andrews

Chinese-speaking threat actor TA4922 is utilizing PackClient, a modular C2 framework sold on Telegram, to target organizations in China and India with tax-themed phishing lures.

Blackpoint APG identified Miraak, a modular post-exploitation framework using PostgreSQL/Timescale for C2 communication and featuring Cobalt Strike BOF compatibility.

Russian state-sponsored actor BlueDelta utilized macro-enabled Word documents to deploy HOOKEDGE, a batch-script backdoor abusing legitimate webhook services for C2 and exfiltration targeting European government entities.

Zhibotong (ZBT) electronics routers and white-labeled variants contain multiple pre-installed surveillance implants enabling unauthenticated root access, DNS hijacking, and credential exfiltration.

Adversaries are using AI-assisted scripts and the snap7.dll library to target Internet-exposed Siemens S7 PLCs for reconnaissance and potential disruption across U.S. critical infrastructure.

Certighost (CVE-2026-54121) is a critical improper authorization vulnerability in AD CS allowing low-privileged users to impersonate Domain Controllers by abusing unverified directory referrals.

ClickFix campaigns are deploying PavinLoader, a multi-stage .NET loader that uses EtherHiding and MSBuild to deliver Amatera Stealer and other payloads.

ToxNetV2 is an AArch64 Linux P2P botnet that integrates NVIDIA NIM LLM services into its controller's decision-making loop to propose operational actions.

The SysScan refund scam uses fraudulent Microsoft-branded security scans to deceive users into uninstalling antivirus software and providing remote access credentials.

An attacker can exfiltrate sensitive local data from Amazon Kiro IDE by using malicious repository content to influence the AI agent into modifying configuration settings and triggering outbound network requests.