Kaung Khant Ko

CopperDragon acts as a digital quartermaster for China-nexus actors, deploying the Sparrow framework via watering-hole attacks and internet-facing exploits against telecom and government sectors.

China-state aligned actor Storm-0940 utilized the ARTEX agentic AI framework to automate a large-scale supply chain compromise targeting ConnectWise applications and downstream cloud environments.

CopperDragon acts as a digital quartermaster for China-nexus actors, deploying the Sparrow framework via watering-hole attacks and internet-facing exploits against telecom and government sectors.

VOLTA is a mature Windows infostealer that leverages LLMs to automate victim profiling and prioritize assets for monetization.

Mustang Panda is targeting Southeast Asian diplomatic entities using new in-memory ZOHOMURK SOCKS5 tunnelers and MINIRECON automated reconnaissance tools deployed via DLL side-loading.

Adversaries such as TeamPCP exploit Python package installation mechanisms including setup.py hooks, .pth files, and entry points to compromise developer environments and CI/CD pipelines.

Adversary Pursuit Group identified ChainScript, a Node.js RAT that utilizes Polygon smart contracts for resilient C2 infrastructure rotation and delivery via ClickFix lures.

A malicious LNK file disguised as an OIC invitation uses PowerShell to download an archive that installs PlugX via DLL side-loading through a Jarte-derived application.

AsyncRAT is delivered through a complex five-stage infection chain involving obfuscated PowerShell, a signed AutoIT interpreter, and memory-only .NET loaders to evade detection.

An unsigned GlobalProtect-themed MSI deploys a backdoor that utilizes Cloudflare Workers for configuration and Google Sheets for C2 communication, specifically targeting victims in Myanmar.