Tim Peck

Kimsuky (APT43) is utilizing updated PebbleDash and AppleSeed malware variants, alongside legitimate tools like VSCode and DWAgent, to target South Korean defense and government entities.

Likely state-sponsored actor CL-STA-1132 is exploiting a zero-day buffer overflow (CVE-2026-0300) in PAN-OS Captive Portal to achieve root-level remote code execution.

Gamaredon (UAC-0010) is utilizing spearphishing emails and the CVE-2025-8088 WinRAR vulnerability to deploy GammaDrop and GammaLoad malware against Ukrainian state institutions.

The KongTuke threat actor is impersonating help-desk staff via external Microsoft Teams chats to deploy the multi-path ModeloRAT toolkit for persistent access.

Seedworm (MuddyWater) conducted a global espionage campaign in early 2026 using Node.js loaders and DLL sideloading to target manufacturing, government, and financial sectors.

LAPSUS$ and TeamPCP targeted Checkmarx developer artifacts and GitHub repositories to exfiltrate credentials and distribute malicious plugins via the Jenkins Marketplace and OpenVSX registry.

The ClickFix campaign has evolved to deploy PySoxy, an open-source Python SOCKS5 proxy, for redundant encrypted C2 access and persistence following initial social engineering.

UNC5142 utilizes EtherRAT and the AI-generated TukTuk framework to conduct data exfiltration and deploy The Gentlemen ransomware via decentralized and SaaS infrastructure.

The threat actor Mr_Rot13 is exploiting a critical cPanel authentication bypass (CVE-2026-41940) to deploy Go-based infectors and the 'filemanager' remote access trojan.

APT37 utilizes obfuscated LNK files and multi-stage batch scripts to deploy a Python-based remote access backdoor disguised as a .cat file.