Tim Peck

A Chinese-speaking threat actor uses VoidLink, a modular AI-assisted framework, to deploy hybrid LKM/eBPF rootkits for kernel-level stealth and ICMP-based C2 on Linux systems.

DPRK-linked threat actors are targeting South Korean organizations using LNK files that execute multi-stage PowerShell scripts and abuse GitHub as a command-and-control infrastructure.

North Korean actor Sapphire Sleet compromised the popular Axios npm package to deliver platform-specific RATs via a malicious dependency named plain-crypto-js.

The FAUX#ELEVATE campaign uses heavily obfuscated VBScript lures targeting French corporate environments to deploy a multi-stage toolkit including XMRig miners and browser credential stealers.

The CrystalX RAT is a sophisticated Malware-as-a-Service platform written in Go that combines traditional spyware, credential theft, and unique 'prankware' capabilities to target users globally.

The Russia-aligned actor Pawn Storm (APT28) is deploying the PRISMEX malware suite via zero-day exploits and advanced steganography to target the Ukrainian defense supply chain and NATO logistics hubs.

The Kimsuky threat group is distributing complex Python-based backdoors and downloaders via multi-stage LNK files using scheduled tasks for persistence.

Attackers can chain an authentication bypass (CVE-2026-2699) with a file upload vulnerability (CVE-2026-2701) to achieve remote code execution on Progress ShareFile Storage Zone Controllers.

Atomic Stealer (AMOS) leverages a new macOS persistence mechanism, anti-VM evasion, and trojanized hardware wallet applications to exfiltrate sensitive data and crypto credentials.

A Russian-origin .NET remote access toolkit named CTRL uses weaponized LNK files to deploy modular payloads for credential theft, RDP session hijacking, and FRP-based reverse tunneling.