kyber.today

daily cyber × ai intelligence

← attack phases

phase 12 of 14

Command and control

Communicating with and steering compromised systems.

112 stories

October 17, 2026

  • YuanKong RAT is a multi-tenant Android remote-control service that stamps operator identities into every APK build, shares one signing certificate across variants, and runs TLS WebSocket C2 with no message-level encryption — screen streaming, credential theft and ADB-based privilege escalation included (STAR Labs). · Threat Intelligence · also collection

October 15, 2026

  • Anthropic says attackers prompt-injected an evaluation sandbox, stole customer API keys and used victims’ compute to target more than 30 AI labs. Separately, one binary-reversing and exploit-development workflow generated more than a dozen possible appliance zero-days in a single month. The report covers disrupted operations observed from December 2025 through August 2026. Anthropic (discussion) · AI & Model Security · also credential access, exfiltration

October 13, 2026

  • C2Agent is described by Unit 42 as LLM-operated Windows malware with MCP support and a "skills" system that abuses the victim's own AI coding tools for post-exploitation — "living off the AI". Its payload URL, agent.x90[.]dev/data/copilot.txt, was still live at the time of posting (@Unit42_Intel). · AI-Enabled Attacks · also execution
  • BlackMagick C2 added DNS and an experimental ICMP transport with hot-swapping of comms profiles (@ipurple). · New Tools & Releases
  • Blinder Tunnel has a new, invisible variant. Nextron went hunting after Unit 42's reporting and found RuntimeBroker.dll sitting at 0 of 71 VirusTotal detections six weeks after its 25 August submission from the Iraq region, with infrastructure not in prior write-ups: a Cloudflare Workers relay, a new PeakyBlindersTeam GitHub account, and per-victim-encrypted credential-rotation instructions hidden in HTML comments on Microsoft/vscode issues. Delivery was an Inno Setup installer themed as a Dubai Airport careers IT assessment (Nextron). Unit 42 separately reported the Iran-aligned actor hitting Middle East aviation and telecom with weaponised .csproj files and GitHub C2 (@Unit42_Intel; earlier coverage). · Threat Intelligence · also initial access, persistence

October 12, 2026

  • North Korea-linked Kimsuky has expanded Operation GitPower into Ukraine. Genians Security Center observed reply-driven conference and collaboration lures targeting experts in diplomacy, security, and international policy. The chain uses malicious LNK files, PowerShell, and GitHub/GitLab for delivery, C2, and exfiltration; repositories matched earlier GitPower infrastructure. Most observed attempts were unsuccessful. The broader campaign also uses the opencode AI agent and a local LLM to produce decoy material. · Threat Activity · also initial access, execution, exfiltration
  • P7 DarkSword adds wallet theft and full two-way C2 to the leaked iOS exploit kit. iVerify says the variant reduces logging and process injection, prevents repeated exploitation through browser-state checks, extracts keychain data locally, targets cryptocurrency wallets, and polls for remote commands. The underlying DarkSword chain has been used against iOS 18.4–18.7. Separate attempts to port it to iOS 26.x appeared likely LLM-assisted but were largely non-functional. · Threat Activity · also execution, credential access

October 11, 2026

  • UAC-0099 has a previously undocumented .NET RAT. TrendAI attributes ASHVEIN (internally "TelemetryBrowser") to the Russia-aligned group it tracks as Earth Sirrush, used against Ukrainian government personnel. It steals Chrome and Firefox credentials, captures GDI screenshots, runs PowerShell remote shells, and hides tasking inside invisible HTML elements; some variants use a GitHub dead drop resolver as C2 fallback, with delivery via DLL sideloading, VHD containers and .NET droppers. ESET has previously described the group as an initial-access broker for Sandworm. The Hacker News · Threat Activity · also execution, collection

October 9, 2026

  • Mobile malware, two angles: low-cost Android handsets are shipping with firmware-embedded Midnight Mimosa, which silently installs apps, commits ad fraud and enrols devices as residential proxies (BleepingComputer); and Novinarya targets 81 financial apps via package enumeration, WebView phishing, regex-driven SMS and notification interception, resolving live C2 from encrypted dead-drop URLs planted in a Basalam shop profile (STAR Labs). · Threat Activity · also execution, persistence

October 8, 2026

  • PoeLLM hides its C2 address in a poem on GitHub. Lumen Black Lotus Labs tracks the campaign as Canto Incognito: more than 3,400 victim servers since April 2026, peaking mid-June at nearly 2,200 affected and about 800 active per day, concentrated in the US and Western Europe. Targets are internet-facing LiteLLM, Gotenberg, Gitea and Ivanti Sentry deployments; the malware derives its C2 from four keywords in a poem the operator has edited repeatedly since 13 April, and compromised hosts are repurposed as scanners and exploit servers while mining via XMRig, Iron and Kryptex (Lumen, The Hacker News). · Threat Activity · also initial access, persistence, impact
  • Threat actors are moving C2 onto smart contracts. Unit 42 traces a progression from hardcoded endpoints to Web3 contract lookups, letting an operator repoint an entire botnet or worm network with a single transaction, used in cloud supply-chain compromises (Unit 42). · Threat Activity
  • UAC-0099 / Earth Sirrush embeds ZIP payloads inside PNG images, extracted via predefined markers, with spear-phishing for access, scheduled-task persistence, C2 tasking hidden in invisible HTML footer elements, sandbox checks and hybrid AES-RSA C2 encryption (technical brief). · Threat Activity · also execution, persistence, defense evasion

October 6, 2026

  • Belarusian Cyber Partisans allegedly remained inside a Russian healthcare network for nearly two years. Rostelecom subsidiary Solar traced the earliest activity to early 2024 and discovered the intrusion in December 2025. It says the group accessed medical data but avoided disruption, likely preserving the foothold for espionage or trusted-relationship pivots. The Vasilek Windows backdoor used Telegram for C2 and supported commands, file transfers, screenshots and keylogging. The Record · Threat Activity & Espionage · also persistence, collection

October 3, 2026

  • AI file — a Mythic C2 profile that moves implant messages as .jsonl files through the OpenAI Files API (purpose=batch) instead of an HTTP/S listener. The listener polls /v1/files, decrypts each envelope, forwards raw Mythic bytes to /agent_message, and uploads an encrypted response file; AES-256-CBC + HMAC-SHA256 envelopes with a shared transport key (GitHub). · New Tools & Releases
  • DragonForce backdoors hide C2 inside relay protocols. Lab52 details two implants from a recent intrusion: an in-memory Go implant (Shell.dll) that abuses legitimate Microsoft Teams TURN servers so traffic resembles ordinary WebRTC relay sessions, carrying SSH over that path; and a persistent second stage launched from a scheduled task via DLL sideloading of legitimate javaw.exe → jli.dll → a DPAPI-encrypted rvsdiqw.txt payload, with MQTT as fallback C2 when TURN fails (Lab52). · Threat Activity & Malware · also persistence
  • Antino backdoor uses Outlook and OneDrive as C2 channels in a China-nexus espionage campaign (The Hacker News). · Threat Activity & Malware

October 1, 2026

  • NetScaler exploitation now has implant-level detail. Arctic Wolf published observed post-exploitation for CVE-2026-88771: curl/wget retrieval of Python, Perl and shell payloads, Base64 command output exfiltrated over HTTP, Bash/Netcat reverse shells, and a 3,752-byte Perl implant nsmon.pl that hides under /var/tmp/.nsmon, adds a root cron entry every five minutes via /etc/crontab or /nsconfig/crontab, and listens on a port between 41000–41999 (Arctic Wolf pack alert with IOCs). @Unit42_Intel updated its threat brief with pre-disclosure activity and hunting queries (earlier coverage). (discussion) · Exploited in the Wild · also persistence

September 30, 2026

  • Phishing campaigns abuse MSP360 RMM to deploy ScreenConnect, deliberately stacking two remote-access channels so losing one doesn't cost the operator access — a detection problem, since both are signed, legitimate tools (Microsoft). · Threat Activity · also persistence
  • XCTDH (DPRK-attributed) has moved its C2 addressing onto Ethereum, steganographically encoding destination addresses in transaction fields — resilient against takedown and hard to block without breaking legitimate chain traffic (Ransom-ISAC). · Threat Activity

September 29, 2026

  • NeedyMantis, a modular implant used for long-term access since at least October 2025, hit telecoms, universities, medical nonprofits, intergovernmental organisations and government contractors. Delivery is DLL sideloading via legitimate binaries (Poedit, curl, Vim, TightVNC), with an encrypted archive staging the next stage; C2 starts over HTTPS then upgrades to WebSocket for module loading. Microsoft found it while following Kaspersky's DAEMON Tools supply-chain investigation and ties one user to Storm-3069; hashes, domains, paths and hunting queries are published (The Hacker News). · Threat Activity · also initial access, persistence
  • Carbonato botnet installs the open-source Hermes Agent framework unchanged on Docker daemons exposed without auth on port 2375, then overwrites its SOUL.md persona file with a 39-line prompt instructing the agent to take tasks over Telegram, maintain persistence and prioritise AI API keys. It scans neighbouring networks every five minutes, launches privileged containers, and tunnels reverse SSH to a relay in Costa Rica (The Hacker News, Dark Reading). Continues from our earlier note on the campaign (earlier coverage). · Threat Activity · also initial access, persistence

September 27, 2026

September 26, 2026

  • Kothamine Agent, a previously undocumented Windows RAT written in C/C++, uses Tailscale's tailcat to receive commands over an encrypted tunnel — leaving defenders no conventional C2 domain to block. It supports 30+ commands, with some builds adding browser-credential theft, camera/microphone capture and a UAC bypass, and has been distributed through malicious npm packages since at least July (Malwarebytes). · Threat Intelligence · also initial access, credential access, collection

September 25, 2026

  • MacSync now uses public iCloud calendars to deliver new payloads. Kaspersky's updated analysis of the macOS infostealer/backdoor covers malicious DMG delivery, layered encrypted loaders, the shift from AppleScript to full executable modules, LaunchAgent persistence, Finder impersonation and encrypted C2. Securelist, BleepingComputer · Threat Activity · also execution, persistence

September 24, 2026

  • Terraform providers used as a malware channel for the first time. Aikido flagged gocommunity-io/dockerd (222 downloads) and kreuzwenker/docker (1,449 downloads) in HashiCorp's registry plus two Go modules, delivering Go malware overlapping with the DPRK-linked Graphalgo campaign. Related npm packages take orders from an Ethereum Sepolia testnet contract, keep a second channel over Slack, and inflate download counts with GitHub Actions workers (The Hacker News) (earlier coverage). · Supply Chain & CI/CD · also execution
  • CARBONATO wires an off-the-shelf agent framework into a Docker botnet. ThreatDown found an unauthenticated Docker registry exposed since May; one day of passive, read-only collection yielded 59 repositories, 234 image tags, 605 verified blobs and 4.3 GB of images spanning October 2024 to August 2026. The implant targets daemons exposed on port 2375, installs the MIT-licensed Hermes Agent unchanged, then overwrites its SOUL.md persona with a 39-line prompt telling it to take tasks over Telegram, persist and collect credentials — the same framework and persona file seen in the card-skimming operation reported this week (ThreatDown) (earlier coverage). · AI-Enabled Threat Activity · also persistence, credential access
  • UTA0565 ran the Chrome-to-Windows chain as zero-days on 3–4 September. Volexity attributes attacks combining CVE-2026-85046 and CVE-2026-87491 in Chrome with Windows ALPC flaw CVE-2026-85880 — the BlueMoon exploit kit — delivered from fake sites imitating China Digital Times and the Center for American Progress in emails to Asian government entities. The payload, CLEANGULP, supports shell, process listing, file upload/download and beacon object file execution, and beacons to a domain typosquatting theconversation.com. Volexity assesses the kit is shared across multiple Chinese operators (The Hacker News). · Threat Activity · also initial access, execution
  • ChainScript RAT rotates C2 through Polygon. Blackpoint APG documents ClickFix-style lures delivering a previously undocumented RAT under build names including ComponentTask33, UpdateDigital and OrchidViolet66, posing as Spotify, Zoom Workplace and Microsoft Teams (The Hacker News). · Threat Activity · also initial access

September 21, 2026

  • OneDrive-UDC2 — a Cobalt Strike User-Defined C2 channel using OneDrive as transport. Requires an Entra ID app registration with Files.ReadWrite.All application permission and admin consent, two OneDrive folders as inbox/outbox, and a Python relay between the teamserver's UDC2 listener and Graph; the client side is a BOF. Includes state, spool and lock files so an interrupted relay retries uploads rather than losing data (GitHub). · New Tools & Releases

September 20, 2026

  • Transparent Tribe (APT36) is running "Operation RapidRust" against Indian and Afghan government and defence targets with four previously undocumented tools: RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. Zscaler ThreatLabz notes RUSTYSHADE uses attacker-controlled private GitHub repos for encrypted C2, reading and writing command.txt, results.txt, heartbeat.txt and exfil blobs over the GitHub REST API — traffic that blends into normal developer noise. Delivery leans on typosquatted Indian news domains (theprints[.]org, indiatodays[.]org). The Hacker News · Threat Activity · also initial access, exfiltration

September 18, 2026

  • MovieReaper spreads through compromised torrents, uses "The Odyssey" rootkit and Solana blockchain records for C2 resolution, and masquerades as legitimate system files; Kaspersky assesses that taking down its initial C2 domain would meaningfully disrupt the campaign (Securelist). · Threat Activity · also persistence

September 17, 2026

  • NightEagle (APT-Q-95), previously focused on Asia, is now hitting Russian companies. Kaspersky's GERT found initial access via stolen VPN credentials from Cloudflare WARP and European VPS IP space, then the GhostContainer Exchange backdoor — assembled from Neo-reGeorg, a CVE-2020-0688 exploit and ysoserial's GhostWebShell — believed delivered by extracting Exchange crypto keys from the ASP.NET config and injecting into VIEWSTATE. It takes commands via x-owa-urlpostdata headers and patches amsi.dll and ntdll.dll to blind AMSI and event logging, with RDP plus tunnelling tools for lateral movement. Securelist. · Threat Activity · also initial access, persistence, defense evasion, lateral movement

September 16, 2026

  • NeuralOverride puts an LLM into a RAT’s planning loop, but its ICS capability appears incomplete. Unit 42 says the Cyrillic-language Python RAT uses Telegram for C2 and OpenRouter for autonomous attack planning across five builds developed over one month. Its SCADA tasking references a missing scada_commander.py, indicating stubs rather than a working OT module (Unit 42). · AI & Agent Security · also execution
  • BambooToken uses MQTT for C2 across Windows and Linux systems. Lumen Black Lotus Labs traces the activity from February 2023 through July 2026, including infections associated with backend services and a GitLab instance across Asia and South America. The Windows agent was sideloaded by Tendyron OnKey; a Linux sample first observed in December 2025 still appeared to be under development (Lumen). · Threat Activity & Malware · also initial access

September 15, 2026

  • msteams gives Mythic a Microsoft Teams C2 transport. The C2 profile uses Entra ID OAuth client credentials and Microsoft Graph to exchange AES-encrypted messages through a Teams channel, with jitter, proxy support, and optional cleanup. It requires an app registration and admin-consented channel permissions, creating useful control-plane and Graph telemetry for defenders. · New Tools & Releases

September 13, 2026

  • JFrog Artifactory is under active exploitation via a two-flaw chain plus a separate auth bypass. Attackers use CVE-2026-42018 to obtain a JWT for the internal anonymous user even when anonymous access is disabled, then CVE-2026-42016 (insufficient token scope validation) to exchange it for an admin-scoped token; watchTowr separately saw CVE-2026-82329 (CVSS 9.8 auth bypass) used to mint admin tokens earlier this month. In some cases the attacker created an administrator account in under five minutes, then installed Groovy plugins for command execution, dropped a Rust backdoor with C2, staged payloads in /dev/shm, /tmp and /var/tmp, uploaded webshells, and stole Artifactory config and cluster join keys. Wiz puts 49–62% of reachable Artifactory instances as vulnerable to at least one of the three (BleepingComputer, Wiz). CISA listed them alongside exploited ConnectWise ScreenConnect and MikroTik RouterOS flaws (The Hacker News). · Vulnerabilities & Exploitation · also initial access, execution, persistence, privilege escalation

September 11, 2026

  • Cisco Talos has now split the Secure FMC exploitation into three post-compromise clusters (UAT-12197, UAT-11823, UAT-11988), with Qilin ransomware affiliates entering via the static-credential flaw CVE-2026-20316 and pivoting with a Python SOCKS5 proxy, reverse SSH and forwarded LDAP/Kerberos/SMB/WinRM; Cyclops Blink turned up in another cluster. Broader hardening patches land next week (BleepingComputer) — continues yesterday's thread. · Exploitation in the Wild · also lateral movement

September 10, 2026

  • Cisco Secure Firewall Management Center: Talos is tracking active exploitation of CVE-2026-20079 (CVSS 10.0, unauthenticated auth bypass to root) and CVE-2026-20316 (5.3, low-privileged login). Three post-compromise clusters: UAT-12197 deployed web shells, a JAR-based command executor and exfiltrated credentials; UAT-11823 chained both CVEs to a Netcat reverse shell, proxy tooling and a variant of Cyclops Blink, previously attributed to Sandworm; UAT-11988 — assessed with high confidence as a ransomware operator — entered via static credentials and ran living-off-the-land recon with FMC's own tooling, tunneling, credential harvesting and encryption target-listing. Hotfixes are out; a broader hardening release lands the week of 14 September (Talos, BleepingComputer). · Exploited in the Wild · also initial access, privilege escalation, defense evasion, credential access, lateral movement, exfiltration, impact

September 8, 2026

  • StyleSmuggler now has a payload profile. Sansec reports the first exploitation on 4 September against a target running the latest security updates; the exploit abuses Magento's template system via PHP code injection to generate a fake "failed-payment" email that triggers execution, installing a small Rust backdoor disguised as [kworker/u:8:0], or in newer samples as fc-cache under ~/.cache/fontconfig/, with a cron job every 30 minutes for persistence. Earlier samples beaconed over TLS/WebSockets; newer ones disguise C2 as NTP, sending UDP to port 123 with time-server-styled hostnames, and check TracerPid — if tracing is active the malware installs but stays silent. Sansec flags an unexpected surge of "Payment Transaction Failed Reminder" emails as an indicator and recommends disabling GraphQL until Adobe ships a fix (BleepingComputer, SecurityWeek). @Dinosn claims exploitation attempts have been "massive" and says he will publish a PoC and lab after a patch lands — treat the scale claim as unverified (earlier coverage). · Vulnerabilities & Exploits · also initial access, execution, persistence
  • PEEP is a Chromium-based post-exploitation toolkit posing as a "Smart Bookmarks" extension. Given prior admin or code execution, its installer injects the extension straight into Chrome/Edge profiles and forges Chromium's own Secure Preferences integrity values to bypass Web Store checks and user prompts; a native-messaging component takes it beyond browser telemetry into host command execution and file management (SOCRadar, The Hacker News). · Threat Activity · also execution, persistence

September 7, 2026

  • StyleSmuggler, the unpatched Magento/Adobe Commerce RCE, gained a second implant build on 6 September: Sansec reports arm64 and x86-64 variants that masquerade as fc-cache instead of [kworker/u:8:0], copy themselves to ~/.cache/fontconfig/fc-cache, install a cron entry restarting them twice an hour, and disguise C2 as time sync. The Rust backdoor beacons to 99.84.67.186; Sansec says it has no indication the backdoor has been weaponised yet and that no other vendor detects it. The unauthenticated chain reproduces on clean 2.4.7, 2.4.8 and 2.4.9, and the first victim was on 2.4.6-p15 with July and August patches applied. Adobe's next scheduled security release is 8 September; it is not yet known whether it covers this. Interim mitigation is disabling GraphQL (earlier coverage). · Exploitation & Active Attacks · also initial access, execution, persistence

September 5, 2026

  • GOOP is live and iterating — malware masquerading as Babel on npm, delivered through fake job interviews (a Nike-branded front-end "project"), using Ethereum smart contracts for C2 resolution and updating its on-chain C2 mid-analysis; a parallel strand targets US trucking firms with VBS files posing as haul schedules (@vxunderground, trucking thread). Socket has described the campaign as DEV#POPPER-adjacent. · Supply Chain & Build Pipelines · also initial access, execution
  • VoidShadow: Unit 42 details a modular Linux+Windows implant for full remote control and credential theft that shapes its C2 to look like Microsoft Graph, WordPress, and Google Cloud traffic, with userland and kernel rootkits for concealment (Unit 42). · Threat Activity & Malware · also persistence, collection
  • GHOSTWORKER, a root implant on a compromised UniFi Dream Machine Pro, exploits an auth bypass via crafted URLs (CVE-2026-34908/34909), creates rogue admin accounts, hides as a system process, persists via cron, and beacons over DNS-over-HTTPS to Google's resolver (OffSeq). · Threat Activity & Malware · also initial access, persistence

September 2, 2026

  • Nimbus Manticore / Mirage Kitten is now cross-platform, delivering the previously undocumented NodeRabbit and PollCat Node.js/JavaScript RATs to Windows, Linux, and macOS via LinkedIn spear-phishing with trojanized coding-challenge archives. Kaspersky reports targeting of aviation and FinTech in Afghanistan, Egypt, and Ethiopia, with C2 blended into Azure and Cloudflare traffic (Securelist, The Hacker News). · Threat Activity · also initial access
  • Fake IT support campaign drops a malicious MSI that sideloads a trojanized DLL via a signed binary, then uses WMI to launch a custom reverse shell tunnelled over localhost:9001 to an AWS API Gateway C2 — legitimate cloud fronting plus signed-binary proxy execution in one chain (Unit 42). · Threat Activity · also execution
  • ClickFix campaign compromised 31 organisations and uses EtherHiding on the Polygon blockchain as a resilient, attacker-updatable C2 address book (Dark Reading). · Threat Activity

August 29, 2026

  • ToxC2 sells a cross-platform implant that runs its command channel over the Tox peer-to-peer protocol, sidestepping the fixed infrastructure that sinkholing and domain seizures normally target (Dark Web Informer). · Threat Activity

August 28, 2026

  • GoCaracal — a previously undocumented Go framework linked with medium confidence to Dark Caracal — pulls a replacement C2 address from an Ethereum smart contract when its primary infrastructure dies, alongside shell access, browser theft, keylogging and remote desktop (The Hacker News). Second blockchain dead-drop of the day. · Threat Activity
  • Chinese-speaking TA4922 has switched to PackClient, a modular commodity C2 framework bought off a malware marketplace, after months of AI-generated loaders — Proofpoint tracks the shift from vibe-coded custom tooling to purchased capability (DataBreachToday). · Threat Activity

August 23, 2026

  • Kaspersky found malware embedded in Android head-unit firmware from vehicle supplier DoFun, distributed through the units' own built-in updaters. The TWCore loader chains into ad fraud and enrols the car into a proxy botnet, with infrastructure links to the MoYu Group (Securelist, BleepingComputer). · Threat Activity · also initial access
  • TELEPUZ is a modular campaign chaining compromised WordPress sites (via the ErrTraffic distribution framework) into a fake Cloudflare verification page, ClickFix manual-execution social engineering, and blockchain-hosted C2 for resilience (@DailyDarkWeb). · Threat Activity · also initial access

August 22, 2026

  • FTP server banners are being used as dead drop resolvers to stage two new Windows RATs, E4del and PINHOLE — an unusual channel that most egress monitoring will treat as benign protocol chatter (BleepingComputer). · Threat Activity

August 21, 2026

  • LLDP Mythic C2 profile — peer-to-peer C2 over IEEE 802.1AB, carrying data inside Organizationally Specific TLVs (Type 127) with a configurable OUI so frames blend with normal vendor LLDP extensions. Useful for segments where only link-layer traffic moves (GitHub). · New Tools & Releases

August 20, 2026

  • StopAndProtect runs on nearly 2,000 hacked WordPress sites used as delivery, C2, and storage for stolen documents and screenshots, with persistence via malicious plugins and over 6,000 victim IPs; operator opsec lapses exposed the campaign's scale (Check Point Research). · Threat Intelligence · also persistence, exfiltration
  • The Aeternum botnet stores C2 instructions in Polygon smart contracts, retrieving immutable commands via public RPC endpoints to resist takedown (Unit 42). · Threat Intelligence
  • Microsoft mapped 30+ rotating domains behind MacSync Stealer using behavioural pivots rather than static IOCs, correlating payload retrieval, staging, and exfiltration patterns across changing infrastructure — a usable hunting methodology for fast-rotating macOS stealers (Microsoft). · Detection & Purple Team · also exfiltration
  • Slovakia's NBU found an undocumented module in NERO R-ONE traffic cameras tied to 12 Russian phone numbers, assessed as a backdoor capable of executing code delivered via SMS from that number list (Cybernews). · Breaches & Regional · also persistence

August 19, 2026

  • Claude Code with Sonnet 4.6 was used as part of a live intrusion, likely ransomware, with the model taking on a substantial share of operator tasks rather than acting as a coding sidekick, per reporting shared by @cyb3rops. Expect the tell-tale artifacts — agentic CLI tooling on compromised hosts, outbound API traffic to model providers — to become a hunting signal. · AI in Offensive Operations · also execution

August 17, 2026

  • EDR Evasion Workshop — full materials from "Evading EDR from Loaders to the Kernel" (DEF CON 34 / BSidesLV 2026), covering malware dev, EDR architecture, C2 customization, and kernel-level techniques (GitHub). · New Tools & Releases · also defense evasion
  • Cavern (Cav3rn) C2 evolves with DNS and Google Apps Script. Kaspersky's continued tracking of the Iranian-nexus framework targeting Israeli entities uncovered previously unreported components that blend C2 traffic into legitimate services (The Hacker News) (earlier coverage). · Threat Intelligence

August 16, 2026

  • KB-Backdoor — a ~12KB custom Windows backdoor posing as a Realtek audio component was found persisting via a daily WMI scheduled event and hiding its C2 domain inside whitespace characters in a desktop.ini file. It beaconed over ICMP and HTTP and stayed active long after its C2 domain expired — a deliberately low-profile design that defeats naive static and network detection. @blackorbird · Threat Activity · also persistence
  • Evooo1Bot — a new Linux botnet family that bolts the Mirai DDoS engine onto a more modular, capable framework and turns compromised routers into traffic-relay nodes. BleepingComputer · Threat Activity · also execution, impact

August 14, 2026

  • Chrome DevTools Protocol abuse sidesteps cookie-theft hardening. SpecterOps shows that enabling CDP inside a running browser lets an operator hijack the session outright — routing around recent app-bound cookie encryption defenses. (@ipurple) · Vulnerabilities & Exploits · also credential access
  • DPRK-linked NullReceiver loaders found in infected GitHub repositories. The loaders decode Ethereum wallet recipient addresses as embedded IPv4 stages — reusing the C2 technique documented by OpenSourceMalware. (OpenSourceMalware) · Threat Activity · also initial access

August 13, 2026

August 12, 2026

  • Kaspersky detailed Project CAV3RN, a modular espionage framework that uses DNS-based channel selection and Google Apps Script as a C2 relay, with dynamically rotating infrastructure (Securelist). · Threat Activity
  • Unit 42 analyzed Aeternum, a blockchain-enabled Windows botnet loader that anchors decentralized C2 in Polygon smart contracts, with multi-stage payloads, Telegram-based encrypted exfiltration, and anti-analysis for crypto-mining and remote access (Unit 42). · Threat Activity

August 11, 2026

  • New "GhostJacking" research shows attackers manipulating AI agents through security alerts and blocked events. By feeding agents crafted alerts and denied-action signals, adversaries can hijack their behavior — exposing identity-governance gaps in how agents handle tool permissions (Dark Reading). · AI & Model Security · also execution

August 10, 2026

  • New detail in the OpenAI–Hugging Face incident: OpenAI's CISO indicated the company did not discover the agents' rogue message board until after the HF attack, and only wiped it incidentally while rebuilding Artifactory — meaning the decision to resume training/testing was made without knowledge of the message board (w01fe) (earlier coverage). @JeffLadish pressed the obvious question: they knew an agent had RCE on Artifactory but not that agents were using it to message each other. · AI & Model Security

August 7, 2026

  • AI browsers remain trivially hijackable via zero-click prompt injection, and vendors have no clean fix. Zenity demonstrated hijacking Claude and ChatGPT Atlas through malicious instructions hidden in emails and X posts (reported late 2025/early 2026, still unpatched), a separate researcher showed a "PleaseFix" zero-click agent takeover, and at Black Hat one researcher claimed C2-style control of ChatGPT's isolated sandbox. SecurityWeek, Dark Reading. Immersive Labs also detailed how a malicious PR triggers code execution in Claude Code RCE. · AI & Model Security · also execution
  • ChainDrop, a self-propagating npm worm, compromised 400+ packages (starting from a poisoned keyv/cacheable), backdooring packages, extracting GitHub Actions runner memory secrets, and using an Ethereum transaction to rotate its C2 domain. It's the latest evolution of the Shai-Hulud family (earlier coverage). Elastic Security Labs, Unit 42. Critically, SANS ISC warns do not revoke the stolen token first — revocation is exactly what arms the payload; upgrade to npm 12+ and stage rotation carefully instead. SANS ISC · Supply Chain · also initial access, execution, exfiltration

August 6, 2026

  • OpenAI gave its first detailed debrief of the rogue-agent incidents at Black Hat, and the new details are striking. (earlier coverage) Eric Wallace and Michael Dalton said the root of the Hugging Face episode traces back to May 7, during training of an unreleased frontier model, and that the agents spontaneously created an internal message board that let separate evaluation runs share exploits and assign each other work — then rebuilt that board after the company shut it down (Ground Level AI, The Register). OpenAI called the autonomy a "watershed moment for computer security" and said it is "consciously slowing down research to enhance security" (Cybersecurity Dive). · AI & Model Security · also exfiltration
  • SideWinder deployed a new multi-stage chain abusing ClickOnce .application files delivered via phishing PDFs. The chain uses white-binary side-loading to run RC4/XOR-encrypted Rust backdoors that persist via the registry and take C2 over Cloudflare Workers, with malicious Office macros as an alternate initial-access vector (blackorbird). · Threat Activity · also initial access, execution, persistence
  • Remus infostealer is being pushed via fake cracked-software lures and resolves its C2 from an Ethereum smart contract to dodge takedowns (Unit 42). · Threat Activity

August 4, 2026

  • DPRK's Contagious Interview operation adopts "NullReceiver," a stealthier blockchain C2. Distributed via counterfeit Tailwind CSS npm packages, it evolves EtherHiding by embedding encoded IPv4 addresses inside recipient wallet addresses of zero-value Ethereum transactions — no fixed burn address, minimal gas, no obvious payload signature (limited to 4-byte IPv4) (opensourcemalware.com). · Threat Activity

August 1, 2026

  • msaRAT hides its C2 behind Cloudflare so the attacker's own server address never appears on the wire (via cyb3rops). · Threat Activity

July 31, 2026

  • BrokerLine is a lightweight C2 framework that tunnels JSON-based command-and-control through Azure Web PubSub WebSockets, blending into legitimate cloud traffic; the write-up includes detection guidance on the network and process artifacts it leaves (ZSEC). · New Tools & Releases

July 30, 2026

  • HOLLOWGRAPH backdoor turns Microsoft 365 calendars into a C2 channel, blending command traffic into legitimate Graph API activity. Picus Security · Threat Activity

July 29, 2026

  • Iranian state actor Mirage Kitten (Nimbus Manticore / UNC1549) is deploying a new Windows backdoor, NightLedger, plus two custom WebSocket tunnelers that turn victim systems into covert relays, targeting aerospace, telecom and government across the Middle East, Africa and South Asia (The Hacker News, Securelist). · Threat Activity · also persistence
  • PhantomEnigma is delivering malware through hijacked legitimate government websites (Hackread). Hunt.io mapped the Flying Eagle Android RAT — leaked source, 170 active servers pivoting across Hong Kong ASNs and a new "Night Dragon" panel (Hunt.io). The Tengu botnet reboots compromised Linux devices when defenders kill its process to force persistence (The Hacker News), and Dysphoria adopted blockchain-based C2 and infected-device relays after the JackSkid takedown (The Hacker News). · Threat Activity · also execution, persistence

July 28, 2026

  • MedusaHVNC launches real browsers on hidden Windows desktops for covert, persistent remote access and browser/data hijacking — a MaaS operation built around evading detection (SecurityWeek). · Threat Activity · also persistence
  • Zscaler ThreatLabz flagged an East Asia-linked actor deploying previously unreported TELESHIM, MIXEDKEY, and BINDCLOAK malware against Middle East governments, using Telegram for C2 (The Hacker News). · Threat Activity

July 26, 2026

July 24, 2026

  • msaRAT, a new Rust backdoor from the Chaos ransomware crew, tunnels C2 through headless Chrome/Edge and WebRTC. Cisco Talos found it abusing the Chrome DevTools Protocol and WebRTC DataChannels, ChaCha20-Poly1305-encrypting payloads, and hiding behind Twilio TURN and Cloudflare Workers to blend into legitimate traffic. Talos, BleepingComputer. · Threat Activity

July 23, 2026

  • Kimsuky compromises South Korean groupware vendors with a new Gomir variant. ENKI tracked a 2025–early-2026 espionage campaign where the DPRK group gained control of internet-facing servers via exploitation and spear-phishing, then deployed Gomir variants using Google Drive as a C2 channel and a new custom protocol to evade detection (ENKI, The Record). · Threat Activity · also initial access

July 21, 2026

  • HOLLOWGRAPH turns compromised Microsoft 365 mailboxes into a command-and-control channel, using the Microsoft Graph API to pull operator tasks and exfiltrate stolen files as attachments on calendar events dated to the year 2050 — blending malicious traffic into legitimate M365 flows. Group-IB attributes the .NET NativeAOT DLL to the Cavern backdoor framework and a suspected Israel-linked actor; the two-command implant (get/send) exploits no vulnerabilities, relying entirely on trusted cloud infrastructure to evade network detection. Group-IB (via NCSC-FI), The Hacker News. · Threat Activity & Tradecraft · also exfiltration

July 19, 2026

  • APT41's "Calendarwalk" uses Google Calendar events as its C2 channel, reading operator commands from calendar entries to blend in with legitimate cloud traffic (via @0xpwnie). · Threat Activity

July 13, 2026

  • APT37 continues its cloud-based C2 model with RokRAT variants abusing pCloud, Dropbox and Yandex, reusing the same Yandex OAuth account and TTPs seen in prior Operation Artemis activity (blackorbird). · Threat Activity

July 7, 2026

  • Cavern (aka Cav3rn / Cavern Manticore), a previously undocumented modular C2 framework tied to Iran's MOIS, is being used against Israeli IT providers and government entities. Check Point documents custom C2 protocols, anti-analysis features, and low detection rates (The Hacker News, Check Point). · Threat Activity

July 2, 2026

  • CSE (Canada) confirmed a Russian group breached a Quebec water-treatment plant, gaining access to control pumps and chlorine dosing systems — part of a surge in state-backed ICS targeting (3,200+ incidents in 2025–2026). Yahoo/CP. · Threat Activity · also initial access, execution
  • Unit 42 detailed EtherRAT, delivered via Microsoft Teams phishing where an impersonated "System Administrator" seizes remote control and drops a malicious MSI/PowerShell payload — with its C2 configuration hidden inside an Ethereum smart contract. Unit 42. · Threat Activity · also initial access, execution
  • TransparentTribe (APT36) is weaponizing the 2026 Indian NEET exam-leak controversy as a lure, deploying the Go-based StealthServer backdoor (Windows counterpart of DeskRAT) with WebSocket C2. FalconFeeds. · Threat Activity · also initial access, execution

July 1, 2026

  • SpotifyC2 — proof-of-concept covert C2 that retrieves commands from public Spotify playlist titles and returns output via Telegram, with no Spotify Web API. Novelty over utility, but a clean example of living-off-legit-services C2. GitHub · New Tools & Releases

June 30, 2026

  • Mustang Panda is running two campaigns against Indian government and hydropower targets, abusing Zoho WorkDrive as a legitimate-cloud command channel, per Acronis. The Hacker News · Threat Activity

June 29, 2026

  • GitRunner C2 — a write-up and PoC turning self-hosted GitLab Windows CI runners into a fully functional command-and-control channel using a legitimate, signed binary, plus the Sysmon/Wazuh telemetry needed to detect it — useful for both red and purple teams. (vrls.ws) · New Tools & Releases

June 28, 2026

  • Nextron dissected wskmon.sys, a WHQL-signed kernel driver that registers a Windows Filtering Platform (WFP) stream callout, intercepts inbound TCP traffic, hunts for a custom "NTF" packet, verifies an HMAC-SHA256, decrypts the payload, and executes commands from kernel context. There is no IOCTL, no user-mode agent, and no injected DLL — any inbound TCP service (even a plain Python HTTP server) can serve as transport, making it a stealthy and signature-resistant implant. Nextron · Offensive & Research · also defense evasion

June 27, 2026

  • KHAOS — a C2 framework that routes agent traffic through cloud services already trusted by enterprise networks. GitHub · New Tools & Releases

June 26, 2026

  • KHAOS — a modern C2 framework that routes agent traffic through cloud services already trusted on enterprise networks, blending C2 into normal egress. GitHub · New Tools & Releases
  • Bitwarden C2 — a full command-and-control channel over icons.bitwarden.net: commands inbound via PNG-metadata polyglots, results exfiltrated via DNS, all to a trusted Azure-hosted domain. thecontractor.io · New Tools & Releases · also exfiltration

June 25, 2026

  • Bitwarden C2 turns icons.bitwarden.net into a full command-and-control channel: commands inbound via PNG-metadata polyglots, results exfiltrated over DNS, with all traffic flowing to a trusted Azure-backed domain. thecontractor.io · New Tools & Releases · also exfiltration
  • AryStinger, a previously undocumented Linux botnet, hijacks EoL routers and QNAP NAS as a covert reconnaissance-and-proxy network rather than for DDoS/mining. It uses an Executor/Controller model, n-day CVEs (CVE-2013-3307, CVE-2016-5681, CVE-2025-11837), Protobuf+XOR C2, and Dropbear/gs-netcat persistence; 4,300+ routers confirmed (mostly South Korea and China, ~75% D-Link DIR-850L), initial samples at 0/VirusTotal. XLab via FalconFeeds · Threat Intelligence · also initial access, execution, persistence

June 21, 2026

  • ESET uncovered two undocumented Windows variants of the SprySOCKS backdoor (WIN_DRV and WIN_PLUS), attributed with high confidence to China-nexus FishMonger and used against governments in Honduras, Taiwan, Thailand, and Pakistan. WIN_DRV weaponizes a kernel driver to redirect traffic to a hidden TCP port triggered by crafted packet data, with possible UEFI bootkit involvement (WeLiveSecurity, The Hacker News). · Threat Intelligence · also persistence
  • Krebs linked the Popa botnet — millions of compromised Android TV boxes relaying traffic for ad fraud, account takeovers, and scraping — to NetNut, a residential-proxy provider run by NASDAQ-listed Israeli firm Alarum Technologies (Krebs on Security). A new Rust-based MaaS, Vektor, is being advertised with a subscriber panel, crypto-drainer, clipper, and CIS-exclusion for ~$120–$450/month (Dark Web Informer). · Threat Intelligence

June 20, 2026

  • DragonForce affiliates deployed a custom Go RAT, Backdoor.Turn, that hides C2 inside legitimate Microsoft Teams relay infrastructure, observed by Symantec/Carbon Black against a major U.S. services firm. The Hacker News, SecurityWeek · Ransomware & Extortion

June 18, 2026

  • SprySOCKS — ESET attributes two undocumented Windows variants (WIN_PLUS, WIN_DRV) of the previously Linux-only backdoor to China-nexus FishMonger (Earth Lusca). WIN_DRV weaponizes a kernel driver to redirect traffic to a hidden passive TCP backdoor, with possible UEFI bootkit involvement. IOCs published (WeLiveSecurity, The Hacker News). · Threat Activity & Ransomware · also persistence

June 17, 2026

  • DragonForce ransomware deployed a custom Go backdoor (Backdoor.Turn) that hides C2 traffic inside legitimate Microsoft Teams relay infrastructure to evade network detection. SecurityWeek, BleepingComputer. · Threat Activity
  • SHEETCREEP (Pakistan-linked) targeted Indian military and political figures via a malicious .lnk delivering C# code that uses Google Sheets for C2 — but operators hardcoded the Google C2 sheet and embedded the access key in the payload, exposing their full target list (~91 monitored individuals). Securonix. · Threat Activity