September 11, 2026
- OceanLotus (APT32) is still shipping a custom XOR shellcode loader that decrypts and runs in memory, delivered in ISO/IMG chains with low AV coverage (Nextron). · Threat Intelligence
in Four Hours to First Victim: AI Agents Ran a Global PaperCut Campaign