[apt36]

September 17, 2026

• APT36 ran Operation RapidRust in August against government and defence targets in India and Afghanistan, with new malware families RUSTYSHADE, RUSTYMOVE, PSNATCH and BASHNATCH plus new post-compromise tooling. Zscaler ThreatLabz. · Threat Activity

in One Extension Hijacks the AI Assistant in Five Major Browsers

July 2, 2026

• TransparentTribe (APT36) is weaponizing the 2026 Indian NEET exam-leak controversy as a lure, deploying the Go-based StealthServer backdoor (Windows counterpart of DeskRAT) with WebSocket C2. FalconFeeds. · Threat Activity

in Scattered Spider Suspect Grabbed at Helsinki Airport, Extradited to the US

June 21, 2026

FortiBleed Exposes 86,000 FortiGate Devices as North Korea's Sapphire Sleet Poisons the Mastra npm Catalog

Fortinet networks face massive credential exposure via FortiBleed affecting 86,644 devices, while North Korea's Sapphire Sleet compromised 145 Mastra npm packages with an infostealer, and Google Cloud Vertex AI SDK suffered a cross-tenant RCE vulnerability. Critical CVEs in Splunk, NGINX, Cisco SD-WAN, and Joomla are under active exploitation, alongside emerging AI-focused attacks including AutoJack and malicious JetBrains plugins stealing API keys.

June 19, 2026

• Dropping Elephant has run one continuous China-themed LNK loader line for three-plus years (44 samples, 2023–2026) delivering an in-memory RAT via PDF-masquerading shortcuts and hidden PowerShell stagers (Rapid7, Nextron); SideCopy (APT36) swapped in a "Minutes Of Meeting" double-extension .lnk lure dropping a .NET RAT with HKCU Run persistence (Nextron). · Nation-State & APT

in FortiBleed Burns 70,000+ Fortinet Edge Devices While a Leaked GitHub Token Guts Novo Nordisk

June 18, 2026

• SideCopy (APT36 / Transparent Tribe) continues its double-extension LNK → PowerShell → CrimsonRAT chain against Indian defense, swapping lures between fake PowerPoint briefings and Word "Minutes of Meeting" docs; staged components barely register at delivery. IOCs via Nextron (Nextron). · Threat Activity & Ransomware

in ShinyHunters Burns a PeopleSoft Zero-Day Through Higher Ed as Copilot "SearchLeak" Shows AI Is the New Exfil Channel

June 17, 2026

• SideCopy / APT36 (Transparent Tribe) targeted Indian defense personnel with a weaponized PowerPoint package and a double-extension .pptx.lnk shortcut launching a .NET CrimsonRAT loader. Nextron Research. · Threat Activity

in Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists