[bitter-apt]

August 14, 2026

• SideCopy delivering CrimsonRAT via Outlook .msg lures, and BitterAPT using malicious .accdr documents against government, defense, and maritime targets — both flagged by Nextron with fresh IOCs. (SideCopy, BitterAPT) · Threat Activity

in vCenter Under Active Exploitation: Critical RCE Weaponized for Reverse-SSH Persistence Across 47 Countries

June 27, 2026

• Bitter APT (APT-C-08) is hitting maritime and government officials with a .accdr file disguised as a PDF: AutoExec VBA fires on open, decodes payloads in memory via MSXML2, side-loads a DLL through signed fsquirt.exe, and plants a 17-minute scheduled task masquerading as a Chrome updater that pipes C2 responses straight into cmd.exe. The DLL runs TLS-callback anti-analysis and WMI/BIOS VM checks before fetching stage two. Nextron Research · Threat Activity

in Amazon Q Coding Assistant Hijacked Through Malicious MCP Configs as Washington Starts Gating Frontier Models Customer-by-Customer