[darkhotel]

August 14, 2026

• DarkHotel (APT-C-06) malicious MSI chain. Nextron identified samples that run AV/environment checks, create scheduled tasks, and pull PowerShell-staged payloads with shellcode injection for evasion. (Nextron) · Threat Activity

in vCenter Under Active Exploitation: Critical RCE Weaponized for Reverse-SSH Persistence Across 47 Countries