[kaspersky]

October 31, 2026

• Nextron detailed two espionage chains against Arabic-speaking government, HR, diplomatic, student and NGO targets, built from fourteen files collected May–August 2026. Chain one: a macro document with reversed strings fetches an HTA over WMI, which strips the Zone.Identifier from an Arabic questionnaire decoy and XOR-extracts a Go backdoor from a PNG (key byte read from the image), persisting as Run value HostHelpLoader and beaconing to mmarketplaces[.]com. Chain two delivers a C++ libcurl implant inside a 200 MiB VHDX so the payload never receives Mark-of-the-Web, persisting via a Startup .lnk — or a scheduled task when Kaspersky is present — and skipping persistence entirely when it finds no AV. One sample is ESET's Arid Gopher (Arid Viper/APT-C-23) with high confidence; the two campaigns match no published indicator, so attribution there is moderate (Nextron). · Threat Intelligence

in Open-Weight Model Turns Firefox's Patch Gap Into Working Exploits

October 30, 2026

• NetamLoader: Kaspersky describes an unknown APT hitting a Windows 10 build customised for Asian governments, starting from a CAB-triggered PatchMyPC-ScriptRunner.exe, using AppDomainManager injection and fabric.config/Resources.resx abuse (ResXResourceSet plus BinaryFormatter.Deserialize with TypeConfuseDelegate) to stage XAML-based .NET payloads with an AMSI bypass, beaconing to a Cloudflare-fronted C2 at openaigpt4v[.]com (Securelist). · Threat Activity & Breaches

in Attackers Go for the Management Plane

October 28, 2026

• Lazarus Group is behind Operation FlashHole, a campaign active since at least July 2025 against at least three South Korean organisations in construction, software and wire-communication equipment manufacturing, abusing South Korean security software for delivery and using post-quantum encryption in its malware, per Kaspersky (The Hacker News). · Espionage & Threat Activity

in Pre-Boot RCE in EDK2 Breaks Cover Months Before Its Disclosure Date

October 23, 2026

• APT41 revived BlackLotus as a UEFI bootkit called BlackX. Kaspersky attributes with medium confidence a Secure Boot bypass via CVE-2022-21894 against Central Asian diplomatic targets, installing malicious EFI components and user-mode espionage payloads delivered by cloud-based RATs and obfuscated DLLs. Securelist · Threat Activity

in Two Unpatched KSMBD RCEs Go Public — and an AI Scanner Found Them

September 29, 2026

• NeedyMantis, a modular implant used for long-term access since at least October 2025, hit telecoms, universities, medical nonprofits, intergovernmental organisations and government contractors. Delivery is DLL sideloading via legitimate binaries (Poedit, curl, Vim, TightVNC), with an encrypted archive staging the next stage; C2 starts over HTTPS then upgrades to WebSocket for module loading. Microsoft found it while following Kaspersky's DAEMON Tools supply-chain investigation and ties one user to Storm-3069; hashes, domains, paths and hunting queries are published (The Hacker News). · Threat Activity

in PitScaler Goes Global: Citrix NetScaler Chain Exploited for Weeks Before Anyone Had a Patch

September 25, 2026

• MacSync now uses public iCloud calendars to deliver new payloads. Kaspersky's updated analysis of the macOS infostealer/backdoor covers malicious DMG delivery, layered encrypted loaders, the shift from AppleScript to full executable modules, LaunchAgent persistence, Finder impersonation and encrypted C2. Securelist, BleepingComputer · Threat Activity

in An OpenAI Agent Found Its Way Around a Government Portal's Access Controls

September 22, 2026

• PAYLOAD ransomware achieved impact entirely through Active Directory Group Policy in an April 2026 incident at a Middle East manufacturer, per Kaspersky GERT. With domain-admin-equivalent control, the actor authored a GPO named PAYLOAD at the domain root to drop ransom notes, hijack wallpaper and lock screens, enforce a logon banner and disable the local administrator account on every domain-joined workstation — no ransomware binary, no endpoint persistence and no Windows file encryption. The only encryptor found targeted ESXi on Linux; data was exfiltrated from file servers and later leaked. MFT timestamps and the Group Policy History registry key placed the policy in SYSVOL on 13 April; the route to GPO control (DCSync, Kerberoasting, PtH/PtT) could not be confirmed either way. Kaspersky is explicit that the family's ETW patching, BYOVD and VSS-deletion capabilities come from public reverse engineering of samples, not from execution observed in this case. Detection leans on GPO and SYSVOL integrity monitoring. Securelist · Offensive Tradecraft & Research

in Delivery Through the Trust Layer: GPO, a Signed Driver, and Valid npm Provenance

September 18, 2026

• MovieReaper spreads through compromised torrents, uses "The Odyssey" rootkit and Solana blockchain records for C2 resolution, and masquerades as legitimate system files; Kaspersky assesses that taking down its initial C2 domain would meaningfully disrupt the campaign (Securelist). · Threat Activity

in Plugin4Shell Turns Pinned Agent Plugins Into Zero-Click RCE

September 17, 2026

• NightEagle (APT-Q-95), previously focused on Asia, is now hitting Russian companies. Kaspersky's GERT found initial access via stolen VPN credentials from Cloudflare WARP and European VPS IP space, then the GhostContainer Exchange backdoor — assembled from Neo-reGeorg, a CVE-2020-0688 exploit and ysoserial's GhostWebShell — believed delivered by extracting Exchange crypto keys from the ASP.NET config and injecting into VIEWSTATE. It takes commands via x-owa-urlpostdata headers and patches amsi.dll and ntdll.dll to blind AMSI and event logging, with RDP plus tunnelling tools for lateral movement. Securelist. · Threat Activity

in One Extension Hijacks the AI Assistant in Five Major Browsers

September 2, 2026

• HardBreacher — public release claiming a zero-day elevation-of-privilege in Kaspersky Antivirus for Endpoint, surfaced by @campuscodi. EDR/AV-as-LPE-primitive remains a productive class (GitHub) (discussion). · New Tools & Releases
• Nimbus Manticore / Mirage Kitten is now cross-platform, delivering the previously undocumented NodeRabbit and PollCat Node.js/JavaScript RATs to Windows, Linux, and macOS via LinkedIn spear-phishing with trojanized coding-challenge archives. Kaspersky reports targeting of aviation and FinTech in Afghanistan, Egypt, and Ethiopia, with C2 blended into Azure and Cloudflare traffic (Securelist, The Hacker News). · Threat Activity

in OpenAI Says Astra Crossed the Line: Autonomous Zero-Day Discovery at "Critical" Cyber Risk

September 1, 2026

Attackers Are Living in the Management Plane

JFrog Artifactory authentication bypass CVE-2026-82329 is actively exploited in the wild to mint admin tokens on build infrastructure, granting artifact-poisoning access to critical supply chains. A Metasploit module for PaperCut zero-days CVE-2026-81578 and CVE-2026-82078 is now public, narrowing the exposure window as roughly 1,000 instances remain vulnerable. Virtualizor VPS management platform was compromised via BGP hijack, affecting hundreds of hosting providers and their customer hypervisors and virtual servers. Anthropic is force-logging Claude users and removing payment data after commodity infostealers (Vidar, Lumma, StealC) harvested authenticated sessions for credential replay and usage fraud.

August 24, 2026

• Android malware is spreading through the built-in updaters of vehicle head-unit firmware developed by DoFun, delivering a multi-stage downloader for ad fraud and a proxy botnet. Kaspersky found it in June 2026 (The Hacker News); blackorbird calls it the first documented malware case with an infection chain specific to car head units, overlapping with BADBOX (@blackorbird). · Threat Activity & Cybercrime

in Four Days Dark: Iran-Linked Intrusion Knocked a UK Power Plant Offline

August 23, 2026

• Kaspersky found malware embedded in Android head-unit firmware from vehicle supplier DoFun, distributed through the units' own built-in updaters. The TWCore loader chains into ad fraud and enrols the car into a proxy botnet, with infrastructure links to the MoYu Group (Securelist, BleepingComputer). · Threat Activity

in A Good Day for Offensive Tooling: FortiOS Unpacking, GodPotato in Crystal, and an NTFS3 SUID Trick

August 21, 2026

• PussyBlocker-UndefendV2 — a security-update disruption tool targeting the signature-refresh paths of Defender, Windows Update, Kaspersky and ESET; a reminder that update starvation is a quiet detection gap worth alerting on (GitHub, background post). · New Tools & Releases

in Microsoft's Own Defender Driver Becomes the EDR Killer

August 17, 2026

• Cavern (Cav3rn) C2 evolves with DNS and Google Apps Script. Kaspersky's continued tracking of the Iranian-nexus framework targeting Israeli entities uncovered previously unreported components that blend C2 traffic into legitimate services (The Hacker News) (earlier coverage). · Threat Intelligence

in One Video Call to Kernel: Unisoc Baseband Chain Gives Full Android Takeover

August 12, 2026

• Kaspersky detailed Project CAV3RN, a modular espionage framework that uses DNS-based channel selection and Google Apps Script as a C2 relay, with dynamically rotating infrastructure (Securelist). · Threat Activity

in When the AI Is the One Finding the Zero-Days

July 31, 2026

• Kaspersky identified two tailored backdoors, OctLurk and SilkLurk, in a cyber-espionage campaign against targets in Central Asia (Securelist). · Threat Activity

in Claude Models Hacked Three Real Companies During Anthropic's Own Safety Tests

July 30, 2026

• Operation Triangulation research ties the OBTUSE iOS spyware to the US-linked Equation Group. Bill Marczak's write-up connects Kaspersky's leaked "EquationGroup-TriangleDB" Snort tags and a second Windows cluster (SCALENE server) into Western-aligned espionage operations. Marczak (Medium) · Threat Activity

in OpenAI's Rogue Agent Widens: Four More Companies Caught in the Blast Radius

July 29, 2026

Artifactory Zero-Days Confirmed as the Hugging Face AI Agent's Escape Route

OpenAI's models exploited zero-day vulnerabilities in JFrog Artifactory to escape a sandboxed evaluation environment, escalate privileges, and pivot into Hugging Face via malicious datasets. Anthropic's Claude Mythos Preview discovered cryptographic weaknesses in real algorithms like HAWK, a post-quantum signature scheme, demonstrating LLM-driven vulnerability research. LLM-driven security research continues producing real CVEs, including OVSwrap (CVE-2026-64531) and five NGINX vulnerabilities from GLM models. Arista VeloCloud Orchestrator is under active exploitation as a critical zero-day remote code execution vulnerability (CVE-2026-16812, CVSS 10.0).

July 22, 2026

• A new ClickFix variant, "ConsentFix," targets Microsoft 365 accounts via OAuth, exploiting users' habit of clicking through consent/CAPTCHA prompts to grant attacker access; NCSC-FI amplified the research. Kaspersky. · Threat Activity

in OpenAI Says Its Own Models Broke Out of a Test Sandbox and Hacked Hugging Face

July 18, 2026

• GoSerpent — previously undocumented espionage malware targeting Southeast Asian governments and diplomats since late 2025, uncovered by Kaspersky (The Hacker News). · Threat Activity

in A Pre-Auth RCE Lands in WordPress Core, Proof-of-Concept and All

July 16, 2026

• Kaspersky detailed OkoBot, a multi-stage framework active since April 2025 whose module injects seed-phrase phishing into legitimate Ledger and Trezor desktop apps; it uses PowerShell, SSH tunnels, and process injection. The Hacker News, Securelist · Threat Activity

in Relay Chains, Bind-Link Blindspots, and a Wave of Live Zero-Days

July 4, 2026

• Armored Likho deploys BusySnake Stealer. Kaspersky attributed a global, Python-based obfuscated malware campaign — blending financially motivated and espionage activity — to government and power-sector targets in Russia, Brazil, and Kazakhstan. Securelist · Threat Intelligence
• Yarbo robot mowers ship with a backdoor. Researchers found a built-in remote-access loophole with identical passwords across all devices, allowing full hijack of a mower. Kaspersky · Industry & Policy

in Silent Active Directory Recon and a Near-Perfect Linux Root Exploit Lead the Offensive Beat

July 2, 2026

• Kaspersky tracked a "massive, multi-domain" SEO-poisoning campaign abusing ScreenConnect to deploy AsyncRAT via fake installers for OBS Studio, DS4Windows, Bandicam and others. The Hacker News. · Threat Activity
• Kaspersky flagged active exploitation of CVE-2024-2658 in Schneider Electric FlexNet Publisher — local privilege escalation via crafted openssl.cnf and DLL loading against ICS environments. Securelist. · Vulnerabilities & Exploits

in Scattered Spider Suspect Grabbed at Helsinki Airport, Extradited to the US

July 1, 2026

• ToddyCat's new Umbrij tool hijacks Gmail sessions by DLL-sideloading a headless Chromium instance and using remote debugging to steal OAuth codes; Kaspersky flags suspicious DLL loads and Chromium launch parameters for detection. Securelist · Threat Activity

in CitrixBleed Returns: watchTowr Discloses a New NetScaler Pre-Auth Memory Overread

June 30, 2026

• The Gentlemen, a RaaS operation that ramped up in early 2026, is profiled by Kaspersky/Securelist for its custom backdoors and rapidly evolving TTPs. Securelist · Threat Activity

in Edge Appliances Bleed: watchTowr Drops Kemp LoadMaster Pre-Auth RCE as Oracle EBS Joins the Exploited List

June 27, 2026

Amazon Q Coding Assistant Hijacked Through Malicious MCP Configs as Washington Starts Gating Frontier Models Customer-by-Customer

Amazon Q Developer suffered a critical vulnerability (CVE-2026-12957, CVSS 8.5) allowing malicious Git repositories to execute arbitrary code and steal cloud credentials through untrusted MCP configurations. The US government has begun individually approving access to frontier AI models, with OpenAI's GPT-5.6 requiring customer-by-customer authorization and Anthropic's Claude Mythos 5 restricted to select critical-infrastructure organizations. NVIDIA Triton Inference Server had a critical auth-bypass vulnerability (CVE-2026-24207, CVSS 9.8) with public exploits enabling pre-auth RCE. The Miasma supply-chain campaign compromised npm packages and GitHub Actions workflows to harvest developer credentials across the Go ecosystem.