August 22, 2026
- Armored Likho has rewritten BusySnake in Golang and adopted the open-source Kharon RAT, while moving C2 and payload hosting off public GitHub to private GitLab and GitHub repos to frustrate analysis and blend with normal developer traffic. LLM-generated loaders remain part of their toolchain (@blackorbird) (earlier coverage). · Threat Activity
in A CVSS 10.0 Lands in Entra ID — and Microsoft Can't Keep Its Exploitation Story Straight