[proofpoint]

August 28, 2026

• Chinese-speaking TA4922 has switched to PackClient, a modular commodity C2 framework bought off a malware marketplace, after months of AI-generated loaders — Proofpoint tracks the shift from vibe-coded custom tooling to purchased capability (DataBreachToday). · Threat Activity

in Australia Charges Two Over the TeamPCP Supply-Chain Spree

July 25, 2026

• Russian Zimbra campaign broadens across webmail platforms. Proofpoint expands the picture on the state-linked actor (TA488 / Void Blizzard / Laundry Bear), tying the "half-click" Zimbra XSS (CVE-2025-66376) to a wider Operation RoundPress push that also weaponized zero-days in mDaemon (CVE-2025-3929) and SOGo (CVE-2026-8496) (earlier coverage). Proofpoint. · Threat Activity

in A Default-Config RCE Cracks GitLab, and the PoC Is Already Public