[sidecopy]

September 23, 2026

• SideCopy has extended its India targeting to academic institutions, using spear-phishing that abuses mshta.exe to execute scripts and deliver ReverseRAT, per Trellix (The Hacker News). · Threat Activity & Breaches

in Attack Chains That Run Themselves

September 8, 2026

• SideCopy / Transparent Tribe activity against Indian defence targets continues with the same LNK plus BAT/PowerShell tradecraft. Qihoo 360's Advanced Threat Research Institute published further CrimsonRAT samples and a separate Go-based RAT, with infrastructure reuse across both campaigns (360 ATRI report). · Threat Activity

in N-able Ships a Fourth N-central Hotfix in Five Weeks — and Can't Agree Whether It's Exploited

August 14, 2026

• SideCopy delivering CrimsonRAT via Outlook .msg lures, and BitterAPT using malicious .accdr documents against government, defense, and maritime targets — both flagged by Nextron with fresh IOCs. (SideCopy, BitterAPT) · Threat Activity

in vCenter Under Active Exploitation: Critical RCE Weaponized for Reverse-SSH Persistence Across 47 Countries

June 21, 2026

FortiBleed Exposes 86,000 FortiGate Devices as North Korea's Sapphire Sleet Poisons the Mastra npm Catalog

Fortinet networks face massive credential exposure via FortiBleed affecting 86,644 devices, while North Korea's Sapphire Sleet compromised 145 Mastra npm packages with an infostealer, and Google Cloud Vertex AI SDK suffered a cross-tenant RCE vulnerability. Critical CVEs in Splunk, NGINX, Cisco SD-WAN, and Joomla are under active exploitation, alongside emerging AI-focused attacks including AutoJack and malicious JetBrains plugins stealing API keys.

June 19, 2026

• Dropping Elephant has run one continuous China-themed LNK loader line for three-plus years (44 samples, 2023–2026) delivering an in-memory RAT via PDF-masquerading shortcuts and hidden PowerShell stagers (Rapid7, Nextron); SideCopy (APT36) swapped in a "Minutes Of Meeting" double-extension .lnk lure dropping a .NET RAT with HKCU Run persistence (Nextron). · Nation-State & APT

in FortiBleed Burns 70,000+ Fortinet Edge Devices While a Leaked GitHub Token Guts Novo Nordisk

June 18, 2026

• SideCopy (APT36 / Transparent Tribe) continues its double-extension LNK → PowerShell → CrimsonRAT chain against Indian defense, swapping lures between fake PowerPoint briefings and Word "Minutes of Meeting" docs; staged components barely register at delivery. IOCs via Nextron (Nextron). · Threat Activity & Ransomware

in ShinyHunters Burns a PeopleSoft Zero-Day Through Higher Ed as Copilot "SearchLeak" Shows AI Is the New Exfil Channel

June 17, 2026

• SideCopy / APT36 (Transparent Tribe) targeted Indian defense personnel with a weaponized PowerPoint package and a double-extension .pptx.lnk shortcut launching a .NET CrimsonRAT loader. Nextron Research. · Threat Activity

in Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists