[symantec]

September 4, 2026

• Node.js is being used as the delivery mechanism in intrusions against government departments, tech companies and hotels since February 2026, with Symantec noting that node.exe is signed, trusted and widely allow-listed (The Hacker News). · Threat Activity

in Malware That Gaslights the AI Analyst

July 10, 2026

• GodDamn ransomware — assessed by Symantec's Threat Hunter Team as a rebrand of Beast — uses the PoisonX kernel driver to neutralize security software before encryption. Dark Reading notes the driver was Microsoft-signed and is being used to kill EDR in attacks against US companies, continuing the run of BYOVD abuse seen with The Gentlemen's Kontron driver last week. The Hacker News · Dark Reading · Malware & Endpoint Evasion

in Signed Drivers and Kernel Rootkits Push the Malware Beat Down to Ring 0

June 20, 2026

• DragonForce affiliates deployed a custom Go RAT, Backdoor.Turn, that hides C2 inside legitimate Microsoft Teams relay infrastructure, observed by Symantec/Carbon Black against a major U.S. services firm. The Hacker News, SecurityWeek · Ransomware & Extortion

in FortiBleed Burns 86,000 FortiGate Devices as Novo Nordisk Loses 1.3TB — Including AI Models — to a Leaked GitHub Token