A USB drive or similar carried across the air gap.
5 real attacks
November 4, 2026
Bitter added PapRAT and three distinct delivery chains: an LNK abusing ftp.exe's ! prefix to run local shell commands, a VHDX image carrying an LNK that shows a decoy spreadsheet while launching an MSI, and a RAR containing a .url shortcut that fetches an LNK over WebDAV (FortiGuard Labs).
· Nation-State & Espionage
October 9, 2026
Mobile malware, two angles: low-cost Android handsets are shipping with firmware-embedded Midnight Mimosa, which silently installs apps, commits ad fraud and enrols devices as residential proxies (BleepingComputer); and Novinarya targets 81 financial apps via package enumeration, WebView phishing, regex-driven SMS and notification interception, resolving live C2 from encrypted dead-drop URLs planted in a Basalam shop profile (STAR Labs).
· Threat Activity
September 11, 2026
Mantax Otax is an Indonesian-linked Android strain that fuses spyware and ransomware: real-time screen recording, browser history, lock-screen PIN theft, contacts, call logs, SMS, file exfil and covert photos, followed by encryption on older Android versions and an on-screen chat portal for live extortion. Sideloaded as an APK from a file-sharing host, it resolves its live C2 domain from a GitHub repo and brokers traffic through Firebase (Zimperium, BleepingComputer). Separately, GoldFactory is abusing Android Work Profile to deliver Gigabud in the same country (Dark Reading).
· Threat Intelligence
August 17, 2026
GriefLure LNK samples overlap with military-telecom targeting. Nextron identified additional malicious LNK samples matching the Seqrite-described GriefLure campaign, which hit Vietnam's military telecom sector (including Viettel Group executives and Vietnamese cybercrime investigators) and Philippine healthcare orgs such as St. Luke's Medical Center (Nextron Research).
· Threat Intelligence
June 19, 2026
Microsoft detailed a self-spreading Windows clipper campaign active since February 2026 that uses USB LNK worms plus a bundled Tor proxy for hidden-service C2 to swap crypto wallet addresses on the clipboard (The Hacker News, BleepingComputer).
· Threat Activity & Intrusions