CWPdoor replaces the Control Web Panel server with a passive, log-suppressing backdoor. A fake updater swaps targeted cwpsrv versions, preserves timestamps, erases command history and accepts commands through signed, encrypted HTTP headers; triggering requests are removed from access logs. More than 340,000 Control Web Panel instances were internet-exposed during the past month, but that is not an infection count. One sample appeared alongside Ebury, although the relationship remains unknown. QiAnXin XLab and BleepingComputer
· Threat Activity & Infrastructure
November 5, 2026
China-aligned SlippyNunchucks hijacked DNS resolution for Sogou Input Method on Windows, abusing the IME's insecure HTTP brand-promotion channel to deliver the DarkVigil (FDMTP) implant to Chinese speakers abroad; activity observed from July 1, 2026 (ESET, The Hacker News).
· Threat Activity
NIKKE's PC launcher was backdoored through its own CDN. Four JavaScript files on Level Infinite's CDN were modified on September 27 to pull obfuscated code from insightjs[.]com / insightjs[.]org; the loader abused launcher functionality to run a LuaJIT payload installing the K2F remote-access agent (command execution, file browsing, screenshots, account and browser credential theft) plus an optional platform_experience_helper.dll that survives launcher close. Strings in a VirusTotal sample show crypto wallet extension theft (MetaMask, Phantom, Coinbase Wallet). Client fix shipped November 4 at 02:30 KST (BleepingComputer, IOCs).
· Threat Activity
October 28, 2026
Lazarus Group is behind Operation FlashHole, a campaign active since at least July 2025 against at least three South Korean organisations in construction, software and wire-communication equipment manufacturing, abusing South Korean security software for delivery and using post-quantum encryption in its malware, per Kaspersky (The Hacker News).
· Espionage & Threat Activity
October 22, 2026
OVHcloud’s postmortem narrows its October 19 CLI incident to roughly 250 downloads, not 250 victims. A stolen developer account replaced v0.11.0–v0.15.0 release binaries from 12:47 to 14:21 UTC; the source and build pipeline remained clean. The payload targeted cloud credentials, SSH keys and local coding-assistant data, while v0.16.0 was unaffected. That is the new scope since yesterday’s coverage; see the OVHcloud advisory.
· Supply Chain & Developer Security
October 15, 2026
Administrators are reporting backdoored Nextcloud servers running Collabora’s Built-in CODE Server. The reports tie compromise to the richdocumentscode app and a critical flaw in the bundled Collabora Online CODE component, making exposed hosts an incident-response case rather than patch-only work. GitHub issue, The Hacker News (discussion)
· Active Exploitation
September 4, 2026
Node.js is being used as the delivery mechanism in intrusions against government departments, tech companies and hotels since February 2026, with Symantec noting that node.exe is signed, trusted and widely allow-listed (The Hacker News).
· Threat Activity
September 3, 2026
The Virtualizor poisoning was a properly executed BGP hijack, with a valid TLS certificate to match (earlier coverage). Attackers exploited routing-security gaps at Hetzner and the certificate issuance process to take over Softaculous IP space and serve a malicious Virtualizor update over trusted TLS (Ars Technica). One hosting provider reported root-level compromise on 5 of 34 hypervisors it checked, with the window opening around 20:57 on 28 August (The Hacker News). (discussion)
· Supply Chain
September 1, 2026
ValleyRAT (Silver Fox) is shipping as signed adware — a modified Chinese wallpaper tool, QN Wallpaper, that DLL-sideloads a malicious libcef.dll from the install directory, with users often adding the whole folder to AV exclusions (Securelist). Separately, a full reverse-engineering write-up of the group's signed AV/EDR-killer kernel driver is now public (reverser.space).
· Threat Activity
August 24, 2026
Android malware is spreading through the built-in updaters of vehicle head-unit firmware developed by DoFun, delivering a multi-stage downloader for ad fraud and a proxy botnet. Kaspersky found it in June 2026 (The Hacker News); blackorbird calls it the first documented malware case with an infection chain specific to car head units, overlapping with BADBOX (@blackorbird).
· Threat Activity & Cybercrime
August 23, 2026
Kaspersky found malware embedded in Android head-unit firmware from vehicle supplier DoFun, distributed through the units' own built-in updaters. The TWCore loader chains into ad fraud and enrols the car into a proxy botnet, with infrastructure links to the MoYu Group (Securelist, BleepingComputer).
· Threat Activity
August 9, 2026
Head Mare breached TrueConf video-conferencing servers to trojanize client installers, swapping legitimate downloads for backdoored versions by exploiting unpatched instances (BleepingComputer).
· Threat Activity
August 5, 2026
QuickFox supply-chain attack deploys the FDMTP implant. FortiGuard Labs is tracking a long-running campaign — active since at least August 2025 — that trojanizes the QuickFox VPN/game-accelerator via a modified Electron renderer that fingerprints victims and loads a JavaScript stager (Fortinet).
· Supply Chain
July 17, 2026
UAT-11795, a Russian-speaking financially motivated actor, is trojanizing WebEx and Zoom installers to deploy the new in-memory Python Starland RAT and a bespoke PowerShell C2 implant (WLDR), targeting US and European victims for credential and crypto theft (Cisco Talos, BleepingComputer).
· Threat Activity
July 9, 2026
Lurking Lizard — Infoblox links a years-long malicious residential-proxy business (230+ lookalike domains, WireVPN and trojanized installers) to a Chinese threat actor recruiting victim devices as proxy nodes. The Hacker News, CyberInsider
· Threat Activity
Trojanized LetsVPN installers deliver GoodPersonRAT, granting full remote control while masquerading as legit VPN software and targeting Telegram Desktop data. CyberInsider
· Threat Activity
June 17, 2026
OptinMonster WordPress plugin (1.2M sites) was hit via compromised CDN credentials, injecting malicious JavaScript that created backdoors and exfiltrated data. CyberInsider.
· Supply Chain