Threat Research

Researchers uncovered UAT-11985, an APT spear-phishing campaign targeting individuals affiliated with Taiwan-based research organizations through AI-assisted event invitations and institutional impersonation....

On October 4, 2026, two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, were disclosed in the AhsayCBS backup utility. From October 7, Team observed attackers exploiting these flaws for remote code execution, targeting five organizations by October 8....

BraZetsu, a Python-based Windows malware framework compiled with Nuitka, is attributed with high confidence to the Brazilian threat actor Exilware and linked to the Infected Marketplace, which sells access to compromised Windows hosts....

Chinese government-linked cyber threat actors, enabled by Integrity Technology Group, combine automated scanning, large-scale botnets, and hands-on exploitation to compromise organizations worldwide, including U.S. critical infrastructure....

Research documents the evolution of MATCHBOIL, a custom C# downloader used by the Russia-aligned UAC-0099 APT group to deliver payloads and establish persistence on compromised systems. Between 2024 and 2026, the malware evolved with advanced .NET obfuscation, sandbox and anti-analysis checks, and modified persistence mechanisms, including scheduled tasks and registry Run keys....

In July 2026, ThreatLabz uncovered a supply-chain attack involving a malicious Terraform provider designed to run attacker-controlled code when initialized. The compromised provider retrieves a Bash loader from a Terraform-themed spoofed domain, which deploys tailored malware based on the victim’s operating system and CPU architecture....

Researchers details a financially motivated threat actor targeting South Korean financial organizations using ARTEX, an open-source agentic penetration-testing tool, alongside LLMs. The campaign leveraged AI-assisted intrusion operations, Claude Code, proxy infrastructure, and attacker-controlled servers, resulting in data exfiltration from targeted organizations....

A large-scale fake Android app adware campaign involved more than 1,900 malicious applications installed across 500,000+ devices in 190+ countries, with India, Russia, and the U.S. among the most affected....

In September, threat actors abused legitimate Power BI domains to make phishing emails appear trustworthy and evade security controls. Victims were directed to fake reference documents that prompted them to click “Download Reference,” leading to attacker-controlled websites....

Researchers identified 42 malicious RubyGems packages published by a threat actor known as Ghost Dev, targeting crypto and Web3 developers through typosquatting, brandjacking, and malicious utility packages. The packages deploy either a reverse shell or a cryptocurrency theft toolkit, with delayed execution and sandbox/CI environment detection....

2CLoader is a newly identified malware loader observed in August 2026 delivering Vidar and Remus information stealers, as well as XWorm RAT. It uses multiple anti-analysis and evasion techniques, including anti-VM and anti-debug checks, user-activity detection, indirect system calls, and Windows API hooks to evade security tools....

An Iranian state-aligned threat actor impersonated the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets. The activity, tracked as CL-STA-1178, includes a campaign dubbed “Blinder Tunnel.” Blinder Tunnel targeted Iraqi critical infrastructure in March 2026, with infrastructure staging observed as early as November 2025....

In August 2026, analysts investigated MDR cases involving ClickFix-style lures that deployed a Python-based tunneling implant. Unlike traditional ClickFix attacks, the lures instructed victims to open Windows Terminal, a technique known as TerminalFix....

TIKTOUK, a WordPress credential-collection toolkit comprising Python components and a Go-based Linux crawler that probes websites and extract exposed secrets. The toolkit targets WordPress configuration, backup, environment, and log files, recovering database credentials, AWS keys, API tokens, and encrypted email credentials through configuration-key-based decryption....

ClingSTUN is a Linux backdoor that exploits unpatched vulnerabilities in Internet-facing routers and IoT devices to establish persistent access and turn compromised systems into remotely controlled proxy nodes....