Malware

Russia's FSB-linked Star Blizzard used a new delivery technique, RedFlick, in 13 phishing campaigns affecting 100+ US and UK organizations to deploy its CosmicPulse backdoor in 2026.

China-nexus actor UAT-11587 hit ~350 endpoints across 8 countries with Antino, a Rust backdoor that uses Outlook and OneDrive via Microsoft Graph for stealth C2, per Cisco Talos.

Rapid7's October 2, 2026 report details AVERAT and new BPFDoor/Rekoobe Linux implants that hide C2 in SMTP port 25 to mimic South Korean (SpamSniper) and Taiwanese (ShareTech) mail-security appliances and relay through compromised NAS, DVR and SMB devices against telecom targets.

OFAC sanctioned a Tren de Aragua ATM jackpotting network on September 30, 2026 — eight facilitators, two Mexican firms and seven TRON addresses — tied to $40.73M in reported US losses. Alleged malware engineer 'Prometheus' was arrested and arraigned in Nebraska two days later.

Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 were exploited from at least September 3, 2026, three weeks before the September 27 patch. Web shells survive the update; attribution is still only suspected.

GTIG tracked UNC6240 (linked to ShinyHunters) mass-exploiting PeopleSoft's CVE-2026-35273 (CVSS 9.8 unauth RCE). Defenders who blocked /PSEMHUB at a WAF instead of patching were bypassed: the actor requested /%50SEMHUB/, one URL-encoded character, then dropped web shells and the SIDEEYE backdoor.

Rapid7 found 'ted', a backdoor a DPRK-linked APT compiled into victims' HAProxy load balancers as a native plugin — reading their decrypted traffic and routing C2 through the load balancer itself. A companion CurlRAT toolkit hid in five trojanized Linux daemons; targets were South Korean firms.

Proofpoint documented BlueMoon, an exploit chain (CVE-2026-85046, -87491, -85880) four espionage clusters — led by China's TA412/APT31 — adopted within days to go from a web page to SYSTEM on patched Windows. Two V8 bugs were patch-gap zero-days; TA412 delivered a 'Google Gemini' spyware extension.

Mandiant documents an intrusion where an AI coding assistant recommended attacker-poisoned software; a developer accepted it, and the attacker used the live session to steal GitHub OAuth tokens and spread the Shai-Hulud worm across ~100 internal repos. How the session was taken over is undisclosed.

Blackpoint APG documented ChainScript, a full-featured RAT pushed via ClickFix lures (fake Spotify/Zoom/Teams installers) that reads a Polygon smart contract to find its live WebSocket C2 — an EtherHiding-style design built to survive takedowns and defeat indicator-based blocking.

Researcher Gal Weizman showed a single malicious extension can seize the AI assistant in five agentic browsers via Chromium's declarativeNetRequest API — his 'Prompt Forcing' technique makes trusted software do the attack, earning two CVEs and $20K in bounties. It needs a pre-installed extension.

A maximum-severity SonicWall SMA1000 SSRF was exploited as a zero-day three weeks before its July patch. Volexity's UTA0533, a separate credential-harvesting operator, and an INC Ransomware affiliate all piled on — one ran Impacket secretsdump from the appliance to DCSync seven domain controllers.

A hardcoded Cloudflare API key let attackers rewrite Brevo's web pages and the JavaScript widgets 100,000+ customer sites embed, serving a fake-CAPTCHA "ClickFix" clipboard-hijack lure and a password-bypassing WordPress backdoor for over five hours on September 14, 2026.

ESET Research documents SparroWocky, a new C++ backdoor from the China-aligned FamousSparrow APT that has almost exclusively targeted Latin American government organizations since mid-2025 — including an entity directly involved in Panama's contested port concession dispute.

Zimperium disclosed RatHat, an Android banking trojan that sends a live map of the victim's screen to a generative AI assistant to navigate the device, abuses Wireless Debugging for shell access, and reinstalls itself after removal — attributed to likely China-based operators.

A joint NCSC/FBI/AIVD advisory published September 15, 2026 details HEAVYGRAM (CHOSEN BRICK), a Telegram-controlled Windows backdoor Iran's MOIS-linked Handala Hack uses to surveil dissidents and journalists — the same actor behind the Stryker wiper attack and DOJ domain seizures.

CVE-2023-46805 and CVE-2024-21887 gave a suspected China-nexus actor unauthenticated code execution on Ivanti VPN gateways from December 2023. Disclosure turned it into 2,100 compromised appliances in a week, a bypassed mitigation and CISA's order to unplug every federal device.

A Russian national extradited from Cyprus faces trial over a 2016–17 campaign that used 225 fake accounts on a Santa Clara freelance platform to send Excel macros dropping the TeamViewer-abusing TVRAT. The unsealed indictment gives numbers the press release rounded away.

On 31 August 2026 investigators cut a 23-year-old peer-to-peer botnet off from its operator by poisoning the peer lists of its own bots. The protocol they exploited had been documented publicly since 2011 and could never be patched.

The malicious release carried valid SLSA provenance and passed every integrity check, because the honest build pipeline compiled source that was already poisoned. It also ran when a developer merely opened the folder.