Magnitude exploit kit
60
Stately Taurus Activity in Southeast Asia Links to Bookworm Malware
Unit 42 links Stately Taurus APT activity in ASEAN region and Myanmar to the decade-old Bookworm malware family via infrastructure overlaps.
Unit 42 connected Stately Taurus (aka Mustang Panda) espionage activity targeting ASEAN-affiliated organizations and Myanmar to the Bookworm malware family, first published in 2015. Earlier attacks delivered the PubLoad stager via DLL sideloading, with a PubLoad variant communicating with C2 at 123.253.32[.]15 while mimicking Windows Update URLs. Three previously unreported loader samples from 2021-2022 used UUID-decoded shellcode loaded via heap allocation and API callbacks, ultimately decrypting and loading Bookworm DLLs. A ToneShell backdoor variant shared debug paths with Bookworm loaders, and the January 2024 CSIRT CTI post corroborated the Myanmar attacks.
65
60
Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated)
Trojanized 3CXDesktopApp installers for Windows and macOS loaded RC4-encrypted shellcode delivering a backdoor to hundreds of thousands of 3CX users.
Threat actors compromised the 3CXDesktopApp build process, adding malicious libraries (ffmpeg.dll, d3dcompiler_47.dll) to installers downloaded from the developer's website. The Windows MSI loader decrypts embedded shellcode with RC4, sleeps for a random 1-4 weeks, then beacons to C2 hidden in icon files on GitHub. Unit 42 fingerprinted 247,277 IPs across 199 countries using 3CX applications and blocked shellcode execution at 127 Cortex XDR customers between March 9-30, 2023.
72
Addressing CVE-2014
60
Tracking OceanLotus’ new Downloader, KerrDown
Unit 42 identifies KerrDown, a new OceanLotus (APT32) downloader active since 2018 targeting Vietnamese speakers via malicious macros and DLL side-loading.
Unit 42 tracks KerrDown, a previously undocumented downloader family used by OceanLotus (APT32) since at least early 2018, primarily targeting Vietnam or Vietnamese-speaking individuals. Delivery uses macro-laced Microsoft Office documents embedding base64-encoded 32-bit and 64-bit DLLs, and RAR archives containing a legitimate program abused for DLL side-loading. KerrDown is dropped as main_background.png, downloads a DES-encrypted payload from a URL, and executes it directly in memory. Researchers used Jaccard-index similarity analysis to identify the new family, connect campaign samples, and infer patterns in the group's working hours and days.
52
September 2025 CVE Landscape
60
57
57
Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools
Acronis details a Spark RAT campaign against Cambodia abusing the vulnerable OPSWAT ardrv.sys driver (CVE-2026-36425) to disable Microsoft Defender and other security tools.
Acronis TRU analyzed a multi-stage Spark RAT campaign targeting Cambodian individuals and organizations with lures spanning government notices, public health materials, and real estate documents. Attack chains use phishing emails with Inno Setup archives, DLL side-loading via a signed Tencent executable, and BYOVD abuse of the vulnerable OPSWAT ardrv.sys driver (CVE-2026-36425) to terminate security software. Shellcode hidden in PNG files patches AMSI and ETW, establishes scheduled task and service persistence, and injects into vssvc.exe and ctfmon.exe to run the open-source Go-based Spark RAT. Tactics resemble the Silver Fox actor, but Acronis tracks the cluster as unattributed with low confidence.
50
February 2026 CVE Landscape: 13 Critical Vulnerabilities Mark 43% Drop from January
60
New malicious web shell from the Tropic Trooper group is found in the Middle East
60
BlackOasis APT and new targeted attacks leveraging zero
60
60
60
60
57
60
60
Authors of Purple Fox EK adds 2 Microsoft exploits
60
60
57
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
Volexity attributes spear-phishing campaign exploiting Chrome-Windows zero-day chain to Chinese actors UTA0560 and APT31 deploying GRIMWEDGE and LONGTALE.
Volexity attributes a September 1, 2026 spear-phishing campaign targeting NGOs to China-linked UTA0560, which abused a reflected XSS flaw on a US university website to trigger a three-part exploit chain (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) escaping the Chrome V8 and browser sandboxes to deploy the GRIMWEDGE JavaScript backdoor with reconnaissance, file management, and command execution capabilities. The same chain was used near-simultaneously by JungleBamboo (APT31) to deploy SUPERSTOMP, installing the LONGTALE/GemStone credential-stealing Chrome extension masquerading as Google Gemini. The Chrome flaws were patched in Chromium but not yet in stable Chrome, creating an unusual patch-gap zero-day window attackers raced to exploit.
85
China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor
China-linked UNC3569 exploited CVE-2026-51990 in Sogou Input Method to deploy the GRAYRABBIT backdoor in active espionage intrusions.
Gen Threat Labs discovered UNC3569 exploiting CVE-2026-51990, a one-click RCE in Tencent's Sogou Input Method for Windows that chains an insecure sgbiz: protocol handler with an unsandboxed Chromium 80 CEF webview. The chain weaponizes CVE-2021-38003 (V8 type confusion) to run shellcode that DLL-sideloads via 7z.exe/7z.dll and deploys the GRAYRABBIT backdoor, which beacons over RC4-encrypted raw TCP 443 to mail.uaiubifas[.]top. Tencent patched the issue in version 16.3.0.3498, released via automatic updates on April 21, 2026. UNC3569 is a PRC-nexus espionage actor targeting government, education, technology, and financial sectors across East and Southeast Asia.
82
China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks
China-linked clusters deploy the BlueMoon kit chaining Chrome V8 CVE-2026-85046 and Windows LPE CVE-2026-85880 in espionage campaigns.
Proofpoint researchers identified BlueMoon, an exploit kit combining a V8 type-confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows kernel privilege-escalation flaw (CVE-2026-85880), first observed August 28, 2026. At least four clusters adopted it, led by TA412 (also tracked as APT31/Violet Typhoon) and followed by UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket, targeting aerospace, manufacturing, government, consulting, and financial sectors. The kit exploited a nearly four-week patch gap between the public Chromium commit (August 7) and stable rollout (September 3). TA412 delivered the GemStone Chrome extension masquerading as a Gemini companion, while other clusters deployed ShadowPad via DLL sideloading, a Rust loader, and DoH-based C2.
80
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
Cisco Talos details ClearFake WebDAV chains delivering Amatera stealer to a Ukrainian government organization, with cryptocurrency and credential theft payloads.
Cisco Talos investigated DLL executions named 'verification.google' via WebDAV UNC paths at a Ukrainian government organization, tracking the actor as UAT-10820 and assessing with moderate confidence the activity is Russian and opportunistic rather than targeted. The infection chain uses ClearFake JavaScript injected via a Cloudflare Worker, EtherHiding storage on BNB Smart Chain contracts, and a ClickFix fake Google CAPTCHA prompt to deliver Amatera stealer. Secondary payloads differ by C2: one loader deploys ZigCryptoStealer with a Go reverse TCP proxy and a vulnerable driver that kills EDR, while the other installs an unauthorized NetSupport Manager with a Russia-based C2. Similar Amatera chains were separately documented by Malwarebytes and Blackpoint Cyber, but with no shared infrastructure.
55
60
60
CISA adds Cisco ASA and FTD and CrushFTP VFS flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
Chinese-Speaking Hackers Use Noodle RAT Backdoor to Spy on Windows and Linux Systems
Chinese-speaking actors use cross-platform Noodle RAT backdoor to maintain covert access to Windows and Linux systems across Asia-Pacific.
Noodle RAT (also ANGYREBEL/Nood RAT) has been active since at least mid-2016 and was long misidentified as Gh0st RAT or Rekoobe variants until Trend Micro and Cyberint classified it as a distinct multi-platform family. The Windows build (Win.NOODLERAT) is an in-memory modular shellcode backdoor delivered via MULTIDROP and MICROLOAD loaders, while the Linux build supports reverse shells, SOCKS tunneling, and cron persistence after web shell or public-facing service exploitation. It has appeared in intrusions in Thailand, India, Japan, Malaysia, and Taiwan and is linked to Iron Tiger, Calypso APT, Rocke, and Cloud Snooper campaigns spanning espionage and cybercrime. Recently discovered Linux builders 1.0.1 and 1.0.2 indicate the toolkit remains actively maintained.
52
China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks
Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.
Volexity documented campaigns detected on September 1, 2026, in which China-linked actors UTA0560 and JungleBamboo (APT31) chained CVE-2026-85046 (V8 type confusion), CVE-2026-87491 (WebAssembly sandbox escape), and CVE-2026-85880 (Windows kernel privilege escalation in RtlpCreateServerAcl). Victims were lured via links on legitimate U.S. university sites vulnerable to reflected XSS, then served hidden exploit iframes behind a donation-form image. Although a V8 fix had landed in Chromium's source after private August reporting, Chrome had not yet shipped it, creating a patch gap the actors exploited. The two groups installed distinct payloads: UTA0560 delivered the GRIMWEDGE JScript backdoor via DLL side-loading, while JungleBamboo used the SUPERSTOMP loader to install the LONGTALE credential-stealing Chrome extension disguised as Google Gemini.
85
Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
Proofpoint links four espionage clusters, including China's APT31, using shared exploit kit BlueMoon chaining Chrome V8 and Windows ALPC zero-days.
Proofpoint reports a previously undocumented exploit kit, BlueMoon, chains Chrome V8 type confusion CVE-2026-85046 with an unassigned V8 sandbox escape and Windows ALPC heap overflow CVE-2026-85880 to achieve code execution and local privilege escalation. APT31 first used it on August 28, 2026 against US NGOs, mining, and commodity trading firms, deploying the GemStone browser backdoor disguised as a Google Gemini extension via the GhostChrome-X integrity bypass. UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket followed on September 2-3, targeting US aerospace, Vietnamese manufacturing, and Indonesian/Singaporean sectors with ShadowPad and sideloaded Rust and .NET payloads. Both V8 flaws were patch-gap zero-days, and verbose code suggests possible AI-assisted development.
82
E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands
Researchers identified two new RATs, E4del and PINHOLE, using FTP banners as dead drop resolvers to fetch C2 commands via ClickFix-style lures.
SOCRADAR documented two previously unreported RATs, E4del and PINHOLE, that use FTP banners as dead drop resolvers, a first in-the-wild use of this technique. E4del is a Node.js-based RAT hidden in a digitally signed Electron application masquerading as Discord, with tiered-jitter beaconing, reverse shell, screenshot capture and desktop streaming. PINHOLE is more advanced, using Pinterest, SurveyMonkey and Cloudflare Workers for C2 resolution, six layers of unpacking, Halo's Gate EDR evasion and Early Bird APC injection. A related WebDAV delivery chain overlaps with ClearFake campaigns distributing WordlistLoader and Amatera Stealer.
55
APT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2
Acronis links the PATCHCORD espionage campaign targeting Afghan telecom and South Asian critical infrastructure to APT36 with moderate confidence.
Acronis Threat Research Unit documented PATCHCORD, a previously undocumented C/C++ backdoor delivered via fake VPN installers impersonating Afghan Telecom (AFTEL), which hijacks Edge, Chrome and Firefox shortcuts for persistence and executes in-memory shellcode. A related Go implant, SHEETCORD, abuses the Google Sheets API for per-victim C2 and was distributed via a domain impersonating India's National Informatics Centre, while a third tool, HACKERAI C2 Agent, uses GitHub Gists and shows signs of LLM-assisted coding. An exposed staging server revealed SuperShell, RAT frameworks, credential-harvesting tools and OpenSSH exploit code, and the researchers attribute the activity to APT36/Transparent Tribe at moderate confidence.
72
60
60
60