50
30
30
30
30
30
45
30
30
30
Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware
Attackers abuse Windows VSS shadow copies to delete recovery points before ransomware and to extract NTDS.dit/SAM credentials, demanding context-aware detection.
Threat actors are weaponizing the Volume Shadow Copy Service (VSS) for two purposes: destroying local recovery points via vssadmin.exe, wmic.exe, diskshadow.exe, wbadmin.exe, and bcdedit.exe before encryption, and accessing static copies of locked files such as NTDS.dit and SAM for credential theft. Ransomware families tied to shadow-copy removal include Akira, Black Basta, BlackCat, Conti, LockBit, Qilin, RansomHub, REvil, Ryuk, and WannaCry. Huntress's analysis of the Nightmare-Eclipse tool showed the BlueHammer technique chaining a Windows Defender timing issue with a VSS snapshot to dump the SAM database and decrypt NT hashes. Defenders should correlate VSS operations with parent process, hive access, and subsequent encryption activity, and maintain immutable off-host backups.
52
30
30
30
30
30
50
35
TuxBot v3: Inside an IoT Botnet Framework With LLM
Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.
Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.
45
Kimwolf v7 Hides DDoS Traffic Behind Chrome Fingerprints and Ethereum
Unit 42 details Kimwolf v7, an Android TV botnet upgrade using HTTP/2 Chrome-fingerprint DDoS floods and Ethereum ENS-based C2 across 1.8M+ infected devices.
Palo Alto Networks Unit 42 identified Kimwolf v7 on February 3, 2026, an upgrade to an Android TV botnet active since August 2025 and linked to the AISURU botnet, which has infected over 1.8 million devices. The new version adds an HTTP/2-based DDoS flood that mimics full Chrome browser fingerprints, consolidates 43 attack commands into 15 methods covering layers 3-7, and resolves C2 addresses via Ethereum Name Service using five hard-coded public blockchain RPC endpoints, backed by a Tor hidden service and a local proxy on 127.0.0.1:23075. It spreads through residential proxies to Android TV boxes with ADB enabled on port 5555 and masquerades as netd_service. The botnet is associated with the record 31.4 Tbps DDoS attack in November 2025.
55
30
45
16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
Typosquatted RubyGems packages deliver the StubMaker infostealer, stealing browser credentials, crypto wallets, and Telegram data from Windows developers.
OpenSourceMalware discovered a typosquatting campaign on August 15, 2026, tracked as StubMaker, publishing 16 malicious RubyGems packages (e.g., ubnuler, brumdler, brundlef) that imitate popular Ruby dependencies. The gems use the extconf.rb install hook to fetch a 22 MB Rust-based loader from GitHub, which launches a Go-based stealer ("wincfg") containing a DLL that bypasses Chromium's app-bound encryption to extract browser credentials, payment cards, crypto wallets and seed phrases, and Telegram Desktop data. Stolen data is uploaded as a password-protected ZIP to Gofile, with the download link sent over plain HTTP. The same actor also deployed 37 typosquatted npm packages delivering the identical loader and infostealer, and abused RubyGems' namespace reuse to republish malicious versions of yanked gems.
55
35
35
30
45
Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement
Zscaler discovered SloppyRAT, a ClickFix-delivered RAT that gives ransomware operators reconnaissance, remote execution, and SOCKS proxy pivoting for lateral movement.
Zscaler identified SloppyRAT in June 2026, linked to a ransomware-related threat actor. The infection chain starts with a ClickFix lure abusing finger.exe over TCP port 79, then uses curl.exe, IronPython, CastleLoader, and CastleRAT before reflectively loading SloppyRAT as a DLL in memory. The RAT supports HTTPS command-and-control, system inventory, file operations, Defender tampering, and a reverse SOCKS proxy, with evasion features including runtime code encryption, indirect syscalls, certificate pinning, and a possible EtherHiding blockchain fallback. Its persistence code is buggy and the malware appears under development, but the pre-encryption foothold gives defenders a window to stop intrusions.
52
Qatar’s Digital Boom Has a Blind Spot: What the 2025-26 Threat Data Is Telling Us
Cyble's Qatar Threat Landscape Report 2025-26 finds Qilin dominated local ransomware while access brokers concentrated on Qatari BFSI and retail access sales.
Cyble's Qatar Threat Landscape Report 2025-26 describes a concentrated threat environment where Qilin accounted for essentially all observed ransomware activity in the country in 2025, including an October campaign, with The Gentleman, Everest, Crypto24, and Payload sharing the space in 2026. Access brokers are selling compromised access, with BFSI and retail accounting for more than half of underground listings, while the education sector sees the most breach and leak incidents. Exploitation activity surged for enterprise remote-access products from Microsoft, Fortinet, Ivanti, and Citrix. The report was published ahead of the CYSEC Qatar summit and cites Qatar's data privacy law and National Cyber Security Agency initiatives.
40
30
30
30
30
ChatGPT Sandbox Flaw Lets Attackers Steal Gmail Data Across Accounts via Hidden Channel
Check Point found a cross-account covert channel in ChatGPT sandboxes via shared JFrog Artifactory metadata, enabling session hijacking and Gmail data theft. Now fixed.
Check Point discovered that ChatGPT code-execution containers across different accounts could all reach the same internal JFrog Artifactory instance, whose Item Properties API was readable and writable by all accounts, creating a covert cross-account communication channel. Attackers could plant hidden instructions via pasted prompts, shared chat links, or custom GPTs, then trigger tasks in a victim's session to exfiltrate connected-app data such as Gmail, using ChatGPT's default 'Important actions' setting that permits reads without confirmation. OpenAI confirmed and decommissioned the shared Artifactory instance, closing the channel before publication.
74
30
45
30
50
Schneider Electric SCADAPack x70 Products
CISA advisory: Schneider Electric SCADAPack x70 RTUs contain CVE-2026-81861, an insufficiently protected credentials flaw allowing unauthorized access to RTU configuration.
CISA advisory ICSA-26-258-04 discloses CVE-2026-81861 affecting all versions of Schneider Electric SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 remote terminal units. The CWE-522 insufficiently protected credentials vulnerability could expose authentication information and permit unauthorized access to RTU configuration through the Secure Lock functionality. The flaw carries a CVSS v3.1 base score of 6.5 (medium), and the products are deployed worldwide in critical manufacturing and energy sectors. Abhinav Agarwal reported the vulnerability to CISA.
25
30