T1543.003 - Windows Service

FamousSparrow Deploys SparroWocky Backdoor in Latin America

Chinese APT Campaign Targets Asia-Pacific with FDMTP Backdoor

Showboat Malware Targets Telecoms in China-Aligned Cyber Espionage Campaign

UAT-10147 Cybercrime Group Integrates AI for Large-Scale Attacks

LiteLLM Supply Chain Attack Exposes Critical Credentials

Active Exploitation of N-able N-central Authentication Bypass Vulnerability

Localized Phishing Campaign Targets Cambodian Organizations with Multi-Stage Malware

Critical AhsayCBS Vulnerabilities Exploited for RCE and Crypto Mining

Critical Path Traversal Vulnerability in GopeedLab Affects Archive Extraction

Discovery of Fast16 Malware: Precursor to Stuxnet Targeting Iranian Nuclear Program

GoSerpent Backdoor Steals Sensitive Data from Southeast Asian Governments

LiteLLM Python Package Compromised in Major Supply Chain Attack by TeamPCP

Gentlemen Ransomware Uses Advanced Techniques for Network Attacks

Urgent Phishing Campaign Targets Corporate Tax Personnel in South Korea

INJ3CTOR3 Targets FreePBX Systems with JOMANGY Webshell and VoIP Toll Fraud

Kaspersky Discovers Supply Chain Attack on Daemon Tools Website

XCSSET Malware Evolves with Enhanced Obfuscation and Persistence Techniques

GoodPersonRAT Malware Distributed via Fake LetsVPN Installer

Phishing Campaign Exploits MSP360 and ScreenConnect for Remote Access

Hola Browser Compromised to Deliver Cryptominer via Supply Chain Attack

WhatsApp Malware Delivers VulcanRAT207.A with SYSTEM-Level Access

SleeperGem: Malicious RubyGems Package Targets Developer Environments

Multiple CVEs Discovered in NVIDIA Megatron and Other Products

Critical RCE Vulnerability in BeyondTrust Software Requires Immediate Patching

Malware Distribution via Fake Video Player Updates on Pirated Streaming Sites

NightSpire Ransomware Exploits RDP for Widespread Attacks

BYOVD Technique Enables Attackers to Disable Security Tools

Cargo Theft Actor Exploits Load Boards for Extended Operations

Toy Ghouls Use HiveMQ and Element for New Windows Backdoors

Gentlemen RaaS Leak Exposes 10% of 2026's Ransomware Victims

Phishing Attacks Utilize Browser-in-the-Browser Technique with Rogue RMM Tools

Chinese-Speaking Groups Exploit BadIIS for SEO Manipulation in Asia

Logitech Options+ Flaw Enables SYSTEM Privilege Escalation

Akira Ransomware Uses Safe Mode to Evade EDR Detection

Vulnerabilities in Vibe-Coded Applications Highlighted

Attackers Exploit Vulnerable Windows Driver to Disable EDR Tools

New Windows Malware Uses Everyday Apps to Compromise Systems

Prometei Botnet Targets Windows Servers for Remote Access and Malware Deployment

China Arrests 67 Members of Silver Fox Cybercrime Group

Foxveil Malware Loader Exploits Discord, Cloudflare, and Netlify for Payload Staging

Arsink Malware Targets Android Users, Stealing Private Data

New Exploits Released: SploitScan and GitDorker Tools

ATT&CK v19 Release Introduces Major Changes in Defense Evasion Tactics

RecoverIt Tool Exploits Windows Service Recovery for Malicious Payload Execution

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain

Hackers Use ERP Web Shell and IDOR Flaws to Breach Major South Korean Churches

Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks

Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks

Attackers Abuse MSP360 to Deploy ScreenConnect in Dual

Weekly Intelligence Report - 25 Sep 2026

The August 2026 Security Update Review

SploitScan exploit

Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors

CVE Alert: CVE-2026-93992 – GopeedLab

Beware Sparrowock Backdoor Bites Commands Catch

Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

Isolation

121344

ESET Research: China-aligned FamousSparrow expands

New SparroWocky backdoor deployed in attacks on governments

Chinese hackers use SparroWocky malware in govt espionage attacks

Logitech Options+ vulnerability allows SYSTEM-level privilege escalation | brief

117062

Orion Policy Institute

Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence

September 2025

CVE-2023

Kaspersky Operation SyncHole

Angry Birds: Toy Ghouls’ new toys

Node.js: Old Technique Makes a Comeback

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Financially Motivated Threat Actor Breeze Comet Targets Brazil

New Ploutus Variant

Chinese Fire Ant hackers turn Cisco routers into spying platforms

Suspected China-linked espionage campaign targets India's finance ecosystem: Seqrite

Seqrite Uncovers China-Linked Cyber Espionage Campaign Targeting India's Tax Ecosystem

Zbt Darklantern Speakingstone

Cambodia-focused cluster uses multistage infection chain with localized lures

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive

UAT-10147 deploys SPECTRE: A cross

Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware

Evasive Attacker Leverages Solarwinds Supply Chain Compromises With Sunburst Backdoor

Earth Preta Updated Stealthy Strategies

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel