Welcome to Security Signals
Late October 2026 Cyber Threat Reports
Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activity, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.
For more articles, check out our #onpatrol4malware blog.
Our Latest Blog Post
September 2026 Edition
Key stats from real-world telemetry and live attack observations over the past month – a concise look at what we’re seeing across malware, phishing, ransomware, C2s, and domain abuse.
Insights (TL;DR)
To help maximize your time, we provide this insights section to summarize the most common attacker behaviors, techniques, and defensive themes observed across the articles featured below.
Top ATT&CK Techniques Observed
- T1195.002 – Compromise Software Supply Chain. Tampered LiteLLM distribution artifacts added startup execution and credential theft before normal application use. See JFrog Security Research.
- T1566.002 – Spearphishing Link. Fake preview invitations linked recipients through several gates to impersonated sign-in pages. See Cofense.
- T1053.005 – Scheduled Task. BITTER’s shortcut-led chain created recurring tasks to execute scripts and maintain contact with its server. See FortiGuard Labs.
- T1098.001 – Additional Cloud Credentials. Microsoft observed application credential changes used for persistence in affected cloud environments. See Microsoft Threat Intelligence.
What Matters Most
- Trusted applications can provide a privileged path into the business. ConnectWise-related application abuse and unauthorized MDM enrollment show why application identities, management tenants, and endpoint actions need to be investigated together. See Microsoft Threat Intelligence and Huntress.
- Account recovery needs to remove the attacker’s persistence. Huntress found session replay alongside new devices and altered MFA methods; resetting a password alone leaves other access paths to investigate. See Huntress.
- Developer workstations remain a route to secrets and downstream systems. LiteLLM and the tampered Cursor extension demonstrate risks in package startup behavior and extension distribution. Verify the source and affected artifact before assigning incident scope. See JFrog Security Research and Microsoft Threat Intelligence.
- Attempt counts do not establish compromise. AWS, Wiz, and Cato report different PHP2Shell observations from different environments. Their findings should guide targeted checks without being combined into a single global success rate. See Amazon Threat Intelligence, Wiz Research, and Cato CTRL.
What Defenders Should Watch
- Unexpected application credentials, service-principal sign-ins, new Entra devices, and changes to MFA methods. See Microsoft Threat Intelligence, Huntress.
- Unapproved MDM enrollment followed by RMM deployment, unfamiliar relays, or remote-access software that reappears after removal. See Huntress.
- External Teams chats impersonating support staff, especially requests to launch Quick Assist or install remote-access tools. See Arctic Wolf Labs, Microsoft Threat Intelligence.
- New DNS records beneath trusted domains and checkout scripts loading unfamiliar hosts. Inspect the records or code as well as blocking the delivery destination. See Infoblox Threat Intel, Sansec, Sansec.
- Developer endpoints with affected package or extension versions, unexpected SSH keys, reverse tunnels, or startup hooks. See JFrog Security Research, Microsoft Threat Intelligence.
- Suspicious task creation, browser-data collection, and short-lived malware that attempts to erase itself after collection. See FortiGuard Labs, ESET Research.
Articles
Our Late October 2026 Cyber Threat Reports highlight research into Microsoft 365 account abuse, software supply-chain compromises, phishing, ransomware, and malicious infrastructure.
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
(Published: 10/21/2026)
A sponsored search result for Amazon Business leads to a spoofed sign-in page and a fake CAPTCHA. Huntress traces abuse of the Windows finger utility through a layered delivery chain that includes NetSupport remote access and Lumma-related stealing activity. Read more.
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
(Published: 10/21/2026)
Group-IB and NyxLab investigate k0t’s exploitation of FortiGate, FortiWeb, and Palo Alto GlobalProtect devices. Recovered tooling and infrastructure reveal credential harvesting, persistent access, and data theft across network-edge systems. Read more.
LiteLLM Hijacked Again: Malicious 1.107.0 Wheels Steal Credentials and Load Remote Code
(Published: 10/21/2026)
JFrog analyzes malicious LiteLLM wheels and affected Docker images containing credential theft and an hourly remote-code channel. Python startup hooks let the payload execute even when an application never imports LiteLLM, expanding the exposure beyond direct use of the library. Read more.
The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operation
(Published: 10/21/2026)
Acronis examines The Gentlemen’s affiliate network, cross-platform ransomware, and tools for disabling endpoint protection. The report includes infrastructure findings and an incident involving vulnerable drivers used to terminate security processes. Read more.
Operation FlashHole: Lazarus breaks security, defies control
(Published: 10/21/2026)
Kaspersky investigates a Lazarus campaign combining tailored spearphishing, watering-hole delivery, and abuse of South Korean security software. The research reconstructs an updated malware chain affecting organizations in software, construction, and communications-equipment manufacturing. Read more.
Inside Brazil’s Financial Malware Ecosystem: Eternidade Stealer
(Published: 10/21/2026)
This technical analysis follows Eternidade Stealer from an MSI installer through persistence and memory-based payload execution. It examines embedded components, decoding, and injection behavior within active Brazilian financial-malware campaigns. Read more.
Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks
(Published: 10/21/2026)
Symantec examines an offensive agent that abuses exposed language-model services to power scanning and intrusion workflows. The research describes credential and database theft objectives and cryptocurrency mining, with compute costs borne by the owners of the hijacked models. Read more.
Eight Compromised eMudhra CA Keys: What Happened and What Organizations Should Do Now
(Published: 10/21/2026)
TrendAI examines weak eMudhra intermediate CA keys and the resulting certificate-trust risks. The report separates potential signing abuse from eMudhra’s statement that the affected intermediates issued no certificates, and covers subsequent trust-store changes. Read more.
Recent AI-Assisted Cyber Attacks in Japan: Investigating Attack Infrastructure and Techniques
(Published: 10/21/2026)
JPCERT/CC investigates servers used in unauthorized-access incidents affecting Japanese organizations and services abroad. Recovered infrastructure shows API-based attacks and automated vulnerability scanning, helping connect individual incidents to broader offensive activity. Read more.
Looking for a Language [Guest Diary]
(Published: 10/21/2026)
This hunting walkthrough uses Kibana Discover and DShield honeypot records to examine language preferences in web traffic. It demonstrates how an unusual request characteristic can narrow a large dataset into activity worth investigating. Read more.
Two critical RCEs in PHP core
(Published: 10/21/2026)
Talos explains PHP2Shell, two unauthenticated PHP runtime flaws that can be reached before application code executes. The report describes affected request-processing paths, mitigation limitations, and a subsequent update documenting exploitation attempts. Read more.
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
(Published: 10/21/2026)
Microsoft attributes ConnectWise application abuse to Storm-0940 and describes downstream Microsoft 365 activity involving previously trusted application credentials. Its investigation records Graph reconnaissance and persistence changes, while warning that successful authentication alone does not prove data theft. Read more.
“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities
(Published: 10/21/2026)
Unit 42 examines an actor’s operational environment and conversations with jailbroken assistants. The research follows their use in planning and carrying out different forms of cybercrime, including fraudulent VoIP activity, grounding its assessment in recovered operator material. Read more.
Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
(Published: 10/21/2026)
Amazon reports a PHP2Shell attempt in MadPot telemetry dated October 17, four days before public disclosure. The report distinguishes that observation from later exploit activity and leaves unresolved how the source obtained vulnerability details during the embargo. Read more.
MrHex: A New Hack and Leak Campaign Attributing Themselves to Handala
(Published: 10/21/2026)
DomainTools maps clearnet and darknet domains associated with MrHex and related personas. The investigation examines their evolution from data brokerage to politically motivated disclosure and the evidence behind claimed links to Handala. Read more.
Fake Amazon Music x YouTube deal lures creators into a Google login trap
(Published: 10/21/2026)
Malwarebytes investigates fake Amazon Music partnership offers that display real YouTube channel statistics. The invented creator portal turns channel verification into Google credential phishing, putting both the account and associated channel access at risk. Read more.
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
(Published: 10/22/2026)
Kaspersky examines BlackX, a BlackLotus-related UEFI bootkit used against diplomatic organizations in Central Asia. The investigation covers installation after administrator access, second-stage payloads, and evidence connecting the campaign to APT41. Read more.
SEO Poisoning Campaign Delivers New Armorsteal Malware
(Published: 10/22/2026)
Zscaler traces fake Chocolatey and Microsoft Activation Scripts sites delivering malicious installation commands. The resulting Python-based Armorsteal components provide remote access, surveillance, clipboard manipulation, and theft of browser data, wallets, and SSH keys. Read more.
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
(Published: 10/22/2026)
Huntress documents stolen-session replay across 79 organizations, including rogue Entra devices, altered MFA methods, and inbox rules. The investigation explains why containment must address sessions, devices, and authentication changes alongside password resets. Read more.
Ormino: OpenJPEG vulnerable-source lineage in Pillow wheels and current vendored repositories
(Published: 10/23/2026)
This investigation traces vulnerable OpenJPEG source into Pillow’s build inputs and identifies the library inside Linux wheels. It distinguishes source matches and embedded-library evidence from proof of the exact compiled revision or end-to-end exploitability. Read more.
The effort of staying online
(Published: 10/23/2026)
Qurium publishes an operational account of its response to a critical PHP incident affecting hosted media organizations. The report documents its remediation timeline and monitoring observations, offering a view of emergency patching from the hosting operator’s side. Read more.
deepveindrilling.com: Magento CMS block loader hits 953 stores
(Published: 10/24/2026)
Sansec tracks a long-running campaign placing JavaScript loaders in Magento CMS blocks. Its latest domain appeared on 83 stores, many previously compromised; the loader screens visitors and can preserve malicious code beyond an individual delivery domain’s lifetime. Read more.
Inside an Exposed ARTEX Workspace
(Published: 10/24/2026)
ThreatMon reconstructs JNDI testing from an exposed ARTEX operator workspace containing code, callback tools, and logs. The report distinguishes the platform’s claimed confirmed findings from the execution evidence actually present in its retest records. Read more.
language-pack-sol: The Solidity Pack That Ships Its Own Backdoor
(Published: 10/25/2026)
A counterfeit Solidity language pack installs a nested extension under a trusted-looking publisher identity. The analysis follows hidden packaging and a blockchain-based C2 lookup that lets the operator change its server without publishing another extension build. Read more.
Eight VS Code Extensions, One RAT Engine: Inside the Task-Board Backdoor
(Published: 10/25/2026)
Eight extensions presented as task boards, dashboards, or a Roblox MCP bridge share a hidden remote-access engine. The client registers workspace information, polls for commands, and can execute JavaScript or shell commands with the developer’s access. Read more.
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
(Published: 10/25/2026)
Wiz tracks an automated campaign that uses stolen GitHub tokens to plant workflows designed to print repository secrets into logs. The attacker retrieves and deletes those runs, while GitHub security changes disrupt parts of the operation. Read more.
Silent Ransom Group – Leak Analysis
(Published: 10/26/2026)
Ransom-ISAC examines leaked operational records attributed to Silent Ransom Group, also known as Luna Moth. The analysis documents voice phishing, AnyDesk access, and manual data theft, while separating supported observations from unverified plans and operator claims. Read more.
Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm Publisher
(Published: 10/26/2026)
JFrog identifies execution hooks across 42 third-party GitHub repositories tied to the testmetest campaign. The report adds native-addon camouflage, encrypted payload storage, and developer-tool hooks to the campaign’s documented publishing and data-collection methods. Read more.
Notorious Brazilian Magecart group hijacks Convertr checkouts via outdated Plausible install
(Published: 10/26/2026)
Sansec traces a payment-card skimmer inserted into Convertr’s analytics script through an outdated Plausible installation. Checkout pages transmitted card information and Brazilian CPF identifiers; a subsequent update confirms removal of the skimmer and a patched analytics installation. Read more.
The Silent Autocomplete: Lolpaon.umltocode Hides Where Your Code Goes
(Published: 10/26/2026)
A UML-to-code extension also registers an enabled-by-default completion provider that transmits source context, file paths, diagnostics, and other workspace material. Yeeth Security documents concealed endpoints and disabled certificate validation in that data channel. Read more.
Borrowed Reputation: Domain Shadowing and Gambling SEO
(Published: 10/26/2026)
Infoblox investigates unauthorized DNS records beneath institutional domains used to serve gambling doorway pages. Two operations show how attackers borrow trusted namespaces while leaving the primary website intact, creating activity that ordinary website checks can miss. Read more.
AI, Scripts, Operator: Inside the ConnectWise Attack
(Published: 10/26/2026)
Huntress compares its ConnectWise-related telemetry with Microsoft’s ARTEX assessment. Its investigation separates operator actions, scripts, and claims about automation, and identifies detection opportunities without treating activity speed alone as proof of model involvement. Read more.
Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access
(Published: 10/26/2026)
Arctic Wolf analyzes more than 400 incidents involving Teams external chats used for impersonation or malicious file delivery. Reused tenants, support-style display names, remote-access tools, and payload domains reveal repeatable patterns for investigation. Read more.
Locked and Loaded: Phishing through Fake Bids and Protected Documents
(Published: 10/27/2026)
Cofense follows a credential-phishing campaign built around an invitation to bid and a password-protected PDF. The lure combines sales urgency with encrypted content that complicates automated inspection, directing recipients toward the attacker’s credential collection flow. Read more.
Fake court ADR phishing campaign distributes LodaRAT
(Published: 10/27/2026)
ThreatDown investigates personalized messages impersonating a Florida federal court and claiming an Alternative Dispute Resolution requirement. The campaign uses unique case identifiers to draw companies into a delivery chain for LodaRAT. Read more.
Camera Management Software Compromise Leads to Malware Deployment
(Published: 10/27/2026)
Huntress follows incidents apparently originating in compromised camera-management software. Attackers drop a remote-access component, sideload DLLs through WpcMon.exe, and establish persistence; the exact initial compromise mechanism and vendor relationship remain uncertain. Read more.
RATatouille: Today’s Special: Impersonating Companies in Korea, Payments in Cryptocurrency
(Published: 10/27/2026)
AhnLab finds corporate impersonation sites while pivoting from ValleyRAT-related infrastructure. The sites offer account and cryptocurrency features, but the report explicitly stops short of confirming shared operators or proving that observed wallet funds came from fraud. Read more.
PHP2Shell: Exploitation Attempts and Remediation Trends
(Published: 10/27/2026)
Wiz reviews PHP2Shell attempts seen after disclosure and changes in exposed deployments. The report distinguishes unsuccessful activity in its telemetry from privately demonstrated working exploits, emphasizing that attempts and confirmed compromises require different evidence. Read more.
Omegatech Is Disrupted, and the Pressure on Bulletproof Hosting Keeps Building
(Published: 10/27/2026)
Silent Push examines the seizure of Virtualine and broader disruption of bulletproof hosting networks. Its analysis discusses how providers move between network identifiers and front companies, explaining why infrastructure disappearance does not always mean an operation has ended. Read more.
SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises
(Published: 10/27/2026)
ANY.RUN analyzes SkyW4lker, a phishing kit abusing Microsoft’s device-code authorization process. The report examines how an apparently legitimate authentication step can give attackers access to corporate Microsoft 365 resources without capturing a password. Read more.
Managed for Malice: How Attackers Turn MDM into Remote Access
(Published: 10/28/2026)
Huntress investigates social engineering that enrolls endpoints into attacker-controlled Hexnode or Rippling management environments. Unauthorized MDM access lets attackers deploy ScreenConnect again after removal, making the enrollment and management tenant part of the containment problem. Read more.
Inside “MR ROBOT” – Anatomy of a Malware-as-a-Service Operation Targeting Indian Bank Customers
(Published: 10/28/2026)
CloudSEK examines an Android crimeware rental operation with an APK builder, affiliate panel, and banking impersonation lures. Its trojans intercept messages and OTPs, collect financial details, and enable call forwarding; one tracked affiliate exposed 5,407 messages from 153 devices. Read more.
False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps
(Published: 10/28/2026)
Group-IB analyzes seven Android trojan families used against Indian banking customers. The report examines their infection chains, credential-stealing capabilities, and supporting infrastructure, connecting multiple forms of mobile fraud within the CyberDakait investigation. Read more.
Four Ways a Repo Runs Code: The Capacitor ‘Auth Error’ Loader
(Published: 10/28/2026)
A malicious Capacitor configuration fetches and evaluates remote code while presenting failures as authentication errors. Yeeth Security reconstructs its reintroduction through a misleading repository commit and explains execution paths that do not depend on a published package release. Read more.
Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion
(Published: 10/28/2026)
Acronis examines Qilin’s affiliate relationships, victim targeting, and ransomware capabilities across enterprise environments. The analysis covers virtual infrastructure attacks and the role of phishing, stolen credentials, vulnerable services, and remote-management tools in gaining access. Read more.
Malaysian WhatsApp Phishing Wave Delivers Overlord Malware
(Published: 10/28/2026)
A WhatsApp lure delivers a ZIP containing a genuine Microsoft-signed executable and a malicious DLL. NetbyteSEC follows DLL sideloading, RuntimeBroker process hollowing, telemetry interference, and delivery of an Overlord remote-control agent. Read more.
CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE
(Published: 10/28/2026)
ThreatLabz examines a Brotli decoder out-of-bounds write and its implications for software processing attacker-controlled compressed data. Its deception telemetry records reconnaissance and exploitation attempts, with guidance to evaluate affected components and patch their dependencies. Read more.
MadApe: The Code That Opens the Door
(Published: 10/29/2026)
Group-IB documents MadApe, a Microsoft device-code phishing kit using business-themed PDFs and fake document-sharing pages. The research connects its redirect infrastructure and authentication lures, showing how victims can authorize access through a legitimate Microsoft sign-in flow. Read more.
Inside Coruna and DarkSword Chains: From Web Lures to iOS Exploitation
(Published: 10/29/2026)
Zimperium maps 608 domains serving Coruna-family exploit code and examines how recovered sites select different chains by iOS version. The analysis covers profiling scripts, exploit delivery, and native payloads across malicious and compromised websites. Read more.
NIK C2: The new AI-enabled command-and-control framework
(Published: 10/29/2026)
Talos analyzes a Windows implant with encrypted WebSocket communications, HTTP fallback, and multiple C2 configuration tiers. NIK combines remote control and credential theft with a command that sends prompts to the OpenAI API through the infected host. Read more.
Kairos Hold’em: Dissecting a New Go-Based DDoS Botnet
(Published: 10/29/2026)
Nozomi analyzes a Go-based Linux botnet observed entering devices through Telnet with an empty root password. Kairos opens large numbers of TCP connections and sends minimal keepalive traffic to exhaust a target service’s connection capacity. Read more.
The Ultra Trail: From Viewer to Mailer
(Published: 10/29/2026)
Infoblox connects a support scam to abuse of UltraViewer, UltraMailer, and more than 350 QuickBooks-lookalike domains. It also finds trojanized installers, while explicitly reporting no evidence that the legitimate application developers participated in the scams. Read more.
Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia
(Published: 10/29/2026)
Kaspersky analyzes a XAML-based .NET loading framework discovered in a CAB archive on government-customized Windows systems. The chain uses legitimate and signed components; the researchers describe a suspected supply-chain path while leaving delivery and actor attribution unresolved. Read more.
From Webshell to Proxy Exit: Inside an Exposed AhsayCBS Operation
(Published: 10/29/2026)
Recovered workspace records show an operator probing AhsayCBS webshells and attempting to deploy Chisel and GOST tunnels. ThreatMon separates responding endpoints and reported proxy checks from independently confirmed victim counts. Read more.
Would Your Employees Join a Fake Anthropic AI Preview?
(Published: 10/29/2026)
Cofense follows fake private-preview invitations through abused GoTo Webinar messages, shortened links, and CAPTCHA gates. The chain impersonates meeting and sign-in services; the observed Microsoft page captures passwords, while the analyzed Google page collects usernames only. Read more.
Threat Researcher’s Notebook: How Attackers Redirect Crypto Payments
(Published: 10/30/2026)
ReversingLabs examines Efimer and AnimateClipper, malware that substitutes attacker-controlled cryptocurrency addresses for copied payment destinations. The analysis explains their clipboard theft behavior and provides infrastructure and sample indicators for investigation. Read more.
Earliest Known PolinRider Malware Found in 2025 npm Packages
(Published: 10/30/2026)
Analysis of nine packages published through a hijacked npm maintainer account places PolinRider-related payloads in May 2025. The recovered packages contain remote-access and stealing components, extending the documented campaign history beyond its previously known 2026 activity. Read more.
Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
(Published: 10/30/2026)
Microsoft analyzes tampered Claude Code-branded packages served through Cursor’s marketplace. The injected JavaScript attempts to add SSH keys, establish reverse tunnels, and persist on developer systems; Microsoft’s marketplace and the official npm distribution were unaffected. Read more.
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
(Published: 10/30/2026)
Microsoft reconstructs two intrusions starting with Teams help-desk impersonation and remote access through Quick Assist. The paths diverge into certificate-template abuse and NTLM relay against AD CS, showing how a support pretext can lead to privileged authentication. Read more.
Cato CTRL Threat Research: PHP2Shell Exploitation Attempts in the Wild, and How Cato IPS Blocked Them
(Published: 10/30/2026)
Cato analyzes a sample of inspected traffic from October 17–26, separating PHP2Shell execution attempts from scanning and invalid proofs of concept. Activity appeared on patch day in its sample; the report describes blocked attempts rather than confirmed compromises. Read more.
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
(Published: 10/31/2026)
Talos analyzes VOLTA, a Windows stealer that assembles stolen credentials, sessions, and personal context into a victim profile. An optional model integration ranks assets for monetization and uses fallback models when a request is refused. Read more.
From Business Emails to XLoader: An Order Lure That Led to In-Memory Injection
(Published: 11/1/2026)
Business-themed order and payment emails deliver archives containing obfuscated JScript. Morphisec follows an embedded LuaJIT interpreter and Lua loader through to XLoader execution and shared-section injection into another process. Read more.
BITTER Expands Its Arsenal with PapRAT
(Published: 11/2/2026)
FortiGuard Labs traces three BITTER infection chains targeting South Asian organizations. Malicious shortcuts, virtual disk images, and WebDAV links deliver PapRAT, whose C++ and Rust variants support remote commands, file transfers, and surveillance. Read more.
EByte Ransomware: Prince Code Behind a New Locker
(Published: 11/2/2026)
Source-code analysis links EByte’s encryption and file-walking routines to Prince ransomware. The report explains why encrypting only every third byte still prevents straightforward recovery, and why a matching decryptor or builder artifacts offer stronger recovery leads than the encryptor alone. Read more.
Shutting the Door on the XCPE Botnet
(Published: 11/2/2026)
Google describes the disruption of XCPE, a backdoor installed on more than 1.3 million Android set-top boxes. Google attributes the operation to manufacturer Videostrong and details how affiliates used infected devices for advertising fraud, residential proxies, and additional malware. Read more.
The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources
(Published: 11/2/2026)
Google investigates theft and resale of access to enterprise model resources. The report describes exposed endpoints, stolen cloud credentials, and illicit routing gateways that aggregate unauthorized access, connecting initial compromise with downstream monetization. Read more.
3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop
(Published: 11/3/2026)
Bitdefender investigates a 3AM affiliate’s intrusion into a UK school environment and movement between domains using ordinary Windows tools. It assesses a mixture of human operation and agent-like retries, while explicitly acknowledging that the model and operator interaction could not be established. Read more.
Gorbag: Orcs at the border harvesting intelligence from Ukraine
(Published: 11/3/2026)
ESET profiles Gorbag, a Russia-aligned actor targeting Ukrainian organizations with spearphishing and short-lived data collection. The report covers Prime ReverseShell, BeautyStealer, and exploitation of a WinRAR path-traversal flaw in its updated delivery chain. Read more.
Want more articles? Check out the previous edition of Security Signals here.
Free Evaluation
Gain a comprehensive view of the external cyber landscape with Malware Patrol’s Cyber Threat Intelligence (CTI) services. We cover a broad spectrum of malicious activities, including malware, ransomware, phishing, cryptominers, newly registered domains, and command-and-control servers to equip your organization with the insights needed to proactively detect and mitigate potential attacks.
Take advantage of a free trial to test our data for yourself.