Arkanix Stealer pops up as short-lived AI info-stealer experiment

Arkanix Stealer, an information‑stealing operation promoted on dark web forums in late 2025, offered modular Python and premium C++ builds with VMProtect and extensive data‑theft capabilities across browsers, wallets, messengers, and gaming platforms. Kaspersky researchers found indicators of LLM‑assisted development, a short‑lived Discord community and referral program, and published IoCs while the operator abruptly took down the project two months after launch. #ArkanixStealer #Kaspersky

Read More
Arkanix Stealer: a C++ & Python infostealer

In October 2025 researchers discovered forum posts advertising a previously unknown MaaS called “Arkanix Stealer” offering both native C++ and Python implants, a configurable control panel, and payload generation. The malware harvested browser credentials, cryptocurrency wallets (using an embedded ChromElevator injector), system and application data, communicated with C2 endpoints on arkanix[.]pw, and the affiliate program and panel were subsequently taken down. #ArkanixStealer #ChromElevator

Read More
VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)

CVE-2026-1731 is a critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support’s thin-scc-wrapper WebSocket handler that Unit 42 has observed being actively exploited to deploy web shells, backdoors (including SparkRAT and VShell), create accounts, move laterally, and exfiltrate data across multiple sectors and countries. CISA added the vulnerability to its…

Read More
Cyber Insights 2026: The Ongoing Fight to Secure Industrial Control Systems

Industrial Control Systems (ICS) remain highly vulnerable because decades‑old hardware, outdated protocols, and operators’ inability to accept downtime prevent effective patching and replacement amid growing nation‑state pre‑positioning and ransomware pressure. To build long‑term resilience in 2026, experts recommend OT‑aware zero trust, identity‑centric controls, microsegmentation, continuous threat exposure management (CTEM), supply‑chain transparency,…

Read More
DotNetToJScript: Execute CSharp from JScript

Attackers can bypass application whitelisting and executable restrictions by converting managed .NET assemblies into JScript loaders that execute in memory via Windows Script Host. The technique demonstrated uses DotNetToJScript to run x64 Meterpreter shellcode over HTTPS, blending into trusted components and evading binary-focused defenses. #DotNetToJScript #Meterpreter

Read More
China-Linked DKnife AitM Framework Targets Routers for Traffic Hijacking, Malware Delivery

Researchers uncovered DKnife, a Linux-based gateway-monitoring and adversary-in-the-middle framework used by China-nexus actors since at least 2019 to perform deep packet inspection, manipulate traffic, and deliver malware via compromised routers and edge devices. The modular toolkit hijacks binary and Android update downloads to deploy backdoors like ShadowPad and DarkNimbus and harvests…

Read More
Organizations Urged to Replace Discontinued Edge Devices

US and UK agencies warned that discontinued edge devices — including firewalls, routers, switches, load balancers, IoT devices, and wireless access points — pose significant security risks because they no longer receive security updates. CISA’s Binding Operational Directive 26-02 requires federal agencies to inventory, update, and decommission end-of-support (EOS) edge devices…

Read More
DKnife Linux toolkit hijacks router traffic to spy, deliver malware

Researchers at Cisco Talos uncovered DKnife, an ELF-based post-compromise toolkit used since 2019 to hijack edge devices and perform deep packet inspection, traffic manipulation, and targeted malware delivery. The framework’s seven Linux components enable DNS and update hijacking, credential harvesting, and delivery of backdoors such as ShadowPad and DarkNimbus, and Talos attributes the activity to a China-nexus threat actor. #DKnife #ShadowPad

Read More
Ransomware gang uses ISPsystem VMs for stealthy payload delivery

Ransomware operators are abusing virtual machines provisioned via ISPsystem’s VMmanager to host and deliver malicious payloads at scale, hiding C2 and distribution servers among legitimate infrastructure. Sophos found identical default Windows hostnames reused across multiple criminal campaigns — including WantToCry, LockBit, Qilin, Conti, BlackCat/ALPHV, and Ursnif — enabling evasion and complicating takedowns. #WantToCry #VMmanager

Read More
CISA gives federal agencies one year to rip out end-of-life devices

CISA has ordered federal civilian agencies to remove end-of-life hardware and software from networks within 12 months after warning that unsupported edge devices are being widely exploited by sophisticated threat actors. Agencies must inventory listed devices within three months, decommission them within a year, implement continuous discovery within two years, and…

Read More
Stan Ghouls targeting Russia and Uzbekistan with NetSupport RAT

Stan Ghouls (aka Bloody Wolf) ran a targeted campaign primarily against organizations in Uzbekistan (and collateral victims in Russia, Kazakhstan, Turkey, Serbia, and Belarus) using spear-phishing PDFs that link to a Java-based loader which installs NetSupport remote management components. Investigators found roughly 50 victims in Uzbekistan, multiple new domains and a JAR/loader MD5 tied to the campaign, and discovered Mirai IoT binaries on a domain related to the threat infrastructure. #StanGhouls #NetSupport

Read More