Related Threat Actors: GTG-10007, Charcoal Typhoon, Salmon Typhoon, SweetSpecter, Keyhole Panda, Vixen Panda, APT41, Ravine Castle
Verticals Targeted: Aerospace, Defense, Government, Financial, Manufacturing, Mining & Natural Resources, Nonprofit/NGO, Professional Services, Commodity Trading
Regions Targeted: US, Asia
Related Threat Actors: TA412 (Violet Typhoon), UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket
Related Families: BlueMoon, GemStone, ShadowPad
Executive Summary
Four espionage-focused threat actors were observed using BlueMoon, a newly tracked exploit kit chaining two Chromium V8 vulnerabilities with a Windows kernel privilege-escalation flaw. First observed in late August 2026, BlueMoon spread rapidly among mostly China-aligned clusters targeting organizations across the United States and Asia. Campaigns delivered payloads including GemStone and ShadowPad. Researchers also identified artifacts consistent with possible AI-assisted development, although evidence remains inconclusive. Proofpoint warns the kit may proliferate further as attackers increasingly exploit open-source patch gaps before downstream security updates reach users.
Verticals Targeted: Gamers
Regions Targeted: Eastern Europe
Related Families: Chaos, Mercurial Grabber, DCRAT, NJRAT
Verticals Targeted: Finance, Enterprise, Government, Industrial
Regions Targeted: Brazil, Latin America, Spain, US
Related Threat Actors: Exilware
Related Families: AgenteV2, CNABHunter
Verticals Targeted: Fintech, Aviation, Aerospace
Regions Targeted: Middle East, Africa, Egypt, Ethiopia, Afghanistan
Related Families: NodeRabbit, PollCat
Verticals Targeted: Government, Diplomacy, Defense Manufacturing
Regions Targeted: Romania, Spain, Turkey, Europe
Related Malware: HEADLACE
Executive Summary
Russian state-sponsored threat group BlueDelta deployed the HOOKEDGE Windows backdoor in espionage campaigns targeting European diplomatic, government, and defense-related organizations. Delivered through macro-enabled Microsoft Word documents, HOOKEDGE uses scheduled tasks, Microsoft Edge, and legitimate webhook services for C2, payload staging, and data exfiltration. The campaigns demonstrate BlueDelta’s continued refinement of established tradecraft to evade detection, minimize infrastructure requirements, and selectively escalate activity against targets assessed as having higher intelligence value.
Executive Summary
SLEEPWALKER is a novel passive Windows backdoor. The malware is designed for DLL side-loading into the ESET Management Agent process ERAAgent.exe and does not autonomously beacon or contain fixed C2 infrastructure. Instead, SLEEPWALKER remains dormant until receiving a specially crafted network packet, then decrypts and executes attacker-supplied bytecode through a custom 23-instruction command language supporting scheduling, multiple communications mechanisms, staged payload delivery, lateral movement, and in-memory code execution.
Verticals Targeted: Government, Education, Media, Technology, Gaming
Regions Targeted: Brazil, Bolivia, China, Canada, Vietnam
Executive Summary
Cisco Talos identified an advanced intrusion ecosystem operated by UAT-10147, a Chinese-speaking, financially motivated threat actor targeting internet-facing Windows and Linux servers. The group combines exploitation of known vulnerabilities with AI-assisted offensive workflows, custom malware, open-source tools, and commodity backdoors. Central to recent activity is SPECTRE, a cross-platform backdoor providing extensive post-exploitation, credential theft, process injection, and defense evasion capabilities. On Linux systems, SPECTRE can deploy the Specter kernel rootkit, while its Windows variant incorporates Bring Your Own Vulnerable Driver (BYOVD) functionality capable of neutralizing endpoint detection and response (EDR) visibility.