Verticals Targeted: Water, Telecommunications, Government, Education
Regions Targeted: Europe, Africa, Latin America
Related Families: Warlock
Related Threat Actors: Longlegs
Verticals Targeted: Critical Infrastructure, Defense
Regions Targeted: United States
Related Threat Actors: Volt Typhoon, QTFY, CyberAv3ngers, FSB Center 16, GRU Unit 29155, Cyber Army of Russia Reborn, NoName057(16), Z-Pentest, Sector16
Executive Summary
US critical infrastructure faces an increasingly consequential operational technology (OT) threat as state-sponsored and other cyber actors conduct activity ranging from long-term pre-positioning in critical infrastructure networks to direct exploitation of programmable logic controllers (PLCs) capable of affecting physical processes. Of particular national-security concern, military installations depend on civilian electricity, water, telecommunications, transportation, fuel, manufacturing, and logistics infrastructure located outside Department of War networks and installation boundaries. Disruption of these systems could therefore create military effects without direct compromise of a military installation.
Executive Summary
Cisco Talos has identified CLOSEDQUORUM, a Windows malware implant that delegates tactical command-and-control (C2) decisions to a panel of commercial large language models (LLMs), allowing portions of an intrusion to operate without continued human direction or a traditional attacker-controlled C2 server. The malware can query up to four LLM providers, including DeepSeek, Qwen, Mistral, and Google Gemini, to select among predefined malicious actions including credential theft, process injection, and persistence, while reporting decisions and stolen data through Discord. Although Talos has not confirmed CLOSEDQUORUM's deployment in the wild and the publicly distributed build is nonfunctional, the malware demonstrates how threat actors can use existing AI services to automate bounded portions of the attack chain and reduce their dependence on human operators.
Verticals Targeted: Health, Government, Telecommunications, Justice, Maritime Transportation
Regions Targeted: Guatemala, Honduras, Puerto Rico, Panama, Venezuela, Ecuador, Peru, Argentina
Related Threat Actors: FamousSparrow
Related Families: SparroWocky
Related Threat Actors: GTG-10007, Charcoal Typhoon, Salmon Typhoon, SweetSpecter, Keyhole Panda, Vixen Panda, APT41, Ravine Castle
Verticals Targeted: Aerospace, Defense, Government, Financial, Manufacturing, Mining & Natural Resources, Nonprofit/NGO, Professional Services, Commodity Trading
Regions Targeted: US, Asia
Related Threat Actors: TA412 (Violet Typhoon), UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket
Related Families: BlueMoon, GemStone, ShadowPad
Executive Summary
Four espionage-focused threat actors were observed using BlueMoon, a newly tracked exploit kit chaining two Chromium V8 vulnerabilities with a Windows kernel privilege-escalation flaw. First observed in late August 2026, BlueMoon spread rapidly among mostly China-aligned clusters targeting organizations across the United States and Asia. Campaigns delivered payloads including GemStone and ShadowPad. Researchers also identified artifacts consistent with possible AI-assisted development, although evidence remains inconclusive. Proofpoint warns the kit may proliferate further as attackers increasingly exploit open-source patch gaps before downstream security updates reach users.
Verticals Targeted: Gamers
Regions Targeted: Eastern Europe
Related Families: Chaos, Mercurial Grabber, DCRAT, NJRAT