The PolySwarm Blog

Verticals Targeted: Financial, Cryptocurrency
Regions Targeted: Global
Related Families: Rokarolla

Executive Summary

Researchers have identified Rokarolla, a newly discovered Android banking trojan distributed through malicious websites impersonating trusted applications such as TikTok, Google Chrome, and Google Play Protect. The malware targets at least 217 banking and cryptocurrency applications and leverages Android Accessibility Services, phishing overlays, SMS interception, keylogging, screen monitoring, and call blocking to facilitate financial fraud. Rokarolla exposes at least 137 operator commands and employs multiple persistence and evasion mechanisms, allowing attackers to maintain extensive control over infected devices while minimizing user awareness and intervention.

Verticals Targeted: Sports, Transportation, Hospitality, Telecommunications, Financial, Technology, Media, Government
Regions Targeted: US, Canada, Mexico, Participating Nations
Related Threat Actors: Handala, CyberAv3ngers, Sandworm, NoName057(16), Cyber Army of Russia Reborn, KillNet affiliates, APT41, Volt Typhoon, Silent Ransom Group, Scattered Spider
Related Families: HANDALA, OlympicDestroyer, NKWIPER, HermeticWiper, RedLine, BlackCat (ALPHV)

Executive Summary

The 2026 FIFA World Cup presents one of the largest cyber target environments in modern history, spanning three host nations, sixteen host cities, critical infrastructure, transportation systems, hospitality providers, broadcasters, government agencies, and millions of attendees. Historical precedent demonstrates that major sporting events attract nation-state actors, hacktivists, cybercriminals, and opportunistic threat actors seeking financial gain, disruption, intelligence collection, or publicity. PolySwarm telemetry confirms continued circulation of destructive malware, infostealers, and ransomware families during the tournament period, highlighting the diverse threat landscape facing organizations supporting World Cup operations.

Verticals Targeted: Software Development
Regions Targeted: Global
Related Families: Miasma, Mini Shai-Hulud

Executive Summary

Miasma is a software supply chain malware campaign targeting developer ecosystems, CI/CD pipelines, GitHub repositories, and open-source package registries. Earlier this month, researchers identified a compromise affecting at least 32 packages and more than 90 malicious package versions published under the @redhat-cloud-services npm namespace. Collectively, the affected packages averaged approximately 80,000 weekly downloads. The campaign abused GitHub Actions OpenID Connect (OIDC) trusted publishing workflows to distribute malicious packages with valid provenance attestations, demonstrating how legitimate software supply chain trust mechanisms can be weaponized following compromise of upstream development infrastructure. Miasma harvests GitHub credentials, cloud identities, CI/CD secrets, SSH keys, and other sensitive developer assets that could facilitate compromise of additional repositories, software packages, and development environments. The campaign highlights the increasing sophistication of attacks targeting software development infrastructure rather than traditional end-user systems.

Verticals Targeted: Legal Services, Law Firms
Regions Targeted: US, Europe, Israel
Related Threat Actors and Malware: UNC3753, Akira, Qilin, DragonForce, INC, The Gentlemen

Executive Summary

Legal services organizations continue to face elevated cyber risk due to the vast quantities of confidential information they maintain on behalf of clients. Law firms, legal consultancies, title services, and compliance organizations routinely store merger and acquisition plans, litigation records, intellectual property, financial disclosures, personally identifiable information (PII), and privileged communications. Recent activity attributed to UNC3753 highlights a growing trend in which threat actors increasingly prioritize data theft and extortion over traditional ransomware deployment. As cybercriminal groups continue targeting the legal sector for its uniquely valuable information assets, organizations must strengthen both technical and operational defenses to protect client confidentiality, business continuity, and professional reputation.

Verticals Targeted: Gaming, Cryptocurrency
Regions Targeted: US, Germany, India, UK, Italy, Vietnam, Canada, Norway, Sweden, Finland, Spain
Related Families: Weedhack

Executive Summary

Researchers have identified Weedhack, a Minecraft-focused Malware-as-a-Service (MaaS) operation active since at least January 2026 that distributes malware through YouTube promotion, SEO poisoning, and counterfeit Minecraft mod websites. The campaign combines credential theft, cryptocurrency wallet theft, Minecraft account hijacking, and premium remote-access capabilities including webcam surveillance, keylogging, screen sharing, and reverse shell access. Operators claim the platform has accumulated more than 116,000 hits and offers subscriptions starting at $5 USD per month, significantly lowering barriers to entry for aspiring cybercriminals and increasing risk to younger users within gaming communities.

Verticals Targeted: Healthcare, Children’s Hospitals
Regions Targeted: US, Europe, Canada
Related Threat Actors: Iranian Threat Actors, Vanilla Tempest, Vice Society
Related Families: Rhysida, LockBit, INC

Executive Summary

Children's hospitals face a unique convergence of cyber risks involving ransomware, data theft, identity fraud, and emotionally motivated targeting. Unlike adult healthcare records, compromised pediatric identities may retain criminal value for decades, supporting synthetic identity fraud, financial abuse, and long-term impersonation. At the same time, children's hospitals operate in highly sensitive environments where disruptions can directly impact patient care and generate significant public pressure. Documented incidents demonstrate that pediatric healthcare organizations remain attractive targets for ransomware groups, nation-state actors, and hacktivists seeking operational, financial, or ideological objectives.

Verticals Targeted: Aviation, Defense, Telecommunications, Software Development, Government
Regions Targeted: US, Israel, UAE, Saudi Arabia, Western Europe, Middle East, Africa
Related Threat Actors: Nimbus Manticore
Related Families: MiniJunk, MiniFast

Executive Summary

IRGC-affiliated threat actor Nimbus Manticore significantly expanded its operational capabilities during the ongoing 2026 Middle East conflict, introducing a new backdoor dubbed MiniFast alongside advanced delivery mechanisms including AppDomain Hijacking, scheduled task abuse, and SEO poisoning. The campaign has targeted aviation, software, defense, and telecommunications organizations across the US, Europe, and the Middle East using phishing lures, Trojanized software installers, and stealth-focused persistence techniques designed to blend into legitimate enterprise activity.

Verticals Targeted: Financial, Cryptocurrency
Related Threat Actors: Lazarus
Related Families: DPAPILoader, RemotePELoader, RemotePE

Executive Summary

Researchers identified a sophisticated Lazarus-linked malware ecosystem composed of DPAPILoader, RemotePELoader, and RemotePE, a chained toolset designed for stealth, persistence, and long-term access in high-value financial and cryptocurrency environments. The malware leverages DPAPI-based environmental keying, direct syscall techniques, ETW suppression, and memory-only payload execution to minimize forensic visibility and evade modern endpoint defenses.