The PolySwarm Blog

Verticals Targeted: Government
Related Families: SysGoRAT

Executive Summary

A cyber intrusion campaign tracked as CL-UNK-1211 was observed targeting government entities and state-affiliated infrastructure between October 2025 and April 2026, with attackers using AI-assisted scripts, custom malware, and open-source tools to compromise Linux environments. The activity involved PHP web shell deployment, credential harvesting, privilege escalation, lateral movement, and attempts to exfiltrate government databases and email accounts, supported by a custom cross-platform RAT named SysGoRAT. The campaign demonstrates how AI-assisted payload development can complement established intrusion techniques while complicating detection through persistent backdoors, legitimate administrative utilities, and extensive anti-forensics activity.

Related Families: Midnight Mimosa, Android.Phantom, Android.Click, Android.Joker

Executive Summary

Midnight Mimosa is a widespread Android malware campaign involving malicious applications preinstalled in the firmware of low-cost, MediaTek-based devices, with infections observed across more than 150 countries. The malware leverages platform-signed system applications to silently deploy additional payloads, evade mobile security protections, execute remotely supplied code, and monetize compromised devices through advertising fraud and residential-proxy services. The campaign poses potential risks to organizations using inexpensive or unmanaged Android devices, as compromised hardware can facilitate unauthorized network activity and maintain persistent malicious functionality that conventional application removal cannot address.

Verticals Targeted: Government, Healthcare, Manufacturing, Information Technology, Law Enforcement, Education, Religious Organizations
Regions Targeted: North America, Southeast Asia, Africa
Related Threat Actors: Flax Typhoon

Executive Summary

Chinese government-linked threat actors enabled by Integrity Technology Group (Integrity Tech) combine automated vulnerability scanning and hands-on exploitation to compromise organizations worldwide. The actors target multiple sectors, including healthcare and US critical infrastructure, using credential attacks, persistent VPN connections, and specialized tools to collect sensitive information. The activity highlights the risks posed by exposed services, compromised identities, and unauthorized access to organizational email environments.

Related Families: Mirai

Executive Summary

An evolving Linux malware campaign was observed deploying ClingSTUN, a back-connect proxy backdoor that exploits known vulnerabilities in Internet-facing IoT and embedded/network devices to establish persistent access and convert compromised systems into remotely controlled proxy nodes. ClingSTUN supports multiple Linux architectures and combines boot persistence, process termination, watchdog manipulation, process concealment, remote command execution, and self-propagation with an unusual technique that abuses legitimate public STUN infrastructure for NAT traversal. The campaign has expanded the number of vulnerabilities and device vendors it targets over time, highlighting the continued risk posed by unpatched, unsupported, and unnecessarily exposed Internet-facing devices.

Verticals Targeted: Water, Telecommunications, Government, Education
Regions Targeted: Europe, Africa, Latin America
Related Families: Warlock
Related Threat Actors: Longlegs

Executive Summary

A China-nexus threat actor tracked by Symantec as Longlegs is continuing to exploit vulnerabilities in on-premises Microsoft SharePoint Server to deploy Warlock ransomware, with recent victims including water and telecommunications operators, a regional government body, and a university. The group combines SharePoint exploitation with webshells, DLL sideloading, living-off-the-land techniques, vulnerable driver abuse, and Visual Studio Code tunneling before disabling security tools and deploying ransomware across compromised environments. In one critical infrastructure intrusion, the attackers deployed an AV/EDR-killing tool to at least 40 hosts within approximately two hours and subsequently delivered Warlock to at least 33 systems, using the victim's own SYSVOL replication infrastructure as part of the ransomware distribution process.

Verticals Targeted: Critical Infrastructure, Defense
Regions Targeted: United States
Related Threat Actors: Volt Typhoon, QTFY, CyberAv3ngers, FSB Center 16, GRU Unit 29155, Cyber Army of Russia Reborn, NoName057(16), Z-Pentest, Sector16

Executive Summary

US critical infrastructure faces an increasingly consequential operational technology (OT) threat as state-sponsored and other cyber actors conduct activity ranging from long-term pre-positioning in critical infrastructure networks to direct exploitation of programmable logic controllers (PLCs) capable of affecting physical processes. Of particular national-security concern, military installations depend on civilian electricity, water, telecommunications, transportation, fuel, manufacturing, and logistics infrastructure located outside Department of War networks and installation boundaries. Disruption of these systems could therefore create military effects without direct compromise of a military installation.

Regions Targeted: Ukraine

Executive Summary

Cisco Talos has identified CLOSEDQUORUM, a Windows malware implant that delegates tactical command-and-control (C2) decisions to a panel of commercial large language models (LLMs), allowing portions of an intrusion to operate without continued human direction or a traditional attacker-controlled C2 server. The malware can query up to four LLM providers, including DeepSeek, Qwen, Mistral, and Google Gemini, to select among predefined malicious actions including credential theft, process injection, and persistence, while reporting decisions and stolen data through Discord. Although Talos has not confirmed CLOSEDQUORUM's deployment in the wild and the publicly distributed build is nonfunctional, the malware demonstrates how threat actors can use existing AI services to automate bounded portions of the attack chain and reduce their dependence on human operators.