Symantec

The threat actor identified as Warlock, with suspected links to China, continues to exploit vulnerabilities within Microsoft SharePoint to conduct attacks. These exploits are designed to disable security tools and subsequently deploy ransomware, targeting organizations primarily in Portuguese- and Spanish-speaking…

The advanced kernel-mode rootkit known as Daxin has resurfaced after more than four years, targeting a manufacturing firm in Taiwan. This reappearance was accompanied by the discovery of a previously unreported backdoor, dubbed Stupig.

A new ransomware family, dubbed GodDamn, has emerged, employing the PoisonX kernel driver to disable endpoint security defenses. This sophisticated evasion technique allows the ransomware to operate without detection by security software.

A new backdoor, identified as Mistic and also known as MLTBackdoor, was deployed in financially motivated cyberattacks beginning in April 2026. These attacks targeted organizations across the insurance, education, IT, and professional services sectors.

DragonForce hackers are leveraging Microsoft Teams relay infrastructure to hide their Backdoor.Turn command-and-control (C2) traffic. This tactic was identified by Symantec and Carbon Black, which noted the use of a custom Go-based remote access trojan (RAT) to achieve this concealment.