Windows Copilot's new Connector feature allows users to link Google (Gmail, Drive, Calendar) and Microsoft cloud accounts, enabling cross-platform AI search and document generation.

Netskope exposed a Python RAT (Nursultan Client) disguised as a Minecraft tool. It uses the Telegram Bot API for C2 to steal Discord tokens, credentials, and capture screenshots on Windows, Linux, and macOS.

Agenda ransomware is exploiting RMM tools and BYOVD techniques to execute a Linux variant on Windows hosts, disabling backups and escalating privileges for data exfiltration.

The Swift SDK for Android has launched in nightly preview, allowing developers to write native Android apps in Swift and easily share code with iOS via swift-java.

ASEC confirmed Kinsing is exploiting Apache ActiveMQ RCE (CVE-2023-46604) to deploy XMRig cryptominer. The group now integrates Sharpire, Cobalt Strike, and Meterpreter for advanced post-exploitation.

Cisco Talos reports Kraken, a HelloKitty successor, is a cross-platform RaaS targeting Windows/ESXi. The malware uniquely benchmarks CPU/IO to optimize encryption speed and uses Cloudflared/SSHFS for persistence.

Chinese cyber-espionage actors have spent years burrowed, undetected, within the networks of critical organizations, infiltrating infrastructure with sophisticated

Despite takedown, LockBit 5.0 resurges as a cross-platform threat. The new variant blinds Windows Event Tracing (ETW), uses Invisible Mode for stealth encryption, and overwrites free disk space.

New 01flip ransomware (written in Rust) targets APAC critical infra across Windows/Linux. The attackers use Sliver for C2 and older exploits for access. A curious "lockbit" ignore list was found in the code.