Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine

Viettel Threat Intelligence tracks Goblin Panda (aka Hellsing, 1937CN) campaigns exploiting COVID-19 themes, using RTF exploits and PlugX/NewCoreRAT to breach government targets and evade most AVs.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.

Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.

CrowdStrike identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript-based information stealer PhantomRaven.

Kaspersky's Holy Water campaign analysis: compromised religious and charity websites in Asia served staged JavaScript that profiled visitors and delivered fake Flash updates installing backdoors.