Unit 42 details PEERSTITCH, a memory-only FortiGate implant
Unit 42 says CL-STA-0954 (Mandiant: UNC5820) chained FortiJump and CVE-2025-61624 to deploy PEERSTITCH, a disk-less ARM64 FortiOS implant, against a telecom MSP.
Stories tagged: #threat-intel
Hirudo Android trojan swaps real banking apps for patched copies
ThreatFabric details Hirudo, an Android banker that uninstalls the real banking app and reinstalls a patched copy with a hooking engine to steal PINs, SMS, and screen data.
SOCRadar: 'CyberXero' wired AI agents into a Ukraine access-broker campaign
SOCRadar attributes a 628,000-record access-broker campaign against Ukraine to 'CyberXero,' reporting Claude Code agents and PentAGI driving Cobalt Strike. The metrics warrant scrutiny.
Cling botnet hides C2 in STUN traffic, spreads via Realtek SDK flaw
Nozomi Networks says the Cling botnet rides a spike in CVE-2021-35394 Realtek SDK exploitation and tunnels its command channel through 13 public STUN servers to blend into normal traffic.
CloudSyncD: fake Zoom installer backdoors macOS, steals passwords
Jamf Threat Labs found CloudSyncD, a new macOS backdoor delivered by a fake Zoom installer that social-engineers past Gatekeeper and hides the user's password in a fake config file.
Warlock ransomware hits critical infrastructure via SharePoint
Symantec says the Warlock operator, tracked as Longlegs/Storm-2603, hit a water utility, a telecom, a regional government and a university using ToolShell SharePoint exploits.
Malicious custom GPT 'Plus 5.6' funnels users into ClickFix RAT
Huntress found a weaponized ChatGPT Custom GPT that pushes victims through a Google Sites ClickFix page to a PowerShell-delivered RAT. At least 40 incidents investigated.
Star Blizzard hits 100+ orgs with RedFlick, CosmicPulse backdoor
Microsoft ties 13 phishing campaigns since January to Russia's Star Blizzard, using a new RedFlick delivery technique to drop the CosmicPulse backdoor at 100+ US/UK orgs.
Symantec ties new Mistic backdoor to ransomware broker KongTuke
Symantec links a stealth in-memory backdoor used since April 2026 to KongTuke (Woodgnat), the initial-access broker that has fed Interlock, Rhysida, Akira, 8Base and Black Basta.