Summary
A remote-access trojan marketed as a professional tool is slashing through Windows defenses, letting operators steal credentials, deploy ransomware, and even harass victims in real time. KGB RAT, sold as Malware-as-a-Service for $150 per month, leverages daily updates and a unique stub generator to evade antivirus tools, with infrastructure traced back to January 2022. Cyware highlights how this blend of technical and psychological pressure is reshaping the threat landscape.
Attackers are hijacking internet-facing routers and IoT devices, turning them into stealthy proxy nodes for further intrusions. The ClingSTUN backdoor exploits vulnerabilities across vendors like Realtek and Ivanti, supports multiple CPU architectures, and uses legitimate STUN services to stay connected behind NAT. This campaign quietly transforms edge devices into persistent attack infrastructure, often leaving only subtle network anomalies as clues.
A zero-day authentication bypass in Ivanti Connect Secure is enabling remote code execution on over 5,500 exposed gateways, with attackers already gaining admin access and hunting for credentials. CVE-2026-104935 is under active exploitation, prompting urgent patching and CISA warnings. Meanwhile, Microsoft’s October Patch Tuesday addresses three exploited zero-days, including CVE-2026-96951, as attackers blend fresh vulnerabilities into broader campaigns.
North Korea-linked FAMOUS CHOLLIMA is planting fake IT hires inside U.S. organizations, redirecting employer-issued laptops to overseas operatives and generating $3 million across more than 70 victims. The n0n extortion group is pressuring 38 maritime organizations worldwide with public leak threats and multimillion-dollar demands, exposing how insider access and supply chain vulnerabilities are fueling new waves of cyber risk.
Top Malware Reported in the Last 24 Hours
KGB RAT markets jump-scare extortion
KGB RAT is a Windows remote-access trojan sold as a polished “legitimate” tool, but it bundles credential theft, keylogging, ransomware-style capabilities, and even screamer-style harassment meant to intimidate victims. It is pitched as Malware-as-a-Service starting at $150 per month, using fake reviews and legal disclaimers to look professional while claiming it can bypass Windows Defender and other antivirus tools. To help it evade detection at scale, it includes a Unique Stub Generator and a built-in crypter, and it also adds a Crypto Clipper module aimed at financial theft. Promoted on underground forums since late 2025, it is positioned as “fully undetectable” with daily updates, while its infrastructure reportedly dates back to January 2022. For victims, the outcome isn’t just data loss—this tool is designed to let an operator control a PC and pressure a person on the other end in real time.
ClingSTUN turns routers into proxy nodes
ClingSTUN is a Linux back-connect proxy backdoor that turns internet-facing IoT and embedded devices into persistent infrastructure an attacker can route traffic through. It spreads by exploiting known vulnerabilities across products from vendors such as Realtek, AVTECH, Ivanti, Tenda, and Lantronix, and researchers say the campaign began with CVE-2022-36553 before expanding to other flaws including CVE-2025-34035 and CVE-2024-23625. To maximize reach, it supports multiple CPU architectures—ARM, Intel 80386, MIPS R3000, PowerPC, and AMD x86-64—making it suitable for the messy reality of edge-device fleets. It also uses legitimate STUN services for NAT traversal, helping it stay reachable even when devices sit behind typical network setups. For organizations, a compromised edge device can quietly become a relay point for further intrusions while the business sees little more than “weird” network behavior.
Fake PuTTY installer hides blockchain C2
Attackers are targeting PuTTY users with a trojanized Windows installer that includes a legitimate, Sectigo-signed copy of the tool as a decoy, so victims think they installed the real thing. Instead, it drops a malicious payload and uses a “bring your own interpreter” approach—checking for Node.js and downloading it if missing—so it can run code through trusted components. What makes the campaign stand out is its command-and-control design: it relies on Ethereum smart contracts to dynamically retrieve C2 addresses, letting operators shift infrastructure without rebuilding the initial implant. The campaign has been linked to SEO poisoning that pushes searchers toward a fake download site, increasing the odds of opportunistic infections. For affected users and businesses, that can mean a compromised workstation in the middle of admin and server-access workflows, where stolen sessions or credentials can quickly translate into broader network access.
Top Vulnerabilities Reported in Last 24 hours
Ivanti gateway zero-day enables remote takeover
Attackers are exploiting a zero-day in Ivanti Connect Secure that can let them run arbitrary commands on exposed remote-access gateways without a valid login (CVE-2026-104935). The issue is an Authentication Bypass that Ivanti says can be used for Remote Code Execution without user interaction, opening the door to administrative access, stolen credentials, and broader network compromise. Attackers are already exploiting this in the wild, with Volexity reporting incidents where intruders gained admin rights, hunted for organizational credentials, and tried to cover their tracks. Shadowserver says it is tracking more than 5,500 Ivanti Connect Secure instances exposed online, while CISA is also flagging the issue as part of active exploitation tracking—an uncomfortable echo of past Ivanti bugs that quickly turned into widespread campaigns. A fix is available in 22.8R2.5, 25.1.1.2, 25.1.3.0, or 25.1.3.1.
Windows command injection joins CISA KEV
A Microsoft Windows command injection flaw tracked as CVE-2026-96951 is now listed by CISA as a known-exploited vulnerability, signaling that attackers are already using it to break into real environments. In practical terms, command injection bugs can let an intruder trick a system into running attacker-chosen instructions, escalating an initial foothold into deeper access and potential data theft or disruption. Attackers are already exploiting this in the wild. CISA highlighted CVE-2026-96951 in an alert announcing its addition to the Known Exploited Vulnerabilities (KEV) Catalog, raising the priority level for organizations—especially U.S. federal agencies operating under Binding Operational Directive 26-04. Microsoft’s October 2026 security advisory also calls out CVE-2026-96951 as actively exploited.
Microsoft Patch Tuesday fixes exploited zero-days
Microsoft’s October 2026 Patch Tuesday includes fixes for three zero-day vulnerabilities that are already being exploited in the wild: CVE-2026-96951, CVE-2026-108398, and CVE-2026-92707. When zero-days are under active attack, the risk shifts from “theoretical” to immediate—organizations can face unauthorized access, data exposure, and service outages before defenders even realize they are targeted. Attackers are already exploiting these vulnerabilities in the wild. The advisory described a broad update spanning 1411 vulnerabilities across Windows and major enterprise products, underscoring how quickly attackers can blend zero-day exploitation into larger campaigns. A fix is available as part of Microsoft’s October 2026 updates.
Top Threat Actors Reported in Last 24 hours
KGB RAT sold as “legit” spyware
KGB RAT is a Windows remote access trojan marketed like a legitimate product but built for criminal use, bundling credential theft, keylogging, ransomware capabilities, and even intimidation features such as “screamer” jump scares. The operators sell it as Malware-as-a-Service, advertising daily updates and a starting price of $150 per month while claiming it can evade Windows Defender and other antivirus tools. The malware’s distribution pitch leans on convenience as much as stealth, including an integrated crypter and C2 connectivity that doesn’t require port forwarding, alongside Telegram Bot API notifications and victim geolocation lookups via an external service. For businesses and individuals hit by a tool like this, the fallout can be both practical and personal: stolen passwords, financial theft via crypto-clipping, and harassment meant to pressure victims into panic decisions. Group-IB reported the infrastructure dates back to January 2022, suggesting a long-running development and resale effort.
FAMOUS CHOLLIMA plants fake IT hires
FAMOUS CHOLLIMA, a North Korea-linked operation tied to financial gain, has been targeting U.S. organizations by placing fraudulent IT workers into roles that provide inside access. Instead of breaking in from the outside, they relied on U.S.-based facilitators to redirect employer-issued laptops to overseas operatives, using tactics like last-minute “relocations” and even fraudulent police reports to explain delivery changes. An Ohio indictment said the scheme impacted over 70 U.S. employers and generated about $3 million, with arrests including Michael James Bostelle and Juan Cecilio Pena Carrillo. For affected companies, the human consequence is straightforward: someone who looks like a normal remote hire can quietly become a conduit for data access, account misuse, and downstream intrusion risk across critical sectors. The activity is linked to the DPRK RevGen: Domestic Enabler Initiative, and the reporting warns that even after disruption, operatives may relocate worker “farms” and modify concealment techniques to keep the model running.
n0n pressures global maritime leak victims
The n0n extortion group is leaning into the maritime supply chain, adding 38 organizations to its leak site spanning Brazil, Spain, Morocco, India, Vietnam, Singapore, China, Taiwan, Kuwait, Indonesia, Germany, and South Korea. Their claims remain unverified, but the pattern described by researchers suggests a shared application vulnerability may be acting as a single point of exposure, with small and recurring data sets across victims. For ports, shipping lines, and the IT providers that keep terminals running, even narrowly scoped leaks can disrupt operations, contractual trust, and day-to-day logistics that depend on timely data sharing. The group’s pressure tactic centers on public negotiation theatrics, including a scoreboard with countdowns to publication deadlines. Reported demands are fixed in a range from $2.4 million to $14 million.
Frequently Asked Questions
What is KGB RAT? KGB RAT is a Windows remote-access trojan sold as a polished “legitimate” tool, but it bundles credential theft, keylogging, ransomware-style capabilities, and even screamer-style harassment meant to intimidate victims. It is pitched as Malware-as-a-Service starting at $150 per month, using fake reviews and legal disclaimers to look professional while claiming it can bypass Windows Defender and other antivirus tools.
What is ClingSTUN? ClingSTUN is a Linux back-connect proxy backdoor that turns internet-facing IoT and embedded devices into persistent infrastructure an attacker can route traffic through. It spreads by exploiting known vulnerabilities across products from vendors such as Realtek, AVTECH, Ivanti, Tenda, and Lantronix, and researchers say the campaign began with CVE-2022-36553 before expanding to other flaws including CVE-2025-34035 and CVE-2024-23625.
What is PuTTY? Attackers are targeting PuTTY users with a trojanized Windows installer that includes a legitimate, Sectigo-signed copy of the tool as a decoy, so victims think they installed the real thing. Instead, it drops a malicious payload and uses a “bring your own interpreter” approach—checking for Node.js and downloading it if missing—so it can run code through trusted components.
What is CVE-2026-104935? Attackers are exploiting a zero-day in Ivanti Connect Secure that can let them run arbitrary commands on exposed remote-access gateways without a valid login (CVE-2026-104935). The issue is an Authentication Bypass that Ivanti says can be used for Remote Code Execution without user interaction, opening the door to administrative access, stolen credentials, and broader network compromise.
What is CVE-2026-96951? A Microsoft Windows command injection flaw tracked as CVE-2026-96951 is now listed by CISA as a known-exploited vulnerability, signaling that attackers are already using it to break into real environments. In practical terms, command injection bugs can let an intruder trick a system into running attacker-chosen instructions, escalating an initial foothold into deeper access and potential data theft or disruption.
What is CVE-2026-96951? Microsoft’s October 2026 Patch Tuesday includes fixes for three zero-day vulnerabilities that are already being exploited in the wild: CVE-2026-96951, CVE-2026-108398, and CVE-2026-92707. When zero-days are under active attack, the risk shifts from “theoretical” to immediate—organizations can face unauthorized access, data exposure, and service outages before defenders even realize they are targeted.
What is KGB RAT? KGB RAT is a Windows remote access trojan marketed like a legitimate product but built for criminal use, bundling credential theft, keylogging, ransomware capabilities, and even intimidation features such as “screamer” jump scares. The operators sell it as Malware-as-a-Service, advertising daily updates and a starting price of $150 per month while claiming it can evade Windows Defender and other antivirus tools.
What is FAMOUS CHOLLIMA? FAMOUS CHOLLIMA, a North Korea-linked operation tied to financial gain, has been targeting U.S. organizations by placing fraudulent IT workers into roles that provide inside access. Instead of breaking in from the outside, they relied on U.S.-based facilitators to redirect employer-issued laptops to overseas operatives, using tactics like last-minute “relocations” and even fraudulent police reports to explain delivery changes.
What is n0n? The n0n extortion group is leaning into the maritime supply chain, adding 38 organizations to its leak site spanning Brazil, Spain, Morocco, India, Vietnam, Singapore, China, Taiwan, Kuwait, Indonesia, Germany, and South Korea. Their claims remain unverified, but the pattern described by researchers suggests a shared application vulnerability may be acting as a single point of exposure, with small and recurring data sets across victims.