EdgeProtect
Threat News
Latest cyber threat intelligence, breaches and exploitation
3 matching stories
APTKaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure
Kaspersky has described a previously unknown APT group, Armored Likho, running a spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer against government agencies and the electric power sector in Russia, Brazil and Kazakhstan.
HoneyMyte adds kernel-mode rootkit to CoolClient backdoor
Kaspersky reports that HoneyMyte (Mustang Panda) has added a Windows kernel-mode rootkit, msagent.sys, to its CoolClient backdoor. The driver hides the backdoor's process, protects its files and registry entries and filters its C2 addresses from network data. Victims were found in Myanmar, Mongolia, Pakistan and Russia, including government entities.
Head Mare APT trojanises TrueConf client installers to drop PhantomCore and PhantomGraph backdoors
Kaspersky reports that Head Mare compromised TrueConf video conferencing servers through two flaws that TrueConf fixed on 18 June 2026, then swapped the hosted client installer for a trojanised build delivering the PhantomCore and PhantomGraph backdoors. The campaigns target Russian organisations in six sectors.
