eBPF Rootkits Spread Underground with Code for Stealthy Linux Implants

Blind Eagle APT-C-36 Resurfaces with Judicial-Themed Phishing Delivering AsyncRAT-DCRat Hybrid RAT Across Latin America

The threat actor known as Blind Eagle has launched a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan that shares its lineage with AsyncRAT and DCRat. The campaign uses Portuguese and Spanish lures resembling court notifications, fiscalía notices, tutela proceedings, and administrative documents. Attack chains begin with phishing emails containing weaponized XHTML files that render as SVG images impersonating Colombia's Fiscalía General de la Nación. The page employs HTML smuggling with ZipCrypto to assemble a ZIP archive payload locally in the browser. Inside the archive is a JavaScript dropper that performs environment reconnaissance before launching a VBScript to bypass AMSI and ETW, display a fake criminal-citation page, and establish persistence. The final payload is an AsyncRAT fork with DCRat lineage decoded and executed in memory via PowerShell, enabling reconnaissance, document collection, keystroke logging, screen capture, and encrypted data exfiltration.

Russian Cloud Provider Beget Rebuilds Infrastructure from Scratch Following Destructive Data Wiper Attack

A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its entire cloud infrastructure from scratch after attackers gained access to management systems on November 1st. The company detected the intrusion shortly after the malware activated and immediately disconnected all servers from the network to contain the spread. Beget, which serves more than 200,000 customers including online stores, media, and educational services, reported that all data in its cloud infrastructure including VPS, S3, and Kubernetes was lost along with CDN settings and IP configurations. VPS binary backups were completely destroyed while file backups survived only partially and will be available for roughly half of VPS users after technically complex matching processes. The firm is manually checking around 1,000 servers for vulnerabilities and hidden scripts, treating all infrastructure as potentially infected, and has notified police and government agencies while collaborating with cybersecurity firms. Recovery efforts have restored 60% of shared hosting and 40% of dedicated servers more than a week after the incident, with the attack focused solely on destruction rather than data theft.

Google Dismantles XCPE Botnet Infecting 1.3 Million Android TV Boxes for Residential Proxy Fraud

Google Threat Intelligence Group collaborated with industry partners to dismantle the XCPE botnet, which had enrolled more than 1.3 million Android TV set-top boxes manufactured by Videostrong Technology Co. The malware secretly turned user devices into residential proxies sold to criminal actors for advertising fraud, account takeovers, and content scraping. The operation is expected to disrupt access to at least 10 million additional compromised IoT devices, including healthcare equipment and karaoke machines. Multiple residential proxy providers such as Honeygain, NetNut, and Grass were linked to the campaign through their SDKs. The takedown also highlighted supply-chain risks in Android-based IoT manufacturing and the role of influencer marketing in distributing pre-infected devices.