At a Glance Malware Family PapRAT malware (C++ and Rust remote access trojans) and WmRAT secondary implant Threat Actor Confirmed campaign attribution to BITTER (also tracked as TA397); suspected South Asian state-aligned cyberespionage group Target / Victims Government, energy, and engineering organizations across South Asia (regional focus confirmed by C2 telemetry and summit lures) Delivery Vector

At a Glance Malware Family Hugging Face malware campaign (peakminer cryptominer, /tmp/.cch/svc.py watchdog, reconnecting reverse shells, and container escape tools) Threat Actor Unattributed; suspected financially motivated Chinese-speaking operator or group Target / Victims Self-hosted AI infrastructure (Xinference and GPUStack), shared GPU notebooks, research clusters (over 32,000 downloads across 31 campaign and 13 linked repositories) Delivery Vector

At a Glance Malware Family NIK C2 framework (Go-based 64-bit Windows implant, OpenAI API client, and screen-locking ransomware) Threat Actor Unattributed operator group (internal project labeled nik_panel; intent unconfirmed) Target / Victims Windows endpoints holding cryptocurrency wallets, browser logins, and OpenAI developer keys (active server observed in the wild) Delivery Vector

This advanced intelligence course prepares you to disrupt global cybercrime actors. Learn to analyze crimeware, investigate ransomware, and infiltr...

TL;DR Group-IB researchers analyzed more than 280 samples of the Windows SiriusQT RAT, a commercial malware family sold on dark web forums since April 2026. Offered for $500 by a reseller named GhostKernel and widely shared in cracked builds, the SiriusQT RAT merges Hidden Virtual Network Computing with a credential stealer. Furthermore, the implant uses six persistence techniques and a custom stream cipher to control infected Windows hosts.