Chinese-linked threat actors have escalated their use of artificial intelligence in cyberespionage operations, deploying autonomous AI penetration-testing agents to attack more than 200 organizations across 14 countries. The campaign demonstrates how sophisticated attackers are beginning to use AI not simply to assist individual hackers but to coordinate multiple simultaneous intrusions, automate exploitation, and pursue sensitive information across critical industries. Researchers at CrowdStrike identified the operation, which began on October 17, 2026, and attributed it to a China-nexus threat actor tracked as Vapor Panda.

FortiGuard Labs links BITTER to cyberespionage attacks on South Asian organizations using malicious Windows shortcuts, PowerShell scripts, and PapRAT malware.

Proofpoint researchers identified a renewed cyberespionage campaign attributed to the threat group TA416, which had previously reduced its targeting of Europe for several years. The campaign is driven by escalating geopolitical tensions between Europe and China, with activity extending to regions including the European Union, NATO, the Middle East, Mongolia, Taiwan, Ukraine, Iran, and Russia. No specific technical details, attack vectors, or dates were disclosed in the report. The resurgence of TA416's operations suggests a strategic shift in response to evolving international relations. The impact involves increased cyberespionage targeting government, diplomatic, and strategic entities.

CrowdStrike and Kaspersky detail AI-powered cyberattacks mounted by Chinese-linked hackers that use ARTEX and CyberStrikeAI platforms.

FortiGuard Labs links BITTER to cyberespionage attacks on South Asian organizations using malicious Windows shortcuts, PowerShell scripts, and PapRAT malware.

A sophisticated cyberespionage campaign has turned legitimate GitHub repositories into covert command-and-control infrastructure, allowing attackers to steal credentials, exfiltrate sensitive government data, and remotely operate malware while attempting to evade security monitoring. DarkBlinders Targets Israel and Iraqi Kurdistan A cyberespionage group tracked as DarkBlinders has abused GitHub repositories to control malware during a targeted intelligence-gathering campaign against Israel and the Kurdistan Region of Iraq.

FortiGuard Labs links BITTER to cyberespionage attacks on South Asian organizations using malicious Windows shortcuts, PowerShell scripts, and PapRAT malware.

At a Glance Malware Family PapRAT malware (C++ and Rust remote access trojans) and WmRAT secondary implant Threat Actor Confirmed campaign attribution to BITTER (also tracked as TA397); suspected South Asian state-aligned cyberespionage group Target / Victims Government, energy, and engineering organizations across South Asia (regional focus confirmed by C2 telemetry and summit lures) Delivery Vector

FortiGuard Labs links BITTER to cyberespionage attacks on South Asian organizations using malicious Windows shortcuts, PowerShell scripts, and PapRAT malware.

Fresh research suggests recent panic over AI-generated malware may be overblown. Last month Anthropic detailed how Russia-linked cyberespionage group Midnight Blizzard used Claude to rebuild malware each time security tools flagged its backdoor as malign. “We observed GTG-20006 operate through customized AI-driven workflows that automated much of their operations from development, infrastructure acquisition, phishing, persistence through command and control, to data exfiltration,” the AI company wrote in its report, referring to Midnight Blizzard, aka APT29 and Cozy Bear, as GTG-20006. While the group’s use of AI as part of its operations is notable, what raised eyebrows was how it did so as part of its evasion strategy: “If their monitoring AI agents identified that any of their deployed malware was detected by a security product, agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections. The agents were designed to continue iterating on GTG-20006’s toolkit until it was undetected,” Anthropic reported. That autonomous loop — from monitoring for detection to rebuilding the malware to fine-tune evasion — raises the spectre of polymorphic AI malware, malicious software that changes its code structure automatically while keeping the same core functionality. But threat intelligence company ReversingLabs (RL) has since released a report detailing how its telemetry and behavior-based threat hunting flagged the campaign’s Go backdoor PowerShell stager as malicious on Aug. 1, weeks before Anthropic’s Sept. 10 report. RL subsequently saw five versions of the same stager over the course of 25 days. Although each had a different hash, all five behaved the same way. That consistent behavior profile left each iteration open to detection, according to a technical blog post by ReversingLabs published last week, as analysts could still hunt for what the malware did and how its files and infrastructure were connected. As a result, evasion via AI rebuilds may not yet be as foolproof as first feared. Variations on a well-worn theme Changing a file to dodge detection is one of the oldest techniques in the business, and polymorphic malware has been deployed to dodge signatures for decades. “What stands out with this Midnight Blizzard activity is outsourcing the busywork to an LLM,” says Ben Bernstein, manager of the cybersecurity advisors team at managed detection and response firm Huntress. “They wired an AI agent to monitor security tools and automatically generate fresh variants without human intervention. We have seen basic script automation do this, but large language models just make the refactoring cleaner and faster.” Huntress backs ReversingLabs’ argument that while AI makes malware faster to rebuild it fails to change the hallmarks of its malicious behavior. “Models are fantastic at scrambling code structure and swapping variables to bypass static analysis,” says Bernstein. “But the AI is not inventing novel exploits. It just automates the grunt work of rewriting the same script to ensure the file hashes change.” In short, Bernstein says, “the packaging looks different, but the payload’s core objective remains exactly the same.” Malicious experiments in AI-assisted malware development Still, AI-assisted malware rebuilding is an emerging if not unprecedented tactic among malware developers. For example, Google documented PromptFlux in late 2025, an experimental script that asked Gemini to rewrite its own source every hour, and PromptSteal, which APT28 used against Ukraine to generate commands at runtime. In March 2026, Microsoft released a report describing how the North Korean cluster Coral Sleet is using agentic AI tools to generate, test, and deploy payloads. “Most of these are early or experimental, and Microsoft’s own assessment is that the capability ‘remain[s] limited by reliability, latency, and operational risk,’” says Igor Lasic, SVP of engineering at ReversingLabs. But this most recent case involving Midnight Blizzard is the “clearest one on record,” according to Lasic, because two independent sources described the same infrastructure: Microsoft on July 31 as CaptiveCrunch, naming the files CornFlake and ChocoShell, and Anthropic on Sept. 10 with visibility into how the operator used Claude. “We held both files from July 6 and July 10, before either report,” says Lasic. Persistent limitations Still, ReversingLabs’ recent report may reflect only the current state of the art of AI-assisted malware rebuilding, as some of the limitations that characterized the Midnight Blizzard instance could be something more advanced models might overcome, Lasic concedes. “Today a model rewrites the file for free but cannot cheaply rewrite the server code that parses the beacon, re-register domains or re-phish victims, so the indicators that survived were the ones that had to change in two places at once,” Lasic explains. “A more capable agent with access to the whole operation could coordinate those changes, and I expect infrastructure indicators to age faster over the next few years, the way hashes already have.” While cost and the availability of more sophisticated models is perhaps only a temporary limit for AI-assisted malware rebuilding, two other limits are closer to fundamental: the behavior of malicious code and clues left behind during a malicious campaign that enable detection. “An implant that steals credentials has to read the credential store and one that calls home has to open a connection, whatever built it,” says Lasic. “Obfuscation makes that harder to extract, but no rewrite removes a requirement without removing the capability.” Furthermore, a model can change the next build but not the builds already observed, timestamped and linked to the same server. “Rebuilding faster produces more artefacts, and each one is another thread back to the operation,” Lasic concludes. Huntress’ Bernstein backs ReversingLabs assessment that behavior-based hunting will remain effective against even AI-assisted malware development. “You can disguise malicious code all day, but if a script tries to dump credentials or establish persistence, most modern EDRs [endpoint detection and response tools] will detect the action itself,” says Bernstein. Another limitation of AI-assisted malware development is that even the latest models are trained to abuse known security vulnerabilities. “They [AI models] remix known patterns rather than dreaming up zero-days,” Bernstein concludes. “Future models might get better if they can actively test their output against live environments to find undiscovered flaws, but for now, they are just recycling known techniques at a higher speed.”

Introduction: Mobile Browsing Becomes an Espionage Entry Point A new mobile-focused cyberespionage campaign attributed to Russia-linked threat group APT29 highlights how compromised websites and vulnerable mobile devices can become entry points for intelligence collection. Rather than relying exclusively on traditional phishing emails or malicious applications, the attackers reportedly used watering-hole techniques to target visitors through compromised or look-alike websites. According to cybersecurity company Sekoia, the attribution carries moderate-to-high confidence, making this a significant development in the ongoing monitoring of Russian cyberespionage operations.

Russia’s APT29 used compromised sites and a hijacked Ukrainian analytics tracker to hit unpatched mobile devices with n-day exploits.

Sekoia has uncovered a sophisticated watering-hole cyberespionage campaign exploiting previously disclosed vulnerabilities in Apple iOS and Google Android devices, with Russian-linked threat group APT29 assessed as the likely operator. The campaign reportedly used zero-click, n-day exploit chains to compromise or profile targeted mobile devices without requiring victims to interact with malicious links or attachments. The findings highlight the continuing danger of advanced mobile exploitation operations, particularly when attackers weaponize vulnerabilities that have already been publicly disclosed but remain unpatched on some devices.

ESET researchers detail Gorbag, a Russia-aligned actor targeting Ukrainian organizations with spearphishing and a WinRAR exploit. Its tools harvest browser…

A suspected South Asian cyberespionage group known as BITTER is using fake diplomatic correspondence, military documents, and official-looking invitations to infiltrate Windows systems and conduct long-term surveillance. The campaign relies on legitimate Windows utilities, malicious installers, and a custom remote access trojan (RAT) called PapRAT to steal information and maintain persistent access to compromised networks. FortiGuard Labs uncovered three separate infection chains during its investigation, revealing how the attackers disguise malicious activity as legitimate Windows operations while deploying surveillance malware against targeted organizations.