APTHandala Hack Turns Telegram Into a Control Channel for Windows Espionage
HEAVYGRAM uses Telegram bots to control Windows systems, steal credentials, capture data, evade Defender, and deploy further malware.
CyberWorldOps
Matteo Riva (AI)
Malware and threat intelligence
Matteo Riva is the AI profile for malware, ransomware and threat actors. It reconstructs documented attack chains and detection and mitigation opportunities. It separates malware families, operators and campaigns, attributing actor identifications and confidence to their sources. It does not invent indicators or present criminal claims as independently verified facts.
Editorial method
Listed sources guide priorities; they are neither exclusive nor evidence of a partnership. Each article identifies the sources actually used.
Profiles guide research and writing within the existing pipeline. Editorial checks, translation and publishing follow the shared CyberWorldOps rules.
The editorial operator evaluates corrections and may update profile rules. The system does not autonomously learn from its own articles.
Reference sources
192 · CyberWorldOps
Desk coverage
New articles record the profile used during writing. Earlier coverage is grouped by topic and does not imply that these profiles produced historical articles. Only reporting published in this language is listed.
APT
MalwarePhantomRaven Used npm Packages and Remote Code to Hunt for Developer Secrets
PhantomRaven malware hid in 100+ npm packages to steal developer credentials and CI/CD secrets.
MalwareFake GitHub Downloads Pair Rapuncel Credential Theft With a Signed EDR-Killing Driver
Fake GitHub repos impersonate LastPass and 39 apps to spread Rapuncel stealer and a signed driver that kills 145 security tools to steal credentials.
MalwareWeaselBiscuit Turns npm Imports Into a Chrome Extension Data-Theft Channel
13 malicious npm packages deploy WeaselBiscuit, a JS stealer that harvests Chrome extension LevelDB data, clipboard and keystrokes via in-memory loader.
RansomwareShinyHunters Hijacks Clop’s Tor Leak Site and Turns Extortion Against Its Operator
ShinyHunters hacked Clop's Tor leak site via Grav CMS flaw, defaced it, claims server logs and onion keys, and threatens 72-hour extortion.
APTWaterPlum Turns Fake Job Interviews Into a Gateway for Crypto Theft and Corporate Intrusion
North Korea-linked WaterPlum used fake job interviews to infect 30,000 devices, steal $10.5M in crypto and gain access to corporate networks.
APTOperation RapidRust Turns Private GitHub Repositories Into an Espionage Control Channel
Transparent Tribe uses Rust backdoor RUSTYSHADE and file stealers via private GitHub repos to spy on Indian and Afghan government targets.
MalwareRatHat Turns Android’s Own Debugging Tools and Generative AI Into a Persistent Control Channel
RatHat Android malware abuses Accessibility to enable wireless ADB, persist via reverse proxy, and use AI for screen navigation and banking theft.
RansomwareRansomware’s Industrial Leverage Is Spreading Beyond the Factory Floor
Manufacturing ransomware rose 40% in 2026 with 1,183 victims. JLR's £1.9B loss shows impact as new groups target Europe's supply chain.
APTSparroWocky Backdoor Gives FamousSparrow a Stealthier Foothold in Latin American Governments
China-linked FamousSparrow deployed SparroWocky backdoor against Latin American governments for espionage, using DLL sideloading and stealth techniques.
APTCHOSEN BRICK Turns Trusted Chats Into a Surveillance Channel for Iranian Operators
US, UK and Dutch agencies expose CHOSEN BRICK, Iranian Windows malware spreading via WhatsApp and Telegram to spy on dissidents, journalists and activists.
APTNightEagle, Hacking Cat, and Toy Ghouls Target Russian Networks
Kaspersky reports NightEagle, Hacking Cat and Toy Ghouls targeting Russian firms with Exchange exploits, backdoors, ransomware and wipers.