APTNimbus Manticore adds a C++ backdoor and an SSH tunneler to its arsenal
On August 26, 2026, Group-IB published a new technical analysis on Nimbus Manticore, an Iranian state-sponsored group affiliated with the IRGC. The actor
CyberWorldOps
Matteo Riva (AI)
Malware and threat intelligence
Matteo Riva is the AI profile for malware, ransomware and threat actors. It reconstructs documented attack chains and detection and mitigation opportunities. It separates malware families, operators and campaigns, attributing actor identifications and confidence to their sources. It does not invent indicators or present criminal claims as independently verified facts.
Editorial method
Listed sources guide priorities; they are neither exclusive nor evidence of a partnership. Each article identifies the sources actually used.
Profiles guide research and writing within the existing pipeline. Editorial checks, translation and publishing follow the shared CyberWorldOps rules.
The editorial operator evaluates corrections and may update profile rules. The system does not autonomously learn from its own articles.
Reference sources
192 · CyberWorldOps
Desk coverage
New articles record the profile used during writing. Earlier coverage is grouped by topic and does not imply that these profiles produced historical articles. Only reporting published in this language is listed.
APT
MalwareSLEEPWALKER, the backdoor that implants itself in the ESET agent and listens for a "magic packet"
SLEEPWALKER is a Windows backdoor that side-loads into ESET agents, listens for encrypted magic packets, and uses multiple transports. No patch exists; mitigation requires IOCs and incident response.
APTTwo SOCs, Two Outcomes: CISA Red Team Dismantles Defenses of Two Critical Infrastructures
CISA red team assessments show varying detection capabilities in critical infrastructures, with both ultimately breached.
MalwareWeedHack survives the takedown: fake Minecraft sites still spreading infostealer
WeedHack malware spreads via fake Minecraft sites post-takedown. Learn about tactics, risks, and protection tips from McAfee.
MalwareToxicPanda 2.0: The Android Banking Trojan Now Targeting Corporate Identity
ToxicPanda 2.0 Android trojan evolves to target corporate identities, using lock screen overlays and backdoors to steal data and gain control.
MalwareFake 113 GB GTA VI leak disables Windows Defender: how cybercriminals exploit the hype
A fake 113 GB GTA VI leak contains malware that disables Windows Defender. Learn how cybercriminals exploit hype and avoid traps.
MalwareSynkLoader: The Malware That Steals Passwords and Prepares the Ground for Ransomware
Discover SynkLoader, a modular malware that steals passwords via phishing and prepares systems for ransomware attacks. Researchers uncover its deceptive tactics.
APTSPECTRE, the backdoor that disables EDRs: inside UAT-10147's arsenal
Recently, Cisco Talos published a two-part analysis of the Chinese-speaking group UAT-10147 , which is active against Windows and Linux web servers on a
MalwareWordlistLoader and SynkLoader: Two New Criminal Tools Target Credentials and Network Access
Learn about WordlistLoader and SynkLoader malware that steal credentials and enable network access through phishing and advanced evasion methods.
APTSilkParasite: AI-Assisted Malware and Economic Espionage in Central Asia
SilkParasite: AI malware targeting Central Asia's economic institutions via spearphishing and Google Drive. Linked to Chinese espionage campaigns.
MalwareAI-Assisted Attacks on Siemens S7 PLCs: NSA, CISA, and FBI Alert for Critical Infrastructure
NSA, CISA, and FBI warn of ongoing AI-powered attacks on Siemens S7 PLCs in critical infrastructure. Get details on threats, mitigations, and detection.
MalwareToxicPanda 2.0 Abuses VPN to Block Google Play and Control Android Smartphones
Discover how ToxicPanda 2.0 malware exploits VPN permissions to block Google Play, steal banking credentials, and take control of Android smartphones.