
Fake Recruiters Deploy NodeRabbit and PollCat: Nimbus Manticore’s New Cross-Platform RATs
Iran's Nimbus Manticore lures developers with fake LinkedIn coding tests to deploy NodeRabbit and PollCat RATs for cross-platform espionage.

Iran's Nimbus Manticore lures developers with fake LinkedIn coding tests to deploy NodeRabbit and PollCat RATs for cross-platform espionage.

Sygnia uncovers Fire Ant's cyber-espionage expanding to Cisco IOS XR routers, TACACS servers, and Linux hosts using invisible tunnels and credential theft.

On 13 August 2026, Hunt.io researchers identified an unprotected server in Amsterdam 31.58.209 . 241 exposing a Python SimpleHTTP directory on port 8000.

Between late September 2025 and early April 2026, government and diplomatic organizations in Romania, Spain, and Turkey were targeted by a cyber espionage

On August 27, 2026, CISA added three new vulnerabilities to the Known Exploited Vulnerabilities KEV catalog. The most severe is CVE-2023-49105, an

GoCaracal malware by Dark Caracal discovered, with dual variants and Ethereum-based C2 backup for advanced espionage operations.

FBI disrupts Chinese hacking platforms QScan and QTRouter used to attack US critical infrastructure, including NASA and Federal Reserve.

DOJ seizes Chinese QScan and QTRouter platforms used to hack US agencies and infrastructure, part of ongoing cyber operations.

On August 26, 2026, Group-IB published a new technical analysis on Nimbus Manticore, an Iranian state-sponsored group affiliated with the IRGC. The actor