ares

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

Russian police in the Rostov region arrested a Taganrog resident believed to be the owner and administrator of LeakBase, a major online forum used by cybercriminals to buy and sell stolen data and hacking tools. According to a report from the Russian state-owned news agency TASS, Russian Ministry of Internal Affairs spokesperson Irina Volk, who announced the arrest, said the unnamed suspect is also accused of creating the LeakBase hacker platform. LeakBase surfaced in 2021 as a project supported by the ARES threat group, gradually growing its user base to over 142,000 members after the Breached hacker forum shut down in March 2023. The forum was free to join and was used by members to sell stolen databases, data leaks, exploits, and other cybercrime services, and also hosted spaces for programming, hacking tips, social engineering, cryptography, and opsec guides. In March 2026, the FBI and law enforcement agents in 14 other countries took down the LeakBase cybercrime forum in an international joint operation coordinated by Europol, known as "Operation Leak." Investigators also executed search warrants, conducted interviews, and made arrests in the United States and across Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom. The LeakBase website (leakbase[.]la) now displays a notice warning that "This website has been seized by the Federal Bureau of Investigation (FBI) as part of an international law enforcement operation." The seizure banner also notes that the forum's database and its contents, including private messages and IP logs, will be used as evidence in future investigations. "On 3 March, law enforcement authorities carried out coordinated enforcement actions across multiple jurisdictions, including arrests, house searches, and 'knock-and-talk' interventions. Around 100 enforcement actions were conducted worldwide, including measures against 37 of the most active users of the platforms," Europol said at the time. "On 4 March, authorities moved to the technical disruption phase, seizing the forum's domain and replacing it with a law enforcement splash page. The operation now enters a prevention phase aimed at deterring further criminal activity and raising awareness of the consequences of engaging in cybercrime." LeakBase was shut down after law enforcement took down RaidForums in 2022 and BreachForums in 2023, two other major cybercrime marketplaces that preceded it. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

As hundreds of vendors descend on San Francisco for the RSAC 2026 Conference, the sheer volume of news can be overwhelming. To help you navigate the noise, SecurityWeek is providing a daily digest of the most significant announcements. Below is our curated roundup of essential product and service updates, along with reports from the second day of the event. Roundups of announcements from day 1 and the days leading up to the conference are also available. Offensive security firm Assail has launched Ares, an autonomous red-teaming platform designed to discover, chain, and exploit vulnerabilities across APIs, mobile applications, and web applications. Ares is a self-healing, self-teaching platform that autonomously adapts attack strategies in real time and requires no hands-on expertise to manage. BlackCloak has released three new capabilities for its Digital Executive Protection platform. Impersonation Protection, now enhanced with device-level biometric validation and geolocation signals, lets BlackCloak members authenticate the legitimacy of communications from other members in real time via the mobile app. Search Suppression complements the existing Data Broker Removal service by automatically suppressing a member’s PII from search engine results while broker removal requests are still being processed. Member Travel Advisory (coming this spring) delivers AI-synthesized, continuously updated risk analysis across cybersecurity, physical, geopolitical, and social dimensions for every country directly within the app. ConductorOne announced a new integration with CrowdStrike Falcon Next-Gen Identity Security that feeds live threat signals drawn from real-time detections, behavioral analytics, and threat intelligence directly into ConductorOne’s access governance workflows. Security teams can filter and prioritize high-risk identities during access reviews and approval decisions based on real-time activity, rather than risk scores. ConductorOne’s policy engine can also use those Falcon signals to automate responses and trigger a review, deny access, or revoke entitlements the moment risk levels shift. Cyera has introduced a new suite of capabilities, including Browser Shield for AI and Data Lineage, to provide real-time visibility into how employees and autonomous agents interact with sensitive data. Browser Shield prevents data exposure at the prompt level within public AI models, while the Data Lineage tool automatically maps how agents move and transform files across their lifecycle. Additionally, the new Cyera MCP allows security teams to build their own data security agents to automate threat hunting and risk remediation using plain-language queries. CrowdStrike launches cloud security innovations, Falcon Data Security, Agentic MDR CrowdStrike announced new Falcon Cloud Security enhancements to help eliminate cloud risk through adversary-informed prioritization. Organizations can identify cloud exposures most likely to be exploited and their root causes, enabling faster remediation. CrowdStrike also introduced Falcon Data Security, a new data security solution that stops data theft across the agentic enterprise. Falcon Data Security discovers, classifies, and stops data theft in real time. The security giant also unveiled Agentic MDR for managed detection and response. Falcon Complete’s analysts build and deploy intelligent agents to automate high-friction security workflows and stop breaches. Darktrace launches adaptive security awareness training and introduces MSSP offering Darktrace has announced Adaptive Human Defense, which replaces scheduled security awareness training with behavioral AI-driven micro-coaching sessions delivered in real time as risks appear in a user’s inbox. Darktrace also unveiled an expansion of Darktrace / EMAIL to include full-message, cross-channel analysis across email, Microsoft Teams, Slack, and Zoom, enabling detection of blended social engineering campaigns across all four platforms, including prompt-injection threats targeting corporate AI assistants. The company also announced a new managed email security offering for MSSPs, built on Darktrace / EMAIL’s Self-Learning AI. Drata has released three new agentic AI capabilities for its trust management platform. The first, Agentic TPRM Assessment (now generally available), automates vendor security reviews by autonomously accessing live evidence from Drata Trust Centers, evaluating controls against defined criteria, and generating findings, follow-ups, and executive reports. The second, Agentic Questionnaire Response (in beta), manages the full security questionnaire lifecycle from intake and drafting to SME collaboration and final delivery, with configurable human-in-the-loop controls. The third, AI Trust Center Creation, ingests a customer’s existing artifacts and quickly auto-generates a complete Trust Center preview. Eclypsium has released the Eclypsium Supply Chain Security Platform version 4.3. The latest version of the platform provides continuous monitoring of network edge devices for vulnerabilities, indicators of compromise, and unknown binaries that may harbor vulnerabilities and custom malware introduced via the IT supply chain. GC Cybersecurity has unveiled its 5th generation Autonomous Data Protection Platform. The new ISE Autonomous Data Protection Platform is designed to address the growing risk of sensitive data exposure across AI, cloud, and SaaS environments. Powered by agentic AI and a 5th generation cybersecurity architecture, the platform continuously discovers, classifies, and protects data in real time, going beyond traditional perimeter-based defenses. Hadrian has released Nova, an agentic pentesting product that autonomously simulates offensive techniques against an organization’s external attack surface, including chaining vulnerabilities and escalating access across real assets. Testing is customer-scoped and repeatable on demand, with findings reviewed by human experts before delivery. Nova is priced per test and is available immediately. KnowBe4 launches phishing alert button for Microsoft Teams and expands platform KnowBe4 is extending its one-click Phish Alert Button (PAB) to Microsoft Teams, allowing users to report suspicious messages directly within the collaboration platform. The integration enables security teams to manage threats from both email and Teams within a single, streamlined workflow. KnowBe4 also expanded its Artificial Intelligence Defense Agents (AIDA) platform with deepfake training agents that generate custom, high-fidelity deepfake simulations featuring an organization’s own leaders to train employees on how to spot AI-generated impersonations. Living Security announced the general availability of its AI-native Human Risk Management platform. Powered by the Livvy AI risk intelligence engine, the platform is designed to secure the “hybrid workforce” — both human employees and AI agents operating across enterprise systems. The platform analyzes behavioral signals across the workforce to identify risk, explain why it matters, and guide remediation before incidents occur. Huntress has expanded its Managed Identity Threat Detection & Response (ITDR) product to cover Google Workspace, adding to its existing Microsoft 365 coverage. The solution detects anomalous authentication activity, attacker-created Gmail inbox rules designed to suppress MFA notifications or hide security alerts, and logins from data center providers commonly associated with threat actors. iCOUNTER announced the general availability of its Counter Threat Operating System (CTOS), a new platform designed to introduce “compromise intelligence” as a control layer for third-party risk. The initial release includes CTOS-TPR, which detects early-stage adversary activity such as reconnaissance and targeting aimed at vendors and partners. By continuously monitoring threat activity and mapping it against an organization’s extended ecosystem, CTOS enables companies to identify and act on risks before they lead to breaches. Miggo is expanding its Runtime Defense Platform to protect AI and agentic environments, with new capabilities including AI-BOM, runtime guardrails and agentic detection and response. It tackles the fact that agents are making decisions dynamically at runtime, so security teams need visibility and protection where models, tools and data actually interact. The enhancement gives security teams visibility and control over AI agents, MCP toolchains and Shadow AI running in production. NetRise launched Provenance, a new product that identifies risk associated with contributors to the open source components inside enterprise software and connected devices. Provenance adds a layer of trust and intelligence to the NetRise Platform, enabling teams to see a variety of project health signals, including advisory relationships and how compromises propagate through dependency graphs, defining a blast radius from a malicious contributor. Novee has launched autonomous AI red teaming for LLM applications, designed to uncover flaws in chatbots, copilots, and agents. It tests for real AI-specific attack paths such as prompt injection, jailbreaks and agent manipulation rather than relying on traditional appsec approaches that were not built for AI behavior. Nudge Security adds new AI agent discovery capabilities Nudge Security announced an expansion of its platform with the addition of AI agent discovery, enabling customers to gain immediate visibility and control over agent identity and permissions. The new capabilities discover AI agents at the source of creation, understand their access risks, and engage their human creators to gain additional context regarding the scope of use for each agent. RSA has announced expanded integration with Microsoft, adding support for the new Microsoft 365 E7: The Frontier Suite through RSA ID Plus for Microsoft, which provides authentication for both human users and AI agents across hybrid, cloud, and on-premises environments. Separately, RSA announced several new passwordless enhancements: a next-generation desktop passwordless client for macOS and Windows, enhanced mobile passkeys with proximity verification, and datacenter passwordless support for Linux and other OS servers. Sectigo has introduced the Sectigo Partner Platform (SPP), a multi-tenant CLM platform designed for MSPs, MSSPs, VARs, and distributors. Unlike single-tenant alternatives, SPP gives each end customer a fully isolated tenant with separate certificate inventories, usage reporting, billing, and admin controls, all managed through a single partner interface. The platform integrates with Sectigo Certificate Manager (SCM) and automates certificate validation, issuance, and renewal workflows. SPP is currently available to a limited number of channel partners, with broader rollout planned. SentinelOne and LevelBlue are combining SentinelOne’s Purple AI and Singularity Platform with LevelBlue’s threat intelligence and Indigo platform to give organizations a unified, AI-powered security operations model, covering MDR, managed SIEM, and incident response in one place. The goal is to reduce dwell time and fragmentation that make most enterprise security stacks hard to manage. Sentra announced a new solution to help organizations securely adopt Google Workspace with Gemini by addressing key AI adoption risks. The platform tackles four core risks: shadow and unused sensitive data, over-permissioning, incorrect or missing labels, and data leakage through AI-generated outputs, using in-place discovery, classification and automated labeling. These capabilities give organizations the visibility and controls needed to maintain data governance, compliance and cost efficiency while preparing for AI. Skyhawk Security has introduced a new Threat Actor Context capability that maps simulated cloud attack scenarios to known adversary tradecraft, campaigns and CVEs. The product enhancement was built for prioritization. It gives security teams more context on which attack paths are most relevant based on real-world threat activity, helping them focus on the true risks to critical assets. Tenable has introduced Hexa AI, an agentic AI engine within the Tenable One platform that automates security workflows and transforms exposure intelligence into coordinated action. Hexa AI helps security teams prioritize and remediate risk at machine speed across IT, cloud, identity and AI environments. By leveraging Tenable’s Exposure Data Fabric, the platform enables organizations to move from reactive response to proactive, continuous risk reduction. Vectra AI has expanded its platform with three new exposure management capabilities. The first is a passive, agentless continuous asset inventory that automatically discovers and tracks unmanaged, OT, and IoT devices across hybrid environments. The second is proactive exposure detection, which identifies observed security and compliance gaps such as risky protocol usage, weak encryption patterns, and exposed credential files. The third is environment observability, providing network-wide visibility into PQC readiness, Zero Trust posture, data movement, and network performance. Zscaler publishes threat research and announces new integrations Zscaler has published its Threatlabz 2026 VPN Risk Report, which shows that 51% of organizations experienced a VPN-related security incident in the past 12 months. The study also found that only 5% trust their VPN infrastructure to detect and stop AI-enabled threats, and only 6% of organizations can deploy a critical VPN patch within 24 hours. Zscaler also announced that it’s now part of Databricks’ new Open Security Lakehouse Ecosystem, which unifies all structured and unstructured security data into a single platform that integrates with any tool to enable social engineering detection, insider threat detection, and anomaly detection.

The FBI has seized the LeakBase cybercrime forum, a major online forum used by cybercriminals buy and sell hacking tools and stolen data. This seizure action is part of an international joint operation coordinated by Europol, known as "Operation Leak," that involved law enforcement agencies in 14 countries. On March 3 and 4, the FBI and law enforcement agents shut down LeakBase by seizing two of its domains, posting seizure banners, and warning LeakBase members of the seizure after collecting further evidence. Police officers and investigators also executed search warrants, made arrests, and conducted interviews in the United States and across Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom. LeakBase's domain (leakbase[.]la) now displays a notice stating "This website has been seized by the Federal Bureau of Investigation (FBI) as part of an international law enforcement operation." The seizure banner also notes that the forum's database and all its contents, including IP logs and private messages, will be used for "evidentiary purposes" in future investigations. "All forum content including users' accounts, posts, credit details, private messages and IP logs have been secured and preserved for evidentiary purposes," the notice reads. "Attempts to access, alter, or interfere with this site may result in additional criminal offenses. This action was possible because of international law enforcement and private sector coordination involving the partners listed below." The domain nameservers have also been switched to ns1.fbi.seized.gov and ns2.fbi.seized.gov, the nameservers used by the FBI when seizing domains. "On 3 March, law enforcement authorities carried out coordinated enforcement actions across multiple jurisdictions, including arrests, house searches, and 'knock-and-talk' interventions. Around 100 enforcement actions were conducted worldwide, including measures against 37 of the most active users of the platforms," Europol added today. "On 4 March, authorities moved to the technical disruption phase, seizing the forum's domain and replacing it with a law enforcement splash page. The operation now enters a prevention phase aimed at deterring further criminal activity and raising awareness of the consequences of engaging in cybercrime." Active since 2021, LeakBase was launched as a project supported by the ARES threat group, and it gradually grew its user base to more than 142,000 members following the closure of the Breached hacker forum. The forum was free to join and offered access to databases, a market for selling leaks, exploits, and other cybercrime services, and an escrow payment system. In addition, it also hosted spaces for programming, hacking tips, social engineering, cryptography, and opsec guides. Today's announcement follows the disruption of RaidForums in 2022 and BreachForums in 2023, two cybercrime marketplaces that preceded it, as well as the BreachForums founder's conviction and sentencing in 2025. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The threat activity cluster known as SloppyLemming has been attributed to a fresh set of attacks targeting government entities and critical infrastructure operators in Pakistan and Bangladesh. The activity, per Arctic Wolf, took place between January 2025 and January 2026. It involves the use of two distinct attack chains to deliver malware families tracked as BurrowShell and a Rust-based keylogger. "The use of the Rust programming language represents a notable evolution in SloppyLemming’s tooling, as prior reporting documented the actor using only traditional compiled languages and borrowed adversary simulation frameworks such as Cobalt Strike, Havoc, and the custom NekroWire RAT," the cybersecurity company said in a report shared with The Hacker News. SloppyLemming is the moniker assigned to a threat actor that's known to target government, law enforcement, energy, telecommunications, and technology entities in Pakistan, Sri Lanka, Bangladesh, and China since at least 2022. It's also tracked under the names Outrider Tiger and Fishing Elephant. Prior campaigns mounted by the hacking crew have leveraged malware families like Ares RAT and WarHawk, which are often attributed to SideCopy and SideWinder, respectively. ArcticWolf's analysis of the latest attacks has uncovered the use of spear-phishing emails to deliver PDF lures and macro-enabled Excel documents to kick-start the infection chains. It described the threat actor as operating with moderate capability. The PDF decoys contain URLs designed to lead victims to ClickOnce application manifests, which then deploy a legitimate Microsoft .NET runtime executable ("NGenTask.exe") and a malicious loader ("mscorsvc.dll"). The loader is launched using DLL side-loading to decrypt and execute a custom x64 shellcode implant codenamed BurrowShell. "BurrowShell is a full-featured backdoor providing the threat actor with file system manipulation, screenshot capture capabilities, remote shell execution, and SOCKS proxy capabilities for network tunneling," Arctic Wolf said. "The implant masquerades its command-and-control (C2) traffic as Windows Update service communications and employs RC4 encryption with a 32-character key for payload protection." The second attack chain employs Excel documents containing malicious macros to drop the keylogger malware, while also incorporating features to conduct port scanning and network enumeration. Further investigation of the threat actor's infrastructure has identified 112 Cloudflare Workers domains registered during the one-year time period, marking an eight-fold jump from the 13 domains flagged by Cloudflare in September 2024. The campaign's links to SloppyLemming are based on continued exploitation of Cloudflare Workers infrastructure with government-themed typo-squatting patterns, deployment of the Havoc C2 framework, DLL side-loading techniques, and victimology patterns. It's worth noting that some aspects of the threat actor's tradecraft, including the use of ClickOnce-enabled execution, overlap with a recent SideWinder campaign documented by Trellix in October 2025. "In particular, the targeting of Pakistani nuclear regulatory bodies, defense logistics organizations, and telecommunications infrastructure – alongside Bangladeshi energy utilities and financial institutions – aligns with intelligence collection priorities consistent with regional strategic competition in South Asia," Arctic Wolf said. "The deployment of dual payloads – the in-memory shellcode BurrowShell for C2 and SOCKS proxy operations, and a Rust-based keylogger for information stealing – suggests the threat actor maintains flexibility to deploy appropriate tools based on target value and operational requirements."

A Glendale man was sentenced to nearly five years in federal prison for his role in a darknet drug trafficking operation that sold cocaine, methamphetamine, MDMA, and ketamine to customers across the United States. 36-year-old Davit Avalyan received a 57-month sentence from U.S. District Judge Percy Anderson in Los Angeles after pleading guilty in October 2025 to one count of conspiracy to distribute narcotics. Avalyan is the last of four defendants to be sentenced in the case. His accomplices, Hayk Grigoryan (also known as Hayk Greg), Gurgen Nersesyan (also known as Guro Tiko), and Hrant Gevorgyan, have already received prison sentences of 10 years, 43 months, and 24 months, respectively. Prosecutors said Avalyan and his co-conspirators ran the operation from September 2018 to February 2025, maintaining a large network of darknet vendor accounts (including multiple storefronts with names like JoyInc, PlanetHollywood, and LaFarmacia) across multiple narcotics online marketplaces. According to court documents, the group packaged drugs into parcels and mailed them from post offices and mailboxes throughout Los Angeles County and other locations. JoyInc, one of the network's primary accounts, is believed to have launched as early as 2018 and is considered among the most prolific methamphetamine and cocaine distributors ever to operate on the darknet. "Vendors JoyInc, LaFarmacia, WhiteDoc, JanesAddiction, DaShop, WhiteRepublic, Tomorowland, PlanetHollywood, DopeValley, and Major2Minor sold cocaine, methamphetamine, 3, 4-Methylenedioxymethamphetamine ('MDMA'), and ketamine to drug customers on these darknet markets in exchange for cryptocurrency, such as Bitcoin and Monero, and shipped the drugs throughout the United States via the United States Postal Service," the indictment reveals. Their accounts were active "on several darknet marketplaces, including Dream Market, Wallstreet, Empire, Silk Road 3.1, ToRReZ, Dark0de, World Market, Tor2Door, alphabay, Incognito, ASAP, Ares, MGM Grand, Archetyp, Abacus, DrugHub, and DarkMatter and would sell methamphetamine, cocaine, MDMA, and ketamine to customers across the United States." The FBI's JCODE (Joint Criminal Opioid Darknet Enforcement) team, a task force focused on dismantling criminal networks that use the darknet to traffic narcotics, led the investigation with support from the U.S. Postal Inspection Service, the Drug Enforcement Administration, the IRS Criminal Investigation, and the Los Angeles Police Department. Earlier this month, a Taiwanese man was also sentenced to 30 years in prison for operating Incognito Market, a massive online narcotics marketplace linked to over $105 million in illegal drug sales. In January, a Slovakian national pleaded guilty to helping operate a darknet marketplace that sold narcotics, cybercrime services, fake government IDs, and stolen personal information for more than two years, and a Virginia man who co-created the Empire Market dark web marketplace admitted to federal drug conspiracy charges for facilitating $430 million in illegal transactions. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Indian defense sector and government-aligned organizations have been targeted by multiple campaigns that are designed to compromise Windows and Linux environments with remote access trojans capable of stealing sensitive data and ensuring continued access to infected machines. The campaigns are characterized by the use of malware families like Geta RAT, Ares RAT, and DeskRAT, which are often attributed to Pakistan-aligned threat clusters tracked as SideCopy and APT36 (aka Transparent Tribe). SideCopy, active since at least 2019, is assessed to operate as a subdivision of Transparent Tribe. "Taken together, these campaigns reinforce a familiar but evolving narrative," Aditya K. Sood, vice president of Security Engineering and AI Strategy at Aryaka, said. "Transparent Tribe and SideCopy are not reinventing espionage – they are refining it." "By expanding cross-platform coverage, leaning into memory-resident techniques, and experimenting with new delivery vectors, this ecosystem continues to operate below the noise floor while maintaining strategic focus." Common to all the campaigns is the use of phishing emails containing malicious attachments or embedded download links that lead prospective targets to attacker-controlled infrastructure. These initial access mechanisms serve as a conduit for Windows shortcuts (LNK), ELF binaries, and PowerPoint Add-In files that, when opened, launch a multi-stage process to drop the trojans. The malware families are designed to provide persistent remote access, enable system reconnaissance, collect data, execute commands, and facilitate long-term post-compromise operations across both Windows and Linux environments. One of the attack chains is as follows: a malicious LNK file invokes "mshta.exe" to execute an HTML Application (HTA) file hosted on compromised legitimate domains. The HTA payload contains JavaScript to decrypt an embedded DLL payload, which, in turn, processes an embedded data blob to write a decoy PDF to disk, connects to a hard-coded command-and-control (C2) server, and displays the saved decoy file. After the lure document is displayed, the malware checks for installed security products and adapts its persistence method accordingly prior to deploying Geta RAT on the compromised host. It's worth noting this attack chain was detailed by CYFIRMA and Seqrite Labs researcher Sathwik Ram Prakki in late December 2025. Geta RAT supports various commands to collect system information, enumerate running processes, terminate a specified process, list installed apps, gather credentials, retrieve and replace clipboard contents with attacker-supplied data, capture screenshots, perform file operations, run arbitrary shell commands, and harvest data from connected USB devices. Running parallel to this Windows-focused campaign is a Linux variant that employs a Go binary as a starting point to drop a Python-based Ares RAT by means of a shell script downloaded from an external server. Like Geta RAT, Ares RAT can also run a wide range of commands to harvest sensitive data and run Python scripts or commands issued by the threat actor. Aryaka said it also observed another campaign where the Golang malware, DeskRAT, is delivered via a rogue PowerPoint Add-In file that runs embedded macro to establish outbound communication with a remote server to fetch the malware. APT36's use of DeskRAT was documented by Sekoia and QiAnXin XLab in October 2025. "These campaigns demonstrate a well-resourced, espionage-focused threat actor deliberately targeting Indian defense, government, and strategic sectors through defense-themed lures, impersonated official documents, and regionally trusted infrastructure," the company said. "The activity extends beyond defense to policy, research, critical infrastructure, and defense-adjacent organizations operating within the same trusted ecosystem." "The deployment of DeskRAT, alongside Geta RAT and Ares RAT, underscores an evolving toolkit optimized for stealth, persistence, and long-term access."

Indian government and defense organizations are being targeted by multiple espionage campaigns delivered by the Pakistan-attributed Transparent Tribe (aka APT36), according to a newly released threat report. These campaigns target both Windows and Linux. One active campaign employs GETA RAT (often specifically attributed to the SideCopy subgroup of Transparent Tribe). It is a dot-NET RAT that abuses legitimate Windows components (including mshta.exe, XAML deserialization, and in-memory payload execution) to avoid signature based detection. Persistence is achieved by layered startup mechanisms that ensure continued access. “The result,” writes Aditya Sood, VP of security engineering and AI strategy at Aryaka in a report-accompanying blog, “is a lightweight but durable foothold, well-suited for extended reconnaissance and intelligence gathering.” A separate campaign targets Linux environments with ARES RAT and system-level persistence. ARES, a Python-based tool long associated with Transparent Tribe, uses a Go-based downloader. When deployed, it performs system profiling, recursive file enumeration, and structured data exfiltration. “Persistence was achieved through systemd user services, allowing the malware to survive reboots while blending into normal system operations,” writes Sood. Aryaka has also detected Transparent Tribe campaigns using a newer and emerging tool: Desk RAT. This is Go-based and distributed via a malicious PowerPoint Add-In. It collects detailed system diagnostics and communicates with its operators using WebSocket-based command-and-control. “This design enables continuous situational awareness on compromised hosts, reinforcing APT36’s long-term surveillance objectives,” writes Sood. (Earlier Go-based malware includes BlackCat/ALPHV ransomware, and the Vampire Bot job-seeker scam.) Aryaka provides a detailed examination of these three malwares and methods of infection in a separate report. The key elements are persistence and stealth. “Initial access in the observed campaigns relies on phishing emails delivering weaponized attachments or embedded download links that lead to malicious LNK files, ELF binaries, HTA scripts, and PowerPoint add-ins,” notes the analysis report. “Execution and loader activity abuses living-off-the-land binaries such as mshta.exe, PowerShell, and scripting engines to retrieve and execute payloads in memory,” it continues. “For command-and-control, the observed malware families – GETA RAT, ARES RAT, and Desk RAT – use encrypted TCP or WebSocket-based communication with periodic heartbeat patterns to maintain persistence.” Sood, however, is keen to stress that such state-sponsored attacks are indicative of a global increase in state espionage attacks. This is no longer adversarial nations pre-positioning themselves in critical industries in case of, or ahead of, a potential kinetic war, but economic intelligence gathering in the face of an increasing global trade and tariff war. “Sometimes,” explains Sood, “unexpected trade deals happen between nations, involving billions and billions of dollars in import or export. There’s a lot of money to be made for a nation’s economy through trade. India, for example, is raising its defense budget by 4% this year, and there are many nations that would like to know what they intend to do with the money.” Aryaka’s analysis of the Persistence Tribe campaigns serves two purposes. Firstly, it provides deep analytical insight into the type of tools used in this new global trade war, and secondly it highlights that politically adversarial nation states are no longer the primary ‘enemy’. Friendly nations will increasingly target other friendly countries and their potential rival companies seeking nothing more (nor less) than economic advantage in trade and tariff wars. The combination of nation state attacks caused by the continuing geo-political tensions together with growing economic attacks from elite groups such as Persistence Tribe, suggests we can expect more nation state attacks in the future. And the analyses of the GETA, ARES, and DESK RATs, with their focus on persistence and stealth, highlights the difficulties cybersecurity practitioners will face in the future. Related: Cyber Insights 2026: Cyberwar and Rising Nation State Threats Related: Pakistani APT Uses YouTube-Mimicking RAT to Spy on Android Devices Related: ‘Stanley’ Malware Toolkit Enables Phishing via Website Spoofing