Recent cyberattack campaigns
Cyberattack campaigns reported in the last month, each from the government advisory or the security company's own research, summarised in our words with what to do about it.
21 campaigns first reported 6 October 2026 to 4 November 2026. Each row links to the advisory or research post it comes from; we name an actor or a sponsor only where that source does. "Unknown" means the source states no sponsor or motive. Indicators of compromise are left out: follow the source link for them. For the groups behind these campaigns, see Threat groups; for the flaws being used, Latest exploited vulnerabilities.
| Campaign | Actor (type) | Targets | Regions named | What happens, and the defence | First reported | Source |
|---|---|---|---|---|---|---|
| Sogou Input Method update hijack | SlippyNunchucks state-sponsored | Organisations and Chinese-speaking individuals using Sogou Input Method; a betting operator | Hong Kong; Thailand; Japan; Vietnam; Oman; Sri Lanka; occasional Europe | DNS manipulation redirected the software's plain-HTTP requests to attacker servers that returned a malicious configuration; update to version 16.10 or later, which uses HTTPS with pinning. | 4 November 2026 | ESET Research |
| Trojanised installer downloads | Not stated unknown | Users searching for cracked software, games and activators | Not stated | Fake cracked-software installers bundle proxyware and adware; block unknown executables and avoid cracks and activators. Microsoft notes the bundled products may have legitimate uses. | 3 November 2026 | Microsoft Threat Intelligence |
| Short-lived intelligence theft near the front line | Gorbag state-sponsored | Law enforcement and justice bodies, local administrations, defence sector, a military aid transport hub | Ukraine | Spearphishing attachments (Excel macros, then WinRAR archives exploiting CVE-2025-8088) deliver a stealer that grabs credentials, VPN settings and documents once; patch WinRAR and filter archive attachments. | 3 November 2026 | ESET Research |
| AI-orchestrated post-exploitation framework | Not stated unknown | Education-sector organisations | Africa; Latin America | Attackers got into SQL Server, then an AI orchestrator ran standard post-exploitation tools; normal detections (LSASS access, remote tasks, WMI movement) still catch it. | 2 November 2026 | Kaspersky Securelist |
| AI-ranked victim dossiers from a stealer | Not stated unknown | Individual Windows users (credentials, wallets, sessions) | Not stated | A self-deleting infostealer sends stolen data to an AI model that ranks what the victim's assets are worth; restrict headless browser launches, revoke tokens and rotate passwords after exposure. | 31 October 2026 | Cisco Talos |
| Tampered AI coding extension | Not stated unknown | Developers using the Cursor extension marketplace | Not stated | A tampered AI coding-assistant extension, served briefly in the Cursor marketplace, was built to plant a persistent SSH backdoor; restrict extensions to approved publishers. Served for a few hours in one marketplace; Microsoft found no impact on the Visual Studio Marketplace or the official npm package, and Anthropic said its systems were not compromised. | 30 October 2026 | Microsoft Threat Intelligence |
| AI-enabled command-and-control framework | Not stated unknown | Windows users (credentials, wallets, chat tokens); no sector named | Not stated | Go implant that steals credentials, can lock screens for ransom, and calls an AI model using the victim's own API key; watch for the persistence and lock behaviours Talos lists. | 29 October 2026 | Cisco Talos |
| Malware in a government-only Windows build | Not stated unknown | Asian government entities (inferred from one victim) | Asia | Likely supply-chain delivery through the Windows update download folder, then abuse of a trusted program's config file; hunt for stray .config files, AMSI tampering and unexpected CAB files. | 29 October 2026 | Kaspersky Securelist |
| SD-WAN controller implant | UAT-11473 unknown | Space and satellite, defence and aerospace, policy research | Not stated | Attackers exploited an SD-WAN controller authentication bypass to install persistent malware; patch CVE-2026-20127 and follow Cisco's hardening guidance. | 28 October 2026 | Cisco Talos |
| Fake AI desktop app downloads (Yoba) | Not stated unknown | People searching for ChatGPT, Claude or Cursor desktop apps | Not stated (skips CIS locales) | Fake GitHub projects ship a malicious DLL beside a real signed AI-vendor executable; observed payload was a cryptominer. Install only from official vendor sites. | 27 October 2026 | Check Point Research |
| Access handoff before a wiper attack | UAC-0099 and Sandworm state-sponsored | Grain logistics; government, finance and media | Ukraine | Spearphishing access handed to a destructive group that later wiped data; watch for command-and-control traffic over mesh networks. | 22 October 2026 | ESET Research |
| UEFI bootkit against diplomats | APT41 (medium confidence) state-sponsored | Diplomatic agencies | Tajikistan; Uzbekistan; Turkmenistan | After gaining admin rights, attackers install a bootkit using Baton Drop (CVE-2022-21894); admins must complete the manual certificate revocation, not just patch. | 22 October 2026 | Kaspersky Securelist |
| AI-automated cloud supply-chain compromise | Storm-0940 state-sponsored | Defence, energy, finance, government, technology, think tanks and more | Global (no countries named) | Supply-chain abuse of a backup app's cloud credentials to reach Microsoft 365 tenants; audit app-only sign-ins and consent grants. | 21 October 2026 | Microsoft Threat Intelligence |
| AI-assisted cybercrime against Indian targets | BUGSTER financially motivated | Universities, an online storefront, telecom/VoIP planning, crypto holders | India | Operator used AI agent tooling with safety limits removed for reconnaissance and attacks on websites; enforce strong admin passwords and MFA, restrict exposed databases, watch outbound traffic to AI and GPU services. | 21 October 2026 | Palo Alto Unit 42 |
| Government Linux server espionage | CL-UNK-1211 unknown | Government entities and state-affiliated infrastructure | Not stated | Web shells and credential theft on government Linux servers, with likely AI-written tooling; restrict outbound traffic and monitor shells. | 15 October 2026 | Palo Alto Unit 42 |
| Ephemeral update-server tampering at AOMEI | UNC7017 unknown | IT services, telecom, higher education | Australia; Brazil; India; Pakistan; Portugal; Singapore; South Africa; Spain; Switzerland; Turkiye; United States | Update configuration files were changed for minutes at a time (April to July 2026) so clients got a malicious update; search past logs for it and alert when an updater launches an unsigned program. | 15 October 2026 | Google Threat Intelligence Group (Mandiant) |
| Phishing-kit and stolen-cloud marketplace | Storm-2990 and Storm-3119 unknown | Healthcare, financial services, wholesale distribution, IT | United States; Japan; Australia; India | Phishing-kit and stolen-cloud marketplace behind mass email and SMS lures; use phishing-resistant MFA and verify unexpected messages. Disrupted by Microsoft's Digital Crimes Unit. | 14 October 2026 | Microsoft Threat Intelligence |
| China-linked automated and hands-on tooling for sensitive-data theft | Integrity Technology Group and China-linked threat actors (named in advisory) state-sponsored | Government services and facilities, critical manufacturing, healthcare and public health, information technology; US law enforcement, education, religious organisations | United States; Southeast Asia; Africa; North America | Joint advisory: China-linked actors mix automated and hands-on tools to steal sensitive data; follow the advisory's detection and hardening guidance. | 8 October 2026 | CISA (Alert AA26-281A) |
| Phishing of Taiwanese research organisations | UAT-11985 unknown | Research organisations and affiliated individuals | Taiwan | Event-themed emails and altered QR-code posters lead to a fake Google sign-in page that relays MFA; use phishing-resistant MFA and check links and QR codes. | 8 October 2026 | Cisco Talos |
| MATCHBOIL downloader updates | UAC-0099 (medium confidence) state-sponsored | Transport, manufacturing and energy firms; also government, finance, media | Ukraine | Spearphishing links to an archive with a script that fetches a downloader and backdoor; watch for scripts run from archives and new Run keys or scheduled tasks. | 8 October 2026 | ESET Research |
| Blinder Tunnel fake-recruiter coding test | CL-STA-1178 state-sponsored | Telecommunications, aviation and other critical infrastructure | Iraq; Israel; United Arab Emirates | Fake airport IT recruiter sends a coding challenge whose project file runs code when opened in the IDE; secure developer environments and watch for DLL sideloading and abnormal cloud-platform traffic. | 6 October 2026 | Palo Alto Unit 42 |