The calm before the ransom: What you see is not all there is

Collection of ESET WeLiveSecurity research and advisories (Jan–Apr 2026) highlighting multiple active threat trends: discovery of a new China-aligned APT dubbed “GopherWhisper” targeting Mongolian government entities; a new NGate malware variant hidden in a trojanized NFC payment app (possible AI-assisted development); PromptSpy — the first known Android malware to incorporate generative AI into its execution flow; analysis of EDR-killer tooling that abuses vulnerable drivers; technical coverage of DynoWiper (attributed to Sandworm) — a destructive data-wiping incident affecting Poland’s power