OceanLotus: From external espionage to domestic targeting

Collection of ESET WeLiveSecurity briefings (Mar–Jun 2026) summarizing active APT and malware activity, notable supply‑chain and mobile threats, and broader defensive guidance. Key technical findings include OceanLotus shifting toward domestic targeting, discovery of GopherWhisper targeting Mongolian government entities, Webworm and FrostyNeighbor tooling/technique updates, a ScarCruft supply‑chain compromise of gaming platforms, a new NGate variant hidden in a trojanized NFC payment app (potentially AI‑assisted), EDR‑killer abuse of vulnerable drivers, and a stealthy Android RAT (BTMOB). The