Angry Birds: Toy Ghouls’ new toys

Kaspersky Securelist threat intelligence feed covering August–September 2026 activity, including newly identified backdoors, APT campaigns, malware distribution chains, industrial-control threats, Android proxy botnets, kernel-level rootkits, exploitation of unpatched TrueConf servers, and covert C2 using MQTT, Matrix, Google Apps Script, and DNS. The collection includes espionage, credential and Telegram-data theft, persistence, defense evasion, and attacks against aviation, FinTech, Middle Eastern and African organizations, Israel, ICS environments, and video-conferencing users.