Pirates in the crosshairs: how one cybercrime gang has been infecting book, movie, and TV show fans for years
2026-05-28T08:51:52Z•2ec843d6a176c7d6dfeb114499686af8ccc9d0411c362779cfba0d7d8f696f85
APTLinuxWindowsappleSeedcloud-atlasexiftoolkimsukymacOSmineroceanlotuspebbledashpyPIransomwareratrceremote-code-executionsupply-chainthreat-inteltriagevulnerabilityxrdp
What happened
Collection of Kaspersky Securelist reports (May 2026) describing multiple active threats and notable vulnerabilities: consumer-focused campaigns delivering miners and a new RAT via pirated-content sites; Cloud Atlas APT targeting Russian and Belarusian public/diplomatic entities using ReverseSocks, SSH, Tor and a new PowerCloud tool; supply-chain abuse via malicious PyPI wheels attributed to OceanLotus delivering ZiChatBot; Kimsuky using PebbleDash tools linked to the AppleSeed cluster; Q1 2026 telemetry on mobile, PC/IoT malware and ransomware trends (EDR killers, shift to data leaks); and at
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 2ec843d6a176c7d6dfeb114499686af8ccc9d0411c362779cfba0d7d8f696f85
- Enrichment time
- 2026-05-28T08:51:52Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.