Angry Birds: Toy Ghouls’ new toys

Kaspersky Securelist feed covering recent threat intelligence on backdoors, APT campaigns, malware delivery, industrial control system threats, Android proxy botnets, kernel-level rootkits, exploitation of unpatched servers, and evasive C2 techniques. Notable activity includes Toy Ghouls using HiveMQ MQTT and Element for command and control, Mirage Kitten malware targeting aviation and FinTech in the Middle East and Africa, HoneyMyte deploying a kernel-mode CoolClient rootkit, Head Mare exploiting vulnerable TrueConf servers, and Project CAV3RN using Google Apps Script and DNS-based C2 routing