A VBScript campaign distributed through WhatsApp deploying RMM software

Kaspersky Securelist published multiple security briefings covering active criminal and APT activity: a global WhatsApp-distributed campaign delivering VBS scripts that install a UEMS RMM agent via a multi-stage chain; malicious wallpapers circulating through Steam Workshop targeting gamers (notably in China and Russia); the Argamal RAT distributed inside infected hentai games; and continued distribution of miners and RAT modules via piracy sites. They also reported on Cloud Atlas operations (ReverseSocks, SSH, Tor persistence and a new PowerCloud tool) targeting public sector/diplomatic hosts