Angry Birds: Toy Ghouls’ new toys
2026-09-08T20:51:46Z•4b50a8217339744286a9c57ff6fff19083050deef4adc9b31c7a3c87d4a7d9dc
AI-securityAPTAndroidDNS C2ElementGoogle Apps ScriptICSJavaScriptMQTTMatrixMiddle East and AfricaNode.jsTelegramTrueConfValleyRATWindowsadwarebackdoorcommand-and-controlcyber-espionageindustrial-control-systemskernel-rootkitmalwareproxy-botnetvulnerability-exploitation
What happened
Kaspersky Securelist intelligence covering August–September 2026 threats, including backdoors and malware attributed to Toy Ghouls, Mirage Kitten, ValleyRAT operators, HoneyMyte, Armored Likho, Head Mare, and Project CAV3RN. Key techniques include MQTT and Matrix-based command and control, adware masquerading, kernel-level rootkits, exploitation of unpatched TrueConf servers, Google Apps Script C2 relays, DNS-based C2 selection, Telegram data theft, proxy botnets, and attacks against aviation, FinTech, industrial control systems, and video conferencing environments. The feed also includes Q2 လ
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 4b50a8217339744286a9c57ff6fff19083050deef4adc9b31c7a3c87d4a7d9dc
- Enrichment time
- 2026-09-08T20:51:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.