Armored Likho expands its cyber-espionage toolkit
2026-08-14T08:51:46Z•6ac3cde0b1f51b528613b2d7d4d4dabc50753aafc2fb6d7057e001090cc769fc
APTBrazilC2Central-AsiaDNS-tunnelingESXiGoogle-Apps-ScriptIoTIsraelLinuxMFA-bypassTelegram-stealerTrueConfWindowsadversary-in-the-middlebackdoorcloud-abusecredential-theftcyber-espionagekeyloggingmobile-malwarenetwork-scanningphishingransomware
What happened
Kaspersky Securelist threat intelligence covering August–July 2026 activity, including Armored Likho’s Still Toolkit targeting Telegram data, Head Mare’s exploitation of unpatched TrueConf servers to deploy PhantomCore and PhantomGraph, Project CAV3RN’s Google Apps Script and DNS-based C2, cloud-hosted adversary-in-the-middle phishing bypassing MFA, Central Asian cyber-espionage backdoors, GenieLocker ransomware targeting Windows, Linux, and ESXi, and broader malware and incident trends.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 6ac3cde0b1f51b528613b2d7d4d4dabc50753aafc2fb6d7057e001090cc769fc
- Enrichment time
- 2026-08-14T08:51:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.