IT threat evolution in Q1 2026. Mobile statistics

Kaspersky Securelist RSS roundup (May 2026) covering Q1 2026 telemetry and multiple technical write-ups. Key items: Q1 mobile, PC and IoT threat statistics (including new SparkCat and Triada variants); analysis of Kimsuky campaigns using PebbleDash tools linked to the AppleSeed cluster; a ransomware trends overview (rise of EDR-killers and shift from encryption to data-leak extortion); disclosure of CVE-2025-68670 (pre-auth RCE in xrdp, promptly patched); a vulnerabilities-and-exploits quarterly summary; OceanLotus distributing ZiChatBot via malicious PyPI wheel packages (supply-chain attack);