Angry Birds: Toy Ghouls’ new toys

Kaspersky Securelist threat intelligence covering August–September 2026 activity, including newly identified backdoors, APT campaigns, malware delivery chains, industrial control system threats, Android proxy botnets, kernel-level rootkits, exploitation of unpatched TrueConf servers, and covert C2 using MQTT, Matrix, Google Apps Script, and DNS. The collection spans espionage, credential and messaging-data theft, ad fraud, proxy monetization, ransomware, and attacks against aviation, FinTech, industrial, and video-conferencing environments.