MacSync under the microscope: new delivery methods and a new payload
2026-10-04T08:51:46Z•870aa2bdb4bb827bde824d6bfb5aa851fdfb248e1d179e6019b7e4bab172e452
Active DirectoryC2 concealmentGhostContainerGroup Policy ObjectsJavaScript malwareMQTTMatrix ElementMirage KittenMovieReaperNightEagle APTNode.js malwareRDP exploitationSolana blockchainToy GhoulsValleyRATbackdoorcryptocurrency targetingdeveloper targetingindustrial control systemsliving off the landmacOS stealermalware masqueradingransomwaretorrent distributionvulnerability intelligence report 2026 Q2 [truncated]
What happened
Kaspersky Securelist RSS items from August–September 2026 describe diverse malware and threat campaigns, including the MacSync macOS stealer with a backdoor targeting cryptocurrency users and developers; PAYLOAD ransomware abusing Active Directory Group Policy in a binary-less, encryptionless operation; MovieReaper distributed through compromised movie torrents and using Solana for C2 concealment; NightEagle activity against Russian organizations involving GhostContainer, GitHub-hosted tools, Active Directory and RDP exploitation; Toy Ghouls backdoors using HiveMQ MQTT and Matrix/Element for C
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 870aa2bdb4bb827bde824d6bfb5aa851fdfb248e1d179e6019b7e4bab172e452
- Enrichment time
- 2026-10-04T08:51:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.