Armored Likho expands its cyber-espionage toolkit
2026-08-13T08:51:45Z•97417c5c5687801f2ee5825a7b9eb2f6f3f3d7b33c4a35e9ed3f0876a36e0a8d
APTC2DNS-tunnelingESXiGoogle-Apps-ScriptIoTLinuxMFA-bypassTelegram-theftTrueConfWindowsadversary-in-the-middlebackdoorcloud-abusecredential-dumpingcyber-espionagekeyloggingmobile-malwarephishingransomware
What happened
Kaspersky Securelist RSS entries covering recent cyber threats, including Armored Likho espionage using the Still Toolkit, Head Mare exploitation of unpatched TrueConf servers, Project CAV3RN cloud and DNS-based C2, MFA-bypassing adversary-in-the-middle phishing, Central Asian espionage backdoors, and GenieLocker ransomware targeting Windows, Linux, and ESXi. The collection also includes quarterly malware statistics and incident-response analysis.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 97417c5c5687801f2ee5825a7b9eb2f6f3f3d7b33c4a35e9ed3f0876a36e0a8d
- Enrichment time
- 2026-08-13T08:51:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.