NightEagle targets Russian companies

Kaspersky Securelist RSS entries report multiple 2026 threat campaigns, including NightEagle exploitation of Active Directory and RDP, Toy Ghouls backdoors using MQTT and Matrix-based command and control, Mirage Kitten malware targeting aviation and FinTech, ValleyRAT distributed as adware, Android proxy-botnet malware, HoneyMyte’s kernel-level rootkit, Armored Likho Telegram espionage, and Head Mare exploitation of unpatched TrueConf servers. The feed also includes industrial-threat and vulnerability trend reports. Specific CVE identifiers are not provided in the supplied summaries.