Out of the Crypt: The Evolving Cyber Extortion Economy

Unit 42 (Palo Alto Networks) published multiple May 2026 threat reports covering an array of high-impact topics: the evolving cyber extortion and data‑theft economy; Iranian APT “Screening Serpens” using AppDomainManager hijacking and new RAT variants against tech and defense targets; misuse of the open‑source ROADtools framework for cloud intrusions; an updated npm supply‑chain threat landscape with wormable malware, CI/CD persistence and multi‑stage attacks; TamperedChef clusters delivering trojanized productivity apps via malvertising; an evolved Gremlin stealer using advanced obfuscation,