ClearSky researchers describe BadPaw’s delivery and evasion chain, including a disguised HTA, installation-age checks, steganographic persistence and staged C2 downloads that deploy the MeowMeowProgram backdoor.
Zscaler ThreatLabz documented APT37’s Ruby Jumper campaign, which uses malicious LNK files and USB-propagated tools to reach air-gapped systems and stage data for delayed exfiltration.
Darktrace says it detected over 32 million high-confidence phishing emails in 2025 across its global customer base. Its findings point to identity compromise overtaking vulnerability exploitation, alongside regional trends in account takeovers, ransomware and AI threats
