Malware Activity
RatHat Android Malware Uses GenAI to Automate Credential and Banking Theft
Security researchers at Zimperium have uncovered a new Android malware strain they’ve named RedHat linked to threat actors believed to be operating from China that targets banking credentials, 2FA and OTP codes, notifications, and other sensitive data while providing persistent remote access to compromised devices. RatHat is distributed through smishing, malvertising, malicious websites, and third-party forums, where victims are tricked into installing malicious APKs disguised as legitimate applications. A dropper abuses Android SessionInstaller APIs to bypass restricted settings and Accessibility Service protections, while multiple anti-analysis and anti-debugging layers hinder detection. The malware uses a three-part architecture consisting of a malicious Android application, a Go-based command-and-control agent, and an FRP client that creates a persistent reverse tunnel to the attacker and exposes access to the device’s ADB daemon. Notably, RatHat incorporates generative AI into its UI-automation process, sending device Accessibility-tree data to an AI assistant (potentially Google Gemini) to identify interface elements and direct automated clicks, scrolling, and navigation. The malware can also capture screens and user input, maintain background execution, disable or uninstall security applications, and execute arbitrary commands, giving operators extensive surveillance and control capabilities beyond traditional mobile credential theft. CTIX analysts will continue to report on novel and interesting malware in the future.
Threat Actor Activity
Russia Hit by Three Separate Groups, Conducting Espionage, Ransomware, and Stealthy Backdoor Attacks
Kaspersky has reported that three (3) distinct threat clusters (NightEagle, Hacking Cat, and Toy Ghouls) are actively targeting enterprises in Russia. NightEagle (APT Q 95) uses stolen credentials to access corporate VPNs via Cloudflare WARP and European VPS IPs, then deploys GhostContainer, a modular backdoor on Microsoft Exchange that masquerades as a legitimate server component. It incorporates open source tools (Neo reGeorg, CVE 2020 0688 exploit, GhostWebShell) and likely abuses VIEWSTATE to launch in memory. For lateral movement, NightEagle uses RDP tunneling (Microsoft dev tunnels, rdp2tcp), exploits AD flaws and BlueKeep (CVE 2019 0708), and performs DCSync attacks to gain domain controller and Kerberos persistence. Hacking Cat, a pro Ukrainian hacktivist group, has shifted from defacements to Gorilla RAT (remote access trojan) and multi platform Monkey ransomware (Rust, .NET, C++, Go) targeting Windows, Linux, and ESXi, with some variants effectively acting as wipers. It also collaborates with Cyber Anarchy Squad and Ukrainian Cyber Alliance to deploy ClearWater ransomware and Nemo Wiper, though Hacking Cat disputes some tool attributions. Toy Ghouls, a financially motivated group, now uses a custom Bird Agent backdoor (HiveMQ MQTT or Matrix/Element C2), delivered via WinRM with tools like Evil WinRM. Bird Agent binds its encrypted config to each host via MachineGuid, runs as a service, and executes hidden PowerShell or CLI commands, signaling a shift in tactics towards a more bespoke, stealthy tooling.
Vulnerabilities
Cisco ISE Zero-Day Authentication Bypass Exploited in Active Attacks
Cisco has released emergency security updates for a maximum-severity authentication bypass vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that is being actively exploited as a zero-day. The flaw tracked as CVE-2026-76460, stems from insufficient authentication controls on an API endpoint, allowing unauthenticated remote attackers to send crafted requests, bypass the web-based management interface, and gain unauthorized access regardless of device configuration. Successful exploitation can enable root-level command execution, potentially allowing attackers to conceal or delete indicators of compromise. Cisco urges customers to upgrade immediately to ISE/ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, or 3.1 Patch 12. While no workaround is available, infrastructure ACLs can restrict traffic and prevent remote exploitation. Organizations should inspect access.log files across all nodes and external firewall and network logs for suspicious activity, with Cisco recommending that potentially compromised systems be re-imaged and restored from trusted backups. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to remediate the flaw within by no later than September 19, 2026, under BOD 26-04. CTIX analysts urge any affected organizations to prioritize patching immediately as no workarounds currently exist.
📧 Never Miss a Briefing
Stay informed and secure. Subscribe to Ankura’s Cyber Flash Update, a bi-weekly briefing curated by our top cybersecurity experts. Receive timely insights on emerging threats, vulnerabilities and malicious actors to keep your systems secure.
Join the Cyber Flash Update community today.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
