Isometric network nodes depicting global cyber threats and APT infiltration.

Daily Cybersecurity News - February 28, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

February 28, 2026 2:42 PM 4 min read

North Korean APT Infiltrates Air-Gapped Networks

Executive Summary

North Korean state-sponsored actor APT37 (aka ScarCruft) is deploying a new malware toolkit to breach isolated networks. The campaign, dubbed 'Ruby Jumper,' uses removable media to exfiltrate data and conduct surveillance on air-gapped systems.

Key TTPs

Initial Access: Malicious LNK files on removable USB drives.
Execution: LNK file launches a PowerShell command which carves and runs multiple embedded payloads.
Defense Evasion: Malware uses hidden directories on removable media to stage data for exfiltration.

Campaign Analysis

This campaign marks a significant evolution in APT37's tactics, introducing a sophisticated, multi-stage toolset specifically designed to bypass the security of air-gapped environments. The use of new, undocumented malware like THUMBSBD and VIRUSTASK demonstrates a focused effort to target highly secure government and defense entities.

Targeting & Infrastructure

Target Profile: Primarily government, defense, and research sectors in South Korea, with expanded targeting in Japan, Vietnam, and the Middle East.

Relevant Terms

Air-Gapped Network: A computer or network that is physically isolated from unsecured networks, such as the public internet, to enhance security.
LNK File: A Windows shortcut file that points to another file or program. Threat actors often embed malicious commands within them to initiate an attack.

Source: BleepingComputer

Kimwolf Botmaster Unleashes Global Disruption

Executive Summary

The threat actor "Dort" is operating the Kimwolf botnet, one of the world's largest, by exploiting vulnerabilities in residential proxy networks and Android devices. The botnet is used to conduct hyper-volumetric DDoS attacks, harass security researchers, and sell access to compromised devices.

Key TTPs

Initial Access: Exploiting exposed Android Debug Bridge (ADB) services by tunneling through residential proxy networks.
Execution: Deploys malware payloads via remote commands to install the botnet client and other malicious applications.
Defense Evasion: Uses DNS over TLS (DoT) and rapidly rotates C2 domains to hide communications and evade takedowns.

Campaign Analysis

The Kimwolf botnet represents a systemic risk, leveraging the residential proxy industry to achieve massive scale rapidly. Its operator, Dort, has engaged in a relentless campaign of harassment and large-scale DDoS attacks against those who expose the botnet's operations.

Targeting & Infrastructure

Target Profile: Primarily Android-based devices like TV streaming boxes and smart TVs, often with pre-installed or vulnerable proxy software.
Infrastructure: A massive, global botnet of over 2 million infected devices, monetized through DDoS attacks, proxy rentals, and unauthorized app installations.

Relevant Terms

Botnet: A network of hijacked computers and devices controlled by a malicious actor to carry out large-scale cyberattacks, such as Distributed Denial-of-Service (DDoS).
Residential Proxy: A service that routes internet traffic through devices on home internet connections, often used by threat actors to conceal the origin of their attacks.

Source: KrebsOnSecurity

Ivanti Devices Harbor Dormant Malware

Executive Summary

CISA warns that RESURGE, a sophisticated malware implant, is exploiting a zero-day vulnerability to breach Ivanti Connect Secure (ICS) devices. The malware is engineered to remain dormant and evade detection, posing an ongoing threat to compromised networks.

Key TTPs

Initial Access: Exploitation of a stack-based buffer overflow vulnerability (CVE-2025-0282) for unauthenticated remote code execution.
Execution: Deploys web shells, modifies system files, and uses tools like BusyBox to execute payloads.
Defense Evasion: Manipulates file integrity checks, tampers with device logs, and uses forged TLS certificates for covert C2 communications.

Campaign Analysis

The RESURGE implant represents a persistent threat, capable of surviving reboots and acting as a rootkit, backdoor, and tunneler. Its passive C2 model allows it to remain latent indefinitely until activated by a remote attacker, making detection difficult.

Targeting & Infrastructure

Target Profile: Organizations using Ivanti Connect Secure, Policy Secure, and ZTA gateways, including critical infrastructure entities.
Infrastructure: Establishes covert Secure Shell (SSH) tunnels for command-and-control operations.

Relevant Terms

Zero-Day: A vulnerability in a system or device that has been disclosed but is not yet patched, which attackers can exploit.
Malicious Implant: A sophisticated piece of malware designed to be secretly placed within a target system to establish long-term control and persistence.

Source: BleepingComputer

Malicious Go Module Deploys Linux Backdoor

Executive Summary

A malicious Go module impersonating a legitimate crypto library is being used to steal developer passwords, establish SSH persistence, and deploy the Rekoobe backdoor on Linux systems. This supply chain attack targets developers by tricking them into using a compromised dependency.

Key TTPs

Initial Access: Relies on developers incorporating a malicious dependency (`github.com/xinfeisoft/crypto`) that impersonates a legitimate Go crypto library.
Execution: The backdoor is placed in the `ReadPassword()` function, which captures credentials during interactive terminal sessions and executes a shell script stager.
Defense Evasion: The module masquerades as a trusted library and uses a GitHub-hosted file as a redirector to hide the command-and-control infrastructure.

Campaign Analysis

This campaign highlights the significant risk of software supply chain attacks, where threat actors abuse developer trust in open-source ecosystems. The use of a well-known backdoor like Rekoobe, previously associated with APT31, suggests a capable adversary.

Actionable Intelligence

IPs: 154.84.63[.1]84
Domains: img.spoolsv[.]cc
Hashes:8b0ec8d0318347874e117f1aed1b619892a7547308e437a20e02090e5f3d2da6(Rekoobe Payload)

Relevant Terms

Backdoor: A covert method of bypassing normal authentication to gain unauthorized remote access to a computer system.
Go Module: A collection of Go packages managed together as a single unit, used to handle dependencies in Go projects.

Source: The Hacker News