The Good, the Bad and the Ugly in Cybersecurity – Week 36 (2026)

The Good | Authorities Dismantle Sality Botnet & Charge Russian Serial Phisher

A coordinated global takedown has successfully dismantled the long-standing Sality malware infrastructure and its associated domains in the U.S. and Europe. Between the DoJ, FBI, Europol, and Eurojust, the joint operation targeted the peer-to-peer (P2P) botnet that has been active since at least 2003. Operating out of Russia, the criminal group behind the botnet controlled over 15,000 infected devices worldwide. 

In recent years, Sality's primary payload was EggJagger, a stealthy clipjacking tool that hijacked cryptocurrency transactions by silently replacing wallet addresses. To neutralize the threat, cyber defenders turned Sality's P2P architecture against itself through protocol-level peer list manipulation, isolating infected hosts from the operators' command channels.

While this massive sinkhole operation permanently blocks new payloads, the sinkholing doesn't remove malware already resident on infected machines and individual infections will persist until cleaned up.

California’s federal grand jury has unsealed an indictment charging a Russian national for orchestrating a mass cyberespionage and phishing campaign targeting independent 80,000 freelancers. Authorities extradited Searzhudin Tamirlanovich Aktulaev to the U.S. following his arrest in Cyprus back in May 2025. Federal prosecutors allege that between June 2016 and November 2017, the defendant used 255 fake user accounts on a popular freelance platform to distribute malware-laced Excel files to unsuspecting workers. When opened, these attachments executed malicious macro commands that silently installed TVRAT and DarkVNC onto the victim endpoints. 

These remote access tools granted the attackers comprehensive control to harvest e-commerce credentials, private online passwords, and personally identifiable information (PII). Aktulaev currently remains in federal custody facing multiple serious charges, including wire fraud conspiracy, protected computer damage, and aggravated identity theft.

The Bad | Iranian Threat Actors Pose as Recruiters to Deploy Cross-Platform Backdoors

Iranian state-sponsored threat group Nimbus Manticore (aka Iranian Dream Job) has expanded its cyberespionage capabilities by deploying novel cross-platform remote access trojans (RATs). To deliver the payloads, operators masquerade as recruiters on job networking platforms to target software developers.

Attackers invite prospective candidates to complete timed coding assessments, while distributing malicious files inside compressed archives. Under the guise of a pre-employment evaluation, the actors instruct targets to troubleshoot a project management app called Taskflow within a strict three-hour window.

The decoy application contains instructions explicitly directing candidates to avoid modifying a supposedly bug-free server configuration file. However, this configuration file contains a malicious import statement pointing to a counterfeit, local library called colorized_terminal.

Since the library is bundled directly within the challenge's dependencies rather than the public registry, it silently executes an implant called NodeRabbit as a detached background process upon project startup.

Developed in Node.js, NodeRabbit functions as an adaptable backdoor capable of running on Windows, Linux, and macOS. The backdoor supports eleven core commands that allow operators to harvest host details, execute arbitrary shell commands, and read or delete local files in chunks. The implant connects to command-and-control (C2) servers hosted on Microsoft Azure to transfer exfiltrated data.

In a parallel campaign, researchers observed the actors distributing a separate cross-platform JavaScript remote access trojan named PollCat. This second payload targets candidates through similar React-themed technical exercises requiring a one-time password to access.

To achieve persistence, both NodeRabbit and PollCat establish local scheduled tasks, registry modifications, or launch agents depending on the target's operating system. The shift to cross-platform scripting allows the operators to utilize a single codebase that runs seamlessly across diverse developer workstations.

The Ugly | New ClickFix Variant Deploys Encrypted Reverse Tunnels via Counterfeit CAPTCHAs

A new ClickFix social engineering variant, dubbed TerminalFix, is leveraging fake Cloudflare CAPTCHA prompts on compromised websites to breach corporate networks.

Rather than deploying typical infostealer malware, this campaign uses a multi-stage intrusion chain that ultimately grants attackers a persistent reverse-tunnel directly into the victim's internal environment. The technique differs from traditional ClickFix schemes by specifically directing users to Windows Terminal or PowerShell, allowing the execution of more complex, multi-line scripts.

The threat sequence begins when a fake verification prompt instructs a visitor to run a PowerShell command preloaded onto their clipboard. This command downloads a compressed ZIP archive containing a legitimate signed executable and a malicious library, which then decodes and launches an obfuscated payload in memory.

In the next stage, the intrusion uses steganography to hide executable fragments and DLL fragments within the pixel data of three distinct PNG images hosted on a C2 server. Once downloaded, the script reassembles these payloads on the disk, establishing persistent, hourly access through a scheduled task and Registry Run key.

While active, the malware conducts comprehensive reconnaissance, scanning domain controllers, databases, backup servers, gateways, mail systems, and Active Directory. The intrusion's core component relies on a custom Python reverse-tunnel module that connects to gitnow.dev on port 443 over an encrypted WebSocket.

Supporting SOCKS5 arbitrary TCP proxying, the tunnel enables attackers to interact with internal hosts, multiplex multiple connections, maintain keepalive states, and rotate browser User-Agent strings. Although Microsoft has not observed hands-on operator activity, it advises to restrict PowerShell execution, monitor LockScreenContentServer.exe outside its standard path, and harden browsers. If network compromise is confirmed, security teams should focus their investigations on signs of lateral movement and rotate all active domain credentials.