In Q1 2026, vulnerability registrations continued to rise, heavily influenced by AI-assisted discovery tools. Threat actors and APT groups actively exploited a mix of legacy and newly discovered vulnerabilities across Windows, Linux, and Microsoft Office, frequently utilizing C2 frameworks like Metasploit and Sliver to bypass authentication and gain initial access.
Havoc
4 posts
Exploits and vulnerabilities in Q1 2026 QEMU abused to evade detection and enable ransomware delivery Threat actors are actively abusing the QEMU hardware emulator to create hidden virtual machines on compromised hosts, effectively shielding their attack toolkits from endpoint detection and response (EDR) solutions. Recent campaigns, including those linked to the PayoutsKing ransomware group, leverage this technique alongside vulnerability exploitation and legitimate remote access tools to establish persistence, harvest credentials, and exfiltrate data.
Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets Check Point Research discovered a zero-day vulnerability (CVE-2026-3502) in the TrueConf client update mechanism, exploited in 'Operation TrueChaos' against Southeast Asian governments. Attackers compromised on-premises TrueConf servers to distribute malicious updates, utilizing DLL sideloading and UAC bypass techniques to deploy the Havoc C2 framework.
SloppyLemming Deploys BurrowShell and Rust-Based RAT to Target Pakistan and Bangladesh Between January 2025 and January 2026, the India-nexus threat actor SloppyLemming conducted a cyber espionage campaign targeting government and critical infrastructure in Pakistan and Bangladesh. The campaign utilized PDF and Excel lures to deploy two custom implants—an in-memory shellcode backdoor named BurrowShell and a Rust-based keylogger—via DLL search order hijacking and extensive abuse of Cloudflare Workers infrastructure.
