Threat actors are exploiting current events, such as Ross Ulbricht’s pardon, to trick users into downloading malware through fake social media accounts and Telegram channels. Meanwhile, a China-aligned hacking group called “PlushDaemon” has conducted a supply chain attack on South Korean VPN provider IPany, compromising the company’s VPN installer to deploy custom “SlowStepper” malware, which has infected companies including a semiconductor firm and a software development company. Additionally, cybersecurity researchers have discovered a new BackConnect (BC) malware module linked to the QakBot loader, which has been used to deliver ransomware and other payloads and is part of a larger cybercrime ecosystem with connections to threat groups such as Storm-1811 and FIN7. Furthermore, researchers have identified a series of cyber-attacks targeting Chinese-speaking regions using a known malware called ValleyRAT, which is delivered through a multi-stage loader called PNGPlug and provides attackers with unauthorized access and control over infected machines. These attacks highlight the evolving nature of cyber threats, with threat actors using sophisticated tactics and exploiting current events to trick victims into downloading malware and demonstrate the need for users to be cautious when executing unknown code and to analyze the contents of suspicious code before running it. CTIX analysts will continue to report on the latest malware strains and attack methodologies.