Cybersecurity
ThreatsDay roundup spans ransomware betrayal, RATs, exposed tools
The bulletin collected reports on a ransomware affiliate’s leak-site betrayal, a WhatsApp-delivered Windows RAT, exposed post-exploitation tools and several other incidents drawn from security researchers and incident responders.
- The bulletin grouped reports on malicious VS Code themes, BraZetsu, a WhatsApp-delivered Windows RAT and an exposed staging service linked to Viva Aerobus.
- A 28-year-old Russian national linked to Qilin was detained in Osaka and extradited to Germany on 2 October 2026.
- Forescout said only 6% of Internet of Medical Things devices and 16% of medical operational technology devices in its sample could support post-quantum cryptography.
- CloudSEK said a Gentlemen affiliate called Azazel ran a separate leak site and kept the extortion proceeds.
- Huntress, StepSecurity and SafeDep reported phishing, package compromise and a Linux worm that spread through developer systems.
Socket said two VS Code themes still available on a marketplace were linked to Aurora Nocturne Night Theme, a removed extension that had hidden a Windows downloader. Group-IB analysed BraZetsu, and Morphisec said a WhatsApp-delivered lure led to VulcanRAT207 through a multistage Windows intrusion.
The bulletin said a 28-year-old Russian national linked to Qilin was detained in Osaka and later handed to Germany. Forescout said only 6% of Internet of Medical Things devices and 16% of medical operational technology devices in its sample could support a move to post-quantum cryptography.
CloudSEK said Azazel, a Gentlemen affiliate, built a leak site of his own and kept the extortion money after publishing victim data. Huntress said attackers used Power BI domains to steer victims towards ScreenConnect installers.
StepSecurity and SafeDep said compromised npm and RubyGems packages were used to steal credentials, open reverse shells and, in one cluster, spread a Linux worm. Another item said an exposed staging service linked to Viva Aerobus revealed post-exploitation tools, and Meta's Muse built dossiers on users and the people they mentioned.
Named in this story
Companies
- Socket
- said two VS Code themes were tied to a removed malicious extension
- Group-IB
- analysed BraZetsu
- Morphisec
- described the WhatsApp-delivered intrusion chain
- Forescout
- analysed medical-device upgradeability to post-quantum cryptography
- CloudSEK
- said Azazel ran a separate leak site and kept the proceeds
- Huntress
- described the Power BI phishing campaign
- StepSecurity
- reported a compromised npm package with credential theft
- SafeDep
- reported malicious RubyGems packages and a self-spreading worm
- Meta
- was said to have built Muse as its personal AI agent
- Viva Aerobus
- was linked to the exposed staging service that revealed tools
Organisations
- Qilin
- was the ransomware group linked to the detained suspect
- Gentlemen
- was the ransomware gang tied to the affiliate Azazel
Products and systems
- Aurora Nocturne Night Theme
- was the removed malicious extension linked to later themes
- BraZetsu
- was described as a Python-based Windows malware framework
- VulcanRAT207
- was the remote access trojan delivered in the intrusion
- Power BI
- was abused as a legitimate domain in the phishing campaign
- ScreenConnect
- was the installer pushed to victims
- Muse
- was the AI agent that built dossiers on users and contacts
Places
- Osaka
- was where the suspect was detained
- Germany
- was the destination of the extradition
How the source tells it
The piece used a chatty, threat-heavy roundup style, with alarm and promotional urgency carrying the framing.
- alarm a negative introduction and repeated worst-case framing across unrelated incidents
- threat inflation a long list of disparate examples was used to suggest a widening threat landscape without any measure of scale
- urgency the bulletin ended with a subscription prompt that pushed the roundup as time-sensitive