CannibalRAT targets Brazil
Summary: Cisco Talos is disclosing UAT-11795, a Russian-speaking, financially motivated adversary conducting a campaign against users in the U.S. and Europe since at least June 2025. Talos also describes an intrusion active since at least January 2026 in which an unknown attacker implanted a CloudZ remote access tool and a previously undocumented plugin called "Pheno."
Bottom line: A financially motivated, Russian-speaking actor has been running against U.S. and European users since at least June 2025, and a separate intrusion stayed active from at least January 2026 with a RAT plus a plugin Talos had never documented before.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026