In brief: Zyxel and Ivanti fix zero-days in their products, Russian hackers target iOS and Android users in watering hole attacks, and more.
The operation abuses insecure HTTP communications in Windows versions of Sogou Input Method to deliver the DarkVigil surveillance implant.
The attackers injected malicious JavaScript code into websites to identify visitors' devices, operating systems, and browser versions.
The attackers used a combination of open-source tools, custom malware and AI to compromise networks and maintain access.
The malware allowed attackers to remotely control infected devices, install additional applications, and execute shell commands.
Tracked as CVE-2026-58115, the vulnerability allows attackers to access vulnerable systems without authentication.
The groupu2019s main targets include law enforcement agencies, justice institutions, local administrations near the front line, and organizations in the defense sector.
