Zscaler CXO Monthly Roundup | September 2026 Deepen Desai (EVP, Chief Security Officer)

IntroductionAugust and September brought major milestones for Zscaler and ThreatLabz, from the release of our annual ransomware report and my keynote at Zenith Live ’26 Singapore to new malware discoveries, investigations into APT campaigns, and the release of the AI readiness report.More recently, reports of AI-assisted attacks in Japan and South Korea also underscore how threat actors are incorporating AI into reconnaissance and exploitation. Our launch of Agentic SecOps addresses a challenge that runs through much of my work and the recent headlines: helping defenders keep pace with increasingly fast and automated AI-assisted attacks. AI-assisted attacks in Japan and South Korea: Reconnaissance, vulnerability discovery, and exploitationAttackers’ use of AI is making headlines. In South Korea, an attacker abused an AI penetration testing framework to compromise multiple financial institutions. In Japan, attackers used AI during several recent cybersecurity attacks.These developments came amid a broader rise in ransomware victims in both countries. Our newly released ThreatLabz 2026 Ransomware Report found that victim counts increased 25% year-over-year in Japan and 175% in South Korea. We cover the report’s key findings in a separate blurb below.These cases reinforce a point I’ve been making for some time: AI has become part of the attack workflow for threat actors. Even though some powerful frontier models, such as those from Anthropic Mythos and OpenAI Cyber, are restricted, attackers can still use open weight models with clever harness engineering to achieve similar outcomes. We expect this trend to accelerate.We tested the capabilities of frontier AI models using our own security harness organized around three testing categories that each mirrored real-world attack (offense) and defense scenarios.How attackers are using AIThese real-world attacks in South Korea and Japan show how threat actors are using AI in the following ways:Reconnaissance: Discovering exposed applications and identifying potential entry points.Vulnerability testing: Scanning potential victims for known vulnerabilities.Exploitation: Supporting attacks against internet-facing applications and APIs.South Korea: Reconnaissance and exploitation of internet-facing applicationsThreatLabz recently examined a campaign in which a threat actor abused ARTEX, an open source agentic penetration testing framework. The attacker used the AI agentic framework to support reconnaissance and exploitation of internet-facing web applications. This resulted in the theft of personally identifiable information (PII) belonging to approximately 67,000 individuals. Attackers could use this PII to support further operations like fraud and social engineering.Japan: Vulnerability scanning and API attacksJapan is facing a rise in publicly disclosed cyber incidents. Masaaki Taira, chair of the Liberal Democratic Party’s National Cybersecurity Strategy Headquarters, said that cyberspace is “in a state of emergency.”During its investigation of recent unauthorized access incidents, the Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) confirmed that attackers used AI to scan for known vulnerabilities and conduct attacks via APIs.Japan’s recent incidents are an early warning of how AI changes attacker economics. Attackers can move faster, automate reconnaissance and vulnerability exploitation, overcome language and skill barriers, and target more organizations. Organizations should reduce exposed systems, strengthen access controls, patch faster, and prepare for breaches through their supply chain.Priorities for CXOs and security leadersHide your attack surface wherever possible. What can’t be discovered is harder to exploit.Use Zscaler Deception to detect and contain lateral movement or privilege escalation with decoy assets and accounts.Apply Zero Trust everywhere (including inside the office), not just for remote access.Minimize blast radius with segmentation and deception. Assume breach and contain fast.Treat AI assets as crown jewels and manage that risk explicitly.Use the AI-powered Exposure Management solution to find and fix vulnerabilities before attackers find and exploit them.Modernize SecOps for machine-speed defense by performing red teaming on all external assets. Use agentic workflows with controls designed to support authorized security testing.We’re seeing AI accelerate large-scale attacks worldwide, which is enabling adversaries to scan for exposed attack surfaces, identify vulnerabilities, and chain exploits in real time. We believe the most effective response is to reduce exposed attack surface, adopt a Zero Trust Everywhere strategy with integrated deception to limit lateral movement, and use AI-powered exposure management (for example, Zscaler) to find and fix issues before attackers do. More recommendations are available in my June 2026 CXO Monthly Roundup. Agentic SecOps launchThis launch is especially meaningful for me because it addresses what I see every day on the front lines of threat research and security operations. Attackers are moving faster and integrating AI into their attack workflows, as illustrated by the recent activity in Japan and South Korea. Many security operations centers (SOCs) are struggling to keep pace because of fragmented tools, incomplete visibility, high data ingestion costs, manual workflows, and slow investigations.We built Agentic SecOps to help customers proactively reduce exposure, detect and investigate threats faster, and contain attacks through closed-loop remediation. Read our launch announcement to learn more about the platform and the vision behind it.A few key highlights from the launch:Unified exposure management and threat management in one platform.Operationalize rich inline telemetry across Zscaler Zero Trust Exchange (ZIA, ZPA, DLP, Deception, Endpoint, Identity, Cloud).Specialized AI agents shaped by more than a decade of frontline SOC, MDR, and threat-hunting experience.Closed-loop remediation through the Zscaler Zero Trust Exchange to turn detection into action in real time. ThreatLabz 2026 Ransomware ReportOur Zscaler ThreatLabz 2026 Ransomware Report examines ransomware activity from April 2025 through March 2026, with a focus on groups and affiliates, victim targeting, attack techniques, data theft, and payment patterns.For security leaders, the findings reinforce a clear reality for defenders: ransomware’s leverage is growing by the terabyte, while initial access is increasingly driven by repeatable playbooks that abuse trusted enterprise tools and trusted people. At the same time, the economics are shifting: total known ransom payments fell year-over-year, but the average payment increased, suggesting attackers are extracting more from the victims that do pay.Key takeawaysTerabyte-scale data theft is the new standard: Among the top 10 ransomware groups by reported data leak volume, combined exfiltration volume increased 275.8% year-over -year to 896.2 terabytes. Multiple groups stole more than 1 terabyte of data from each victim on average.Ransomware threat actors are targeting employees with privileged roles and business influence: Manager-level titles and above accounted for 62% of victims in attacks by a prominent ransomware group. Of the 351 victims identified, roughly 75% worked in finance, sales, operations, HR, and marketing—functions tied to non-technical yet critical business processes and data.Abuse of trusted enterprise tools continues to play a larger role in ransomware operations: Ransomware threat actors are using legitimate collaboration and remote support tools, including Microsoft Teams and Quick Assist, to turn spam bombing and IT-themed social engineering into initial access that can be leveraged for lateral movement, data theft, and file encryption.ThreatLabz findings show that ransomware risk extends well beyond technical and executive roles. Managers across core business functions possess the access, authority, and organizational knowledge threat actors need to advance an intrusion. Recommendations for security leadersRestrict unsolicited external messages and calls on collaboration platforms.Train employees to verify unusual IT requests through trusted internal channels.Deploy inline threat protection and endpoint security to detect and block attacks.Monitor for unusual activity across accounts, devices, remote access tools, and data transfers.Enforce least-privilege access to limit what attackers can reach.Use Zero Trust segmentation to contain compromises and prevent lateral movement.Zscaler Zero Trust Exchange Coverage – Zscaler Internet Access (Advanced Cloud Sandbox, Advanced Threat Protection, Advanced Cloud Firewall, SSL Inspection), Deception, Zscaler Private Access (AI Segmentation), Zscaler AI Protect, Zscaler Exposure Management (Asset Exposure Management, External Attack Surface Management, Unified Vulnerability Management) ThreatLabz 2026 Frontier AI Readiness ReportFrontier AI models can identify security vulnerabilities and chain them into a complete attack path, from reconnaissance to data theft, within minutes. Because of this, ThreatLabz worked with leading frontier AI companies to examine whether enterprises are prepared to defend against cyberattacks operating at machine-speed. We leveraged AI models in isolated, controlled simulation environments to emulate the specific attack patterns and velocity of frontier AI. Using these insights, we evaluated organizations on a 0-100 scale, assessing various axes including data protection, attack surface shielding, and decoy deployment to determine how well they could withstand an autonomous, machine-speed attack.Our findings in the ThreatLabz 2026 Frontier AI Readiness Report show that across hundreds of enterprises assessed, the average Frontier AI Readiness Score sat at 37 out of 100. Even more telling, the average AI governance pillar score was just 2.1 out of 20, proving that enterprise readiness for these advanced threats remains virtually at “year zero.”The findings in this report are drawn from Frontier-AI-Readiness Assessments conducted across hundreds of enterprise organizations during H1 2026. 32% are Fortune 500 companies. The cohort spans 12 industries with the following composition:Meaningful insightsEnterprises can maximize their existing AI-defense capabilities with a few simple steps. Organizations can significantly improve their defenses with practical cyber hygiene. In 64% of organizations, the licensed deception product is positioned for deployment to add high-fidelity detection depth. 18% have authentication capabilities that can be extended to additional sites. Through configuration optimization alone, organizations can reach target scores between 73 and 98 out of 100. From the cohort’s average starting score of 37, this represents massive individual point improvements.AI governance is at year zero across every assessed enterprise, regardless of organization size or control breadth. 100% of assessed organizations lack identity-based authentication for their AI, and 91% have publicly exposed AI endpoints. The average AI governance pillar score was 2.1 out of 20 (10.5% of maximum). The highest score in the cohort was 3 out of 20. The exposure is substantial: public AI endpoints were common across the cohort, including internet-exposed MCP endpoints and unauthenticated chatbots or copilots. The most serious cases observed included critical-severity GenAI gateways exposed to the public internet.RecommendationsEnable enforcement mode on security controls.Gate all AI surfaces with identity-aware access immediately.Raise SSL/TLS inspection to a minimum of 70% qualified coverage within 90 days.Replace wildcard domains with named FQDNs on critical segments.Deploy deception on critical network segments.Move internet-exposed VPN appliances behind Zero Trust-brokered access.Patch CISA KEV vulnerabilities on internet-facing assets within 72 hours of assessment. Operation RapidRust targets sensitive data across various platforms and air-gapped networksThreatLabz analyzed new activity by the Pakistan-nexus threat actor APT36, targeting government and defense entities in India and Afghanistan. Since our last publication about the group’s activity in January 2026, APT36 has maintained a high operational tempo and updated its tactics, techniques, and procedures (TTPs) in continued attacks.In this campaign, dubbed Operation RapidRust, ThreatLabz discovered new malware families and post-compromise tools, as well as significant post-compromise activity. The new tools include the RUSTYSHADE backdoor, the RUSTYMOVE post-compromise tool, and the PSNATCH and BASHNATCH file-stealing tools.Command-and-control communicationRUSTYSHADE uses attacker-controlled private GitHub repositories for command-and-control (C2) communication. All messages exchanged between RUSTYSHADE and the GitHub repositories are encrypted using AES-256-GCM.Air-gapped networks at riskAPT36 deployed RUSTYMOVE on a compromised machine during post-compromise activity. Its sole function is to continuously monitor external removable media (e.g., USB, SD, MMC, and IEEE 1394 devices).Post-compromise activityDuring our investigation, ThreatLabz observed post-compromise activity from APT36 operators, including system, user, and network reconnaissance commands, and the deployment of next-stage payloads. Most of the activity took place between August 20, 2026, and September 1, 2026.ThreatLabz analyzed the timestamps associated with the C2 commands and found that the threat actor issued commands only between 4:00 a.m. and 11:00 a.m. UTC. The figure below shows the distribution of C2 commands by hour of the day.ThreatLabz also analyzed the commands by date. As shown in the figure below, all observed activity occurred on weekdays, with no activity observed during the two weekends included in the analysis period.This campaign demonstrates that APT36 continues to target government and defense entities in India and Afghanistan while maintaining high operational tempo and evolving TTPs. To learn more, please visit Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH.Zscaler Zero Trust Exchange Coverage – Zscaler Internet Access (Advanced Cloud Sandbox, Advanced Threat Protection, Advanced Cloud Firewall, SSL Inspection), Deception, Zscaler Private Access (AI Segmentation), Zscaler AI Protect, Zscaler Exposure Management (Asset Exposure Management, External Attack Surface Management, Unified Vulnerability Management) New malware and notable campaignsC2Looper abuses GitHub to support potential ransomware activity: ThreatLabz discovered a new backdoor likely affiliated with an initial access broker for ransomware attacks. It supports typical backdoor commands including remote shell execution, reconnaissance, and deploying additional malware tooling.Abyssos, a modular RAT: ThreatLabz identified Abyssos, a modular RAT with capabilities such as credential theft, file exfiltration, VNC-based remote access, and support for downloadable modules to expand its functionality.ChainDrop (mini Shai-Hulud) turns trusted build pipelines into a supply chain vector: ThreatLabz continues to document the evolution of Shai-Hulud and its potential impact on the software supply chain.Vidar evolves to complicate analysis: ThreatLabz published a technical analysis of Vidar’s latest string obfuscation that leverages a virtual machine combined with custom stream ciphers.Ledger phishing exploits trust in search ads and cloud platforms: ThreatLabz analyzed how threat actors used Google ads and a series of redirects to lure Ledger users into submitting secret recovery phrases.2CLoader, a customizable malware: ThreatLabz analyzed a new malware loader named 2CLoader that has been observed delivering Vidar and Remus.  

​[#item_full_content] IntroductionAugust and September brought major milestones for Zscaler and ThreatLabz, from the release of our annual ransomware report and my keynote at Zenith Live ’26 Singapore to new malware discoveries, investigations into APT campaigns, and the release of the AI readiness report.More recently, reports of AI-assisted attacks in Japan and South Korea also underscore how threat actors are incorporating AI into reconnaissance and exploitation. Our launch of Agentic SecOps addresses a challenge that runs through much of my work and the recent headlines: helping defenders keep pace with increasingly fast and automated AI-assisted attacks. AI-assisted attacks in Japan and South Korea: Reconnaissance, vulnerability discovery, and exploitationAttackers’ use of AI is making headlines. In South Korea, an attacker abused an AI penetration testing framework to compromise multiple financial institutions. In Japan, attackers used AI during several recent cybersecurity attacks.These developments came amid a broader rise in ransomware victims in both countries. Our newly released ThreatLabz 2026 Ransomware Report found that victim counts increased 25% year-over-year in Japan and 175% in South Korea. We cover the report’s key findings in a separate blurb below.These cases reinforce a point I’ve been making for some time: AI has become part of the attack workflow for threat actors. Even though some powerful frontier models, such as those from Anthropic Mythos and OpenAI Cyber, are restricted, attackers can still use open weight models with clever harness engineering to achieve similar outcomes. We expect this trend to accelerate.We tested the capabilities of frontier AI models using our own security harness organized around three testing categories that each mirrored real-world attack (offense) and defense scenarios.How attackers are using AIThese real-world attacks in South Korea and Japan show how threat actors are using AI in the following ways:Reconnaissance: Discovering exposed applications and identifying potential entry points.Vulnerability testing: Scanning potential victims for known vulnerabilities.Exploitation: Supporting attacks against internet-facing applications and APIs.South Korea: Reconnaissance and exploitation of internet-facing applicationsThreatLabz recently examined a campaign in which a threat actor abused ARTEX, an open source agentic penetration testing framework. The attacker used the AI agentic framework to support reconnaissance and exploitation of internet-facing web applications. This resulted in the theft of personally identifiable information (PII) belonging to approximately 67,000 individuals. Attackers could use this PII to support further operations like fraud and social engineering.Japan: Vulnerability scanning and API attacksJapan is facing a rise in publicly disclosed cyber incidents. Masaaki Taira, chair of the Liberal Democratic Party’s National Cybersecurity Strategy Headquarters, said that cyberspace is “in a state of emergency.”During its investigation of recent unauthorized access incidents, the Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) confirmed that attackers used AI to scan for known vulnerabilities and conduct attacks via APIs.Japan’s recent incidents are an early warning of how AI changes attacker economics. Attackers can move faster, automate reconnaissance and vulnerability exploitation, overcome language and skill barriers, and target more organizations. Organizations should reduce exposed systems, strengthen access controls, patch faster, and prepare for breaches through their supply chain.Priorities for CXOs and security leadersHide your attack surface wherever possible. What can’t be discovered is harder to exploit.Use Zscaler Deception to detect and contain lateral movement or privilege escalation with decoy assets and accounts.Apply Zero Trust everywhere (including inside the office), not just for remote access.Minimize blast radius with segmentation and deception. Assume breach and contain fast.Treat AI assets as crown jewels and manage that risk explicitly.Use the AI-powered Exposure Management solution to find and fix vulnerabilities before attackers find and exploit them.Modernize SecOps for machine-speed defense by performing red teaming on all external assets. Use agentic workflows with controls designed to support authorized security testing.We’re seeing AI accelerate large-scale attacks worldwide, which is enabling adversaries to scan for exposed attack surfaces, identify vulnerabilities, and chain exploits in real time. We believe the most effective response is to reduce exposed attack surface, adopt a Zero Trust Everywhere strategy with integrated deception to limit lateral movement, and use AI-powered exposure management (for example, Zscaler) to find and fix issues before attackers do. More recommendations are available in my June 2026 CXO Monthly Roundup. Agentic SecOps launchThis launch is especially meaningful for me because it addresses what I see every day on the front lines of threat research and security operations. Attackers are moving faster and integrating AI into their attack workflows, as illustrated by the recent activity in Japan and South Korea. Many security operations centers (SOCs) are struggling to keep pace because of fragmented tools, incomplete visibility, high data ingestion costs, manual workflows, and slow investigations.We built Agentic SecOps to help customers proactively reduce exposure, detect and investigate threats faster, and contain attacks through closed-loop remediation. Read our launch announcement to learn more about the platform and the vision behind it.A few key highlights from the launch:Unified exposure management and threat management in one platform.Operationalize rich inline telemetry across Zscaler Zero Trust Exchange (ZIA, ZPA, DLP, Deception, Endpoint, Identity, Cloud).Specialized AI agents shaped by more than a decade of frontline SOC, MDR, and threat-hunting experience.Closed-loop remediation through the Zscaler Zero Trust Exchange to turn detection into action in real time. ThreatLabz 2026 Ransomware ReportOur Zscaler ThreatLabz 2026 Ransomware Report examines ransomware activity from April 2025 through March 2026, with a focus on groups and affiliates, victim targeting, attack techniques, data theft, and payment patterns.For security leaders, the findings reinforce a clear reality for defenders: ransomware’s leverage is growing by the terabyte, while initial access is increasingly driven by repeatable playbooks that abuse trusted enterprise tools and trusted people. At the same time, the economics are shifting: total known ransom payments fell year-over-year, but the average payment increased, suggesting attackers are extracting more from the victims that do pay.Key takeawaysTerabyte-scale data theft is the new standard: Among the top 10 ransomware groups by reported data leak volume, combined exfiltration volume increased 275.8% year-over -year to 896.2 terabytes. Multiple groups stole more than 1 terabyte of data from each victim on average.Ransomware threat actors are targeting employees with privileged roles and business influence: Manager-level titles and above accounted for 62% of victims in attacks by a prominent ransomware group. Of the 351 victims identified, roughly 75% worked in finance, sales, operations, HR, and marketing—functions tied to non-technical yet critical business processes and data.Abuse of trusted enterprise tools continues to play a larger role in ransomware operations: Ransomware threat actors are using legitimate collaboration and remote support tools, including Microsoft Teams and Quick Assist, to turn spam bombing and IT-themed social engineering into initial access that can be leveraged for lateral movement, data theft, and file encryption.ThreatLabz findings show that ransomware risk extends well beyond technical and executive roles. Managers across core business functions possess the access, authority, and organizational knowledge threat actors need to advance an intrusion. Recommendations for security leadersRestrict unsolicited external messages and calls on collaboration platforms.Train employees to verify unusual IT requests through trusted internal channels.Deploy inline threat protection and endpoint security to detect and block attacks.Monitor for unusual activity across accounts, devices, remote access tools, and data transfers.Enforce least-privilege access to limit what attackers can reach.Use Zero Trust segmentation to contain compromises and prevent lateral movement.Zscaler Zero Trust Exchange Coverage – Zscaler Internet Access (Advanced Cloud Sandbox, Advanced Threat Protection, Advanced Cloud Firewall, SSL Inspection), Deception, Zscaler Private Access (AI Segmentation), Zscaler AI Protect, Zscaler Exposure Management (Asset Exposure Management, External Attack Surface Management, Unified Vulnerability Management) ThreatLabz 2026 Frontier AI Readiness ReportFrontier AI models can identify security vulnerabilities and chain them into a complete attack path, from reconnaissance to data theft, within minutes. Because of this, ThreatLabz worked with leading frontier AI companies to examine whether enterprises are prepared to defend against cyberattacks operating at machine-speed. We leveraged AI models in isolated, controlled simulation environments to emulate the specific attack patterns and velocity of frontier AI. Using these insights, we evaluated organizations on a 0-100 scale, assessing various axes including data protection, attack surface shielding, and decoy deployment to determine how well they could withstand an autonomous, machine-speed attack.Our findings in the ThreatLabz 2026 Frontier AI Readiness Report show that across hundreds of enterprises assessed, the average Frontier AI Readiness Score sat at 37 out of 100. Even more telling, the average AI governance pillar score was just 2.1 out of 20, proving that enterprise readiness for these advanced threats remains virtually at “year zero.”The findings in this report are drawn from Frontier-AI-Readiness Assessments conducted across hundreds of enterprise organizations during H1 2026. 32% are Fortune 500 companies. The cohort spans 12 industries with the following composition:Meaningful insightsEnterprises can maximize their existing AI-defense capabilities with a few simple steps. Organizations can significantly improve their defenses with practical cyber hygiene. In 64% of organizations, the licensed deception product is positioned for deployment to add high-fidelity detection depth. 18% have authentication capabilities that can be extended to additional sites. Through configuration optimization alone, organizations can reach target scores between 73 and 98 out of 100. From the cohort’s average starting score of 37, this represents massive individual point improvements.AI governance is at year zero across every assessed enterprise, regardless of organization size or control breadth. 100% of assessed organizations lack identity-based authentication for their AI, and 91% have publicly exposed AI endpoints. The average AI governance pillar score was 2.1 out of 20 (10.5% of maximum). The highest score in the cohort was 3 out of 20. The exposure is substantial: public AI endpoints were common across the cohort, including internet-exposed MCP endpoints and unauthenticated chatbots or copilots. The most serious cases observed included critical-severity GenAI gateways exposed to the public internet.RecommendationsEnable enforcement mode on security controls.Gate all AI surfaces with identity-aware access immediately.Raise SSL/TLS inspection to a minimum of 70% qualified coverage within 90 days.Replace wildcard domains with named FQDNs on critical segments.Deploy deception on critical network segments.Move internet-exposed VPN appliances behind Zero Trust-brokered access.Patch CISA KEV vulnerabilities on internet-facing assets within 72 hours of assessment. Operation RapidRust targets sensitive data across various platforms and air-gapped networksThreatLabz analyzed new activity by the Pakistan-nexus threat actor APT36, targeting government and defense entities in India and Afghanistan. Since our last publication about the group’s activity in January 2026, APT36 has maintained a high operational tempo and updated its tactics, techniques, and procedures (TTPs) in continued attacks.In this campaign, dubbed Operation RapidRust, ThreatLabz discovered new malware families and post-compromise tools, as well as significant post-compromise activity. The new tools include the RUSTYSHADE backdoor, the RUSTYMOVE post-compromise tool, and the PSNATCH and BASHNATCH file-stealing tools.Command-and-control communicationRUSTYSHADE uses attacker-controlled private GitHub repositories for command-and-control (C2) communication. All messages exchanged between RUSTYSHADE and the GitHub repositories are encrypted using AES-256-GCM.Air-gapped networks at riskAPT36 deployed RUSTYMOVE on a compromised machine during post-compromise activity. Its sole function is to continuously monitor external removable media (e.g., USB, SD, MMC, and IEEE 1394 devices).Post-compromise activityDuring our investigation, ThreatLabz observed post-compromise activity from APT36 operators, including system, user, and network reconnaissance commands, and the deployment of next-stage payloads. Most of the activity took place between August 20, 2026, and September 1, 2026.ThreatLabz analyzed the timestamps associated with the C2 commands and found that the threat actor issued commands only between 4:00 a.m. and 11:00 a.m. UTC. The figure below shows the distribution of C2 commands by hour of the day.ThreatLabz also analyzed the commands by date. As shown in the figure below, all observed activity occurred on weekdays, with no activity observed during the two weekends included in the analysis period.This campaign demonstrates that APT36 continues to target government and defense entities in India and Afghanistan while maintaining high operational tempo and evolving TTPs. To learn more, please visit Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH.Zscaler Zero Trust Exchange Coverage – Zscaler Internet Access (Advanced Cloud Sandbox, Advanced Threat Protection, Advanced Cloud Firewall, SSL Inspection), Deception, Zscaler Private Access (AI Segmentation), Zscaler AI Protect, Zscaler Exposure Management (Asset Exposure Management, External Attack Surface Management, Unified Vulnerability Management) New malware and notable campaignsC2Looper abuses GitHub to support potential ransomware activity: ThreatLabz discovered a new backdoor likely affiliated with an initial access broker for ransomware attacks. It supports typical backdoor commands including remote shell execution, reconnaissance, and deploying additional malware tooling.Abyssos, a modular RAT: ThreatLabz identified Abyssos, a modular RAT with capabilities such as credential theft, file exfiltration, VNC-based remote access, and support for downloadable modules to expand its functionality.ChainDrop (mini Shai-Hulud) turns trusted build pipelines into a supply chain vector: ThreatLabz continues to document the evolution of Shai-Hulud and its potential impact on the software supply chain.Vidar evolves to complicate analysis: ThreatLabz published a technical analysis of Vidar’s latest string obfuscation that leverages a virtual machine combined with custom stream ciphers.Ledger phishing exploits trust in search ads and cloud platforms: ThreatLabz analyzed how threat actors used Google ads and a series of redirects to lure Ledger users into submitting secret recovery phrases.2CLoader, a customizable malware: ThreatLabz analyzed a new malware loader named 2CLoader that has been observed delivering Vidar and Remus.