VB2026 preview: Griffith, LANDFALL, Gorbag research
A VB2026 conference preview details five 2026 threat-research findings: the Griffith cyber-mercenary group, hospitality-sector reservation fraud, Samsung zero-click Android spyware (LANDFALL), Russia-aligned espionage group Gorbag, and new attacks against agentic AI platforms.
Sourcevirusbulletin.com — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This piece previews five research talks slated for VB2026, spanning distinct areas of the threat landscape. Kaspersky researchers cluster the VB6-based DarkMe malware and a new C++ implant, GriffithRAT, into a single cyber-mercenary intrusion set dubbed Griffith, active against fintech and iGaming platform users since late 2024, with initial access via Telegram and Skype. Gen Digital documents 'Reservation Hijack', a multi-stage hospitality fraud chain that begins with phishing against hotel/booking staff and pivots to guest-facing fraud using stolen reservation context delivered through Booking.com, Cloudbeds, SMS, WhatsApp, and email. Unit 42 details LANDFALL, a previously unknown commercial-grade Android spyware framework that exploited a zero-day in Samsung's image-processing library for zero-click compromise via WhatsApp-delivered malformed DNG files, attributed to a UAE-linked actor also running parallel Windows intrusions against Middle Eastern government and financial targets.
ESET introduces Gorbag, a Russia-aligned espionage group targeting Ukrainian military, law enforcement, defence-industry, and local-government entities since early 2025 via spear-phishing with conscription- and drone-procurement-themed lures, deploying a PowerShell backdoor or custom infostealer and self-deleting to hinder forensics. Finally, Gen/Avast researchers examine emerging threats to agentic AI platforms (Claude Code, Cursor, OpenClaw), including the ClawHavoc campaign weaponizing the ClawHub skill ecosystem to spread AMOS and Amatera infostealers, and the Skynet malware's embedded prompt injections designed to fool AI-based security tools. The researchers also cite an incident where an autonomous coding agent deleted 1.9 million rows of customer data due to misidentifying a production environment, underscoring risks from agent autonomy beyond adversarial attack.
Collectively, the article is a research roundup rather than an active incident report, but it surfaces concrete, named intrusion sets, a zero-day exploitation chain, and a genuinely new attack surface (agentic AI abuse) that defenders should track ahead of broader disclosure at VB2026 in October.
Mentioned in this report
Detection guidance
PowerShell Backdoor Execution with Self-Deletion Pattern
A behavioural hunt for the technique in general.
Detects PowerShell spawning with suspicious command patterns followed by rapid self-deletion attempts, consistent with Gorbag espionage toolkit behaviour. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PowerShell Backdoor Execution with Self-Deletion Pattern
description: Detects PowerShell processes executing encoded or obfuscated commands
followed by process self-termination or file deletion, typical of Gorbag-style infostealers
and backdoors designed to hinder forensics.
tags:
- attack.execution
- attack.stealth
- attack.t1059.001
- attack.t1070
logsource:
category: process_creation
product: windows
detection:
selection_powershell:
Image|endswith: \powershell.exe
CommandLine|contains:
- -EncodedCommand
- -enc
- IEX
- Invoke-Expression
selection_suspicious_args:
CommandLine|contains:
- System.Diagnostics.Process
- Remove-Item
- 'del '
- $PSVersionTable
filter_legitimate:
CommandLine|contains:
- -NoProfile -Command "&{
- Write-Host
- Get-Help
condition: selection_powershell and selection_suspicious_args and not filter_legitimate
falsepositives:
- PowerShell-based system administration scripts using encoded commands
- Legitimate cleanup tasks in deployment automation
level: high
id: a26e0d30-271a-5ec3-8a7b-b4c2217769ce
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.virusbulletin.com/blog/2026/08/what-cybersecurity-experts-are-talking-about-2026
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs