VB2026 preview: Griffith, LANDFALL, Gorbag research

3 August 2026 elevated threat financial-servicesgovernment-nationaldefense

A VB2026 conference preview details five 2026 threat-research findings: the Griffith cyber-mercenary group, hospitality-sector reservation fraud, Samsung zero-click Android spyware (LANDFALL), Russia-aligned espionage group Gorbag, and new attacks against agentic AI platforms.

This piece previews five research talks slated for VB2026, spanning distinct areas of the threat landscape. Kaspersky researchers cluster the VB6-based DarkMe malware and a new C++ implant, GriffithRAT, into a single cyber-mercenary intrusion set dubbed Griffith, active against fintech and iGaming platform users since late 2024, with initial access via Telegram and Skype. Gen Digital documents 'Reservation Hijack', a multi-stage hospitality fraud chain that begins with phishing against hotel/booking staff and pivots to guest-facing fraud using stolen reservation context delivered through Booking.com, Cloudbeds, SMS, WhatsApp, and email. Unit 42 details LANDFALL, a previously unknown commercial-grade Android spyware framework that exploited a zero-day in Samsung's image-processing library for zero-click compromise via WhatsApp-delivered malformed DNG files, attributed to a UAE-linked actor also running parallel Windows intrusions against Middle Eastern government and financial targets.

ESET introduces Gorbag, a Russia-aligned espionage group targeting Ukrainian military, law enforcement, defence-industry, and local-government entities since early 2025 via spear-phishing with conscription- and drone-procurement-themed lures, deploying a PowerShell backdoor or custom infostealer and self-deleting to hinder forensics. Finally, Gen/Avast researchers examine emerging threats to agentic AI platforms (Claude Code, Cursor, OpenClaw), including the ClawHavoc campaign weaponizing the ClawHub skill ecosystem to spread AMOS and Amatera infostealers, and the Skynet malware's embedded prompt injections designed to fool AI-based security tools. The researchers also cite an incident where an autonomous coding agent deleted 1.9 million rows of customer data due to misidentifying a production environment, underscoring risks from agent autonomy beyond adversarial attack.

Collectively, the article is a research roundup rather than an active incident report, but it surfaces concrete, named intrusion sets, a zero-day exploitation chain, and a genuinely new attack surface (agentic AI abuse) that defenders should track ahead of broader disclosure at VB2026 in October.

Mentioned in this report

Threat actors GorbagGriffithUAE-linked threat actor

Malware AMOSAmateraBridgeHeadDarkMeGriffithRATLANDFALLSkynet

Campaigns ClawHavocReservation Hijack

Detection guidance

PowerShell Backdoor Execution with Self-Deletion Pattern

ATT&CK T1086

Detects PowerShell spawning with suspicious command patterns followed by rapid self-deletion attempts, consistent with Gorbag espionage toolkit behaviour. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PowerShell Backdoor Execution with Self-Deletion Pattern
description: Detects PowerShell processes executing encoded or obfuscated commands
  followed by process self-termination or file deletion, typical of Gorbag-style infostealers
  and backdoors designed to hinder forensics.
tags:
- attack.execution
- attack.defense-evasion
- attack.t1086
- attack.t1070
logsource:
  category: process_creation
  product: windows
detection:
  selection_powershell:
    Image|endswith: \powershell.exe
    CommandLine|contains:
    - -EncodedCommand
    - -enc
    - IEX
    - Invoke-Expression
  selection_suspicious_args:
    CommandLine|contains:
    - System.Diagnostics.Process
    - Remove-Item
    - 'del '
    - $PSVersionTable
  filter_legitimate:
    CommandLine|contains:
    - -NoProfile -Command "&{
    - Write-Host
    - Get-Help
  condition: selection_powershell and selection_suspicious_args and not filter_legitimate
falsepositives:
- PowerShell-based system administration scripts using encoded commands
- Legitimate cleanup tasks in deployment automation
level: high
id: a26e0d30-271a-5ec3-8a7b-b4c2217769ce
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.virusbulletin.com/blog/2026/08/what-cybersecurity-experts-are-talking-about-2026

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free