The Good, the Bad and the Ugly in Cybersecurity – Week 35

This report summarizes multiple active threats: INTERPOL-led Operation Jackal IV and related takedowns of West African cybercrime and CaaS providers; US disruptions of QScan/QTRouter IoT botnets tied to Chinese state-aligned actors targeting critical US networks; US Treasury sanctions (Economic Outcast) on Iran-linked operators; a supply-chain compromise by TeamPCP that backdoored open-source projects and stole developer credentials; the NovaCookies phishing-as-a-service platform abusing DocuSign to capture Microsoft 365 sessions; and a Spark RAT campaign in Cambodia using BYOVD and CVE-2026-36425 to escalate privileges and disable security products.