DeskRAT targets Indian government Linux systems via TransparentTribe (APT36). MuddyWater expands espionage campaign beyond the Middle East using Phoenix v4 backdoor. Jira flaw CVE-2025-22167 enables file manipulation. Warlock ransomware blends Chinese espionage and cybercrime.