SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 107

Malware campaigns are increasingly targeting specific sectors, with recent attacks highlighting the vulnerability of Microsoft 365 calendars. The Chaos ransomware's msaRAT module, for instance, leverages browser-based communication to establish covert command and control channels. Another notable threat, SleeperGem, involves compromised RubyGems, including git_credential_manager, Dendreo, and fastlane, which drop a persistent backdoor. AgentBaiting, a separate campaign, utilizes over 800 fake AI skills and MCP servers to deliver malware. These threats underscore the importance of operational resilience planning, particularly in sectors that rely heavily on Microsoft products. The UAC-0145 primary compromise vectors, as of July 2026, further emphasize the need for proactive measures to mitigate such risks¹. So what matters to practitioners is that ransomware targeting Microsoft products demands sector-specific risk assessments and tailored operational resilience strategies to minimize potential disruptions.