The Griffith Intrusion Set and the Evolution of Modular MaaS: A 2026 Threat Intelligence Deep Dive

Executive Summary

As we enter September 2026, the global threat landscape has reached a point of unprecedented velocity and modularity. The Encrygma Threat Intel Unit (ETIU) has synthesized recent reporting from the last 72 hours and the broader month of August to identify a significant shift in adversary tradecraft. The primary developments involve the emergence of the GriffithRAT implant, the expansion of the TAG-195 (Golden Chickens) Malware-as-a-Service (MaaS) ecosystem, and the novel use of blockchain technology for command-and-control (C2) resilience by North Korean-linked actors.

These trends are occurring against a backdrop where the median time from CVE disclosure to exploitation has collapsed to mere hours, as noted in the 2026 Fortinet Global Threat Landscape Report. The industrialization of cybercrime, powered by AI-driven reconnaissance and modular malware delivery, has rendered traditional, manual patch management cycles obsolete. This report provides a deep dive into these new malware families and the defensive strategies required to mitigate their impact.

Background & Context

The year 2026 has been defined by the "Year of the Evasive Adversary," a term coined in the CrowdStrike 2026 Global Threat Report. Adversaries are increasingly moving fluidly across identity, cloud, and virtual environments while avoiding heavily monitored endpoints. A key driver of this shift is the 89% increase in attacks by AI-enabled adversaries, who leverage generative models to refine social engineering and automate exploit development.

In the last 24-72 hours, the focus has sharpened on specific intrusion sets that exemplify this evolution. The Griffith intrusion set, previously known for its use of the DarkMe malware, has undergone a significant technical overhaul. Similarly, the TAG-195 group, a notorious MaaS provider, has demonstrated that public disclosures do not necessarily lead to operational cessation but rather to rapid iteration and the release of more complex, modular tooling.

Analysis

The Griffith Intrusion Set: From DarkMe to GriffithRAT

Recent reverse engineering findings published in late August 2026 by researchers at Kaspersky and others have detailed the transition of the Griffith intrusion set. Historically, this group utilized DarkMe, a malware family written in Visual Basic 6 (VB6). However, the latest campaigns targeting fintech and iGaming platforms have introduced a new C++-based implant dubbed GriffithRAT What cybersecurity experts are talking about in 2026.

GriffithRAT represents a significant upgrade in capability. The shift to C++ allows for better performance, easier integration with modern system APIs, and enhanced evasion techniques. The implant includes a custom-developed remote-desktop controller, a sophisticated keylogger, and a file-grabber. Analysis of the GriffithRAT delivery mechanism shows a reliance on signed execution methods to bypass application whitelisting. Furthermore, the group has been observed attempting to influence threat intelligence platforms like VirusTotal through manipulated comments, a form of "intel poisoning" designed to mislead researchers.

TAG-195 (Golden Chickens) Modular Resurgence

The TAG-195 ecosystem, often linked to the financially motivated threat actor group FIN6 or Cobalt Group, has resurfaced with four new malware families: TinyEgg, ChonkyChicken, a modularized variant of ChonkyChicken, and ChromEggscalator Golden Chickens Resurfaces With Four New Malware Families and Modular Implants.

TinyEgg is a lightweight loader designed for initial persistence, while ChromEggscalator is a specialized utility for stealing credentials from modern web browsers. The modular nature of these implants allows TAG-195 customers to select specific capabilities, reducing the footprint of the malware on the infected host. This "pay-per-feature" model is a hallmark of the 2026 MaaS landscape, where stealth is prioritized over broad functionality. The group has also been observed using "ClickFix-style" social engineering, which uses fake browser update prompts or AI-generated technical support warnings to trick users into executing the initial payload ESET H1 2026 Threat Report.

EtherRAT and Smart-Contract C2 Resolution

One of the most technically significant developments in August 2026 is the exploitation of the React2Shell vulnerability (a critical flaw in React Server Components) by North Korean-linked actors to deploy EtherRAT North Korea-linked Actors Exploit React2Shell to Deploy New EtherRAT Malware.

EtherRAT is a Linux-based remote access trojan that utilizes Ethereum smart contracts for C2 resolution. By embedding C2 infrastructure details within the blockchain, the attackers ensure that their communication channels cannot be easily taken down by traditional domain seizures or IP blocking. The malware also deploys five independent persistence mechanisms, making it exceptionally difficult to eradicate once it has gained a foothold in a Linux environment. This use of "Web3" infrastructure for malware operations represents a growing trend in APT tradecraft aimed at achieving long-term persistence in critical infrastructure.

Key Findings

• Modularization of MaaS: Threat actors like TAG-195 are moving away from monolithic payloads toward modular implants (TinyEgg, ChromEggscalator) to minimize detection surface.
• C++ Transition: The Griffith intrusion set's move from VB6 to C++ for GriffithRAT indicates a drive for higher performance and better evasion of modern EDR solutions.
• Blockchain-Based C2: The deployment of EtherRAT highlights the use of Ethereum smart contracts for resilient, decentralized C2 resolution, complicating traditional takedown efforts.
• High-Velocity Exploitation: Vulnerabilities like React2Shell and the SimpleHelp OIDC bypass (CVE-2026-48558) are being weaponized within hours of disclosure Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer.
• Social Engineering Evolution: The rise of "ClickFix" and "ConsentFix" techniques demonstrates how attackers are weaponizing AI and OAuth abuse to bypass MFA and hijack cloud accounts ESET H1 2026 Threat Report.

Attribution & Confidence

ETIU assesses with High Confidence that TAG-195 remains a primary developer for the Golden Chickens MaaS ecosystem, serving multiple financially motivated threat actors. We assess with Medium-High Confidence that the Griffith intrusion set is a cyber-mercenary group, likely operating out of Eastern Europe, given their targeting of global fintech platforms. The attribution of EtherRAT to North Korean-linked actors is based on overlapping TTPs with known Lazarus and Kimsuky campaigns, particularly the focus on Linux environments and innovative C2 mechanisms; ETIU maintains Medium Confidence in this specific attribution pending further infrastructure mapping.

Defensive Recommendations

To counter these evolving threats, organizations must move beyond traditional perimeter defenses:

1. Implement Autonomous Trust: Adopt SASE and Zero Trust architectures that do not rely on static network boundaries but instead verify every identity and device 2026 Fortinet Global Threat Landscape Report.
2. Monitor Blockchain Traffic: Security teams should implement monitoring for unusual interactions with smart contracts or Ethereum nodes, which may indicate EtherRAT-style C2 resolution.
3. Enhance EDR for Modular Payloads: Configure EDR solutions to detect the behavioral patterns of lightweight loaders like TinyEgg, focusing on process injection and unusual API calls rather than file signatures.
4. Prioritize Identity Security: Given the rise of ConsentFix and OAuth abuse, organizations must audit third-party application permissions and enforce FIDO2-compliant MFA to prevent account hijacking ESET H1 2026 Threat Report.
5. Accelerate Patching Cycles: With time-to-exploit measured in hours, automated patch management for edge devices and web frameworks (like React Server Components) is no longer optional.

Outlook

The remainder of 2026 will likely see a continued surge in "Living Off the App" strategies and the further integration of AI into the attack lifecycle. As adversaries refine their use of decentralized infrastructure and modular implants, the burden on defenders to provide real-time, automated responses will grow. The Encrygma Threat Intel Unit anticipates that the Griffith intrusion set will expand its targeting to include decentralized finance (DeFi) protocols, leveraging the technical advancements seen in GriffithRAT. Organizations that fail to adapt to this high-velocity, identity-centric threat environment will face increasing risk of catastrophic intrusion.