GMI Cloud raised $663 million: a $223 million Series B with Nvidia in the round and a $440 million credit facility from ChinaTrust Commercial Bank. Teams that need GPUs in Taiwan, Thailand or Malaysia get a funded local supplier whose expansion rests mostly on borrowed money.
Perspective Coverage
3 publishers
- Builder
- Builder 20%
- Operator
- Operator 37%
- Investor
- Investor 43%
Reality
- Evidence55
- Adoption50
- Hype gap+30
- Incentives65
- Confidence60
GMI Cloud raised $668 million, two-thirds of it through a $445 million credit facility led by CTBC and the rest as a $223 million Series B. Repaying debt on that scale depends on the more than $600 million in contracted annual revenue GMI reports and on how quickly it puts GPUs into production to serve it.
Reality
- Evidence35
- Adoption50
- Hype gap+20
- Incentives65
- Confidence40
Securelist says the newest CoolClient deploys a signed kernel-mode driver as a Windows service to hide its process, files and registry keys. It was seen in Pakistan, Mongolia and Myanmar.
Reality
- Evidence62
- Adoption30
- Hype gap+10
- Incentives35
- Confidence60
Trend Micro says the loader fires when the module is imported, not when it is installed. That moves the only workable control from install-hook scanning to knowing every name in the resolved tree.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+20
- Incentives35
- Confidence60
Google Threat Intelligence and Mandiant put the Brazilian crew's route to Pix and STR at password spraying plus a fake IT support call, which means the controls that bite here are RMM allow-listing and out-of-band verification of the help desk.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence55
ESET traced more than a year of espionage against government organizations in eight Latin American countries and territories to a modular C++ implant that hooks CreateThread so every thread it spawns looks like AnimateWindow.
Perspective Coverage
5 publishers
- Builder
- Builder 22%
- Operator
- Operator 68%
- Investor
- Investor 10%
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+5
- Incentives
- Insufficient
- Confidence68
LastPass traced a fake Authenticator hosted on GitHub to a months-long impersonation campaign that spoofed at least 40 organizations, including its own brand. The server steering victims to the download was still being updated in September.
Perspective Coverage
4 publishers
- Builder
- Builder 27%
- Operator
- Operator 64%
- Investor
- Investor 9%
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+15
- Incentives40
- Confidence70
Huntress found the same one-megabyte PIF in two customer environments, pulled down by a link that promised a PNG. Everything after it is the 2024 DarkMe chain, down to the rundll32 /sta GUID from that campaign.
Reality
- Evidence72
- Adoption22
- Hype gap+14
- Incentives66
- Confidence68
LastPass and Delphos Labs say a single malware-as-a-service kit impersonated at least 40 companies on GitHub, and the kernel driver it delivered was Microsoft-attested and undetected by every engine on VirusTotal.
Publishers:blog.lastpass.com
Reality
- Evidence62
- Adoption48
- Hype gap+12
- Incentives68
- Confidence55
The only public count of internet-exposed MCP servers is fourteen months old, so a new open-source scanner fingerprints them by protocol handshake and reports which ones answer a caller holding no credentials.
Reality
- Evidence46
- Adoption20
- Hype gap+15
- Incentives55
- Confidence47
Group-IB puts the Qilin affiliate cut at up to 80 percent, and KELA logged a change that routes victim payments through affiliate wallets first, which says more about the operation's incentives than its thin public tradecraft record does.
Publishers:blog.bushidotoken.net
Reality
- Evidence54
- Adoption63
- Hype gap+14
- Incentives71
- Confidence57
Check Point says a Chinese-speaking crew has been running custom Apache modules on compromised Brazilian federal, state and municipal web servers since mid-2025, so the address bar and the TLD tell a visitor nothing useful.
Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 58%
- Investor
- Investor 19%
Reality
- Evidence67
- Adoption58
- Hype gap+26
- Incentives66
- Confidence65
Sygnia says the actor pivoted from vCenter into ESXi on stolen vpxuser credentials, left backdoors that survive reboots, and terminated vmsyslogd so the hosts stopped writing an audit trail while containment ran.
Reality
- Evidence55
- Adoption35
- Hype gap+15
- Incentives70
- Confidence50
A Raxis post catalogues three campaigns that made GitHub the delivery host rather than the hiding place, which is why the 1,300 repositories flagged as open to RepoJacking matter more than the million-device headline above them.
Reality
- Evidence28
- Adoption45
- Hype gap+38
- Incentives65
- Confidence34
Broadcom's Threat Hunter Team says the same small team, the same infrastructure and one control panel serve both Chinese state espionage and a crypto-fraud sideline. Actor-type triage does not survive that.
Reality
- Evidence58
- Adoption68
- Hype gap+12
- Incentives62
- Confidence55