The Larva-26002 threat actor has been active in targeting mismanaged MS-SQL servers, exploiting vulnerabilities associated with the Bulk Copy Program (BCP) utility. This group is known for deploying various strains of ransomware, including Trigona and Mimic, and has evolved its tactics and tools over time. In 2026, they have notably adopted a Go language-written malware named ICE Cloud Client, a scanner designed to facilitate further malicious activities.