In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2484 articles
Kaspersky details Kimsuky campaigns using evolving PebbleDash and AppleSeed malware, phishing droppers, and legitimate VSCode tunneling and DWAgent for persistence and remote access, mainly against South Korean targets.
Researchers traced an underground Telegram marketplace selling iPhone-unlocking and smishing tools. DNS analysis identified more than 10,000 associated domains, with traffic to verified campaign domains rising 350% in 2025 versus 2024.
ReliaQuest reports KongTuke is impersonating help-desk staff in external Teams chats to trick users into running PowerShell that installs ModeloRAT, whose multiple C2 paths and layered persistence complicate containment.
Rapid7 says a Chaos-branded intrusion likely linked to MuddyWater used Microsoft Teams social engineering to steal credentials and establish remote access, then exfiltrated data without encrypting files. Its analysis details the downloader and custom RAT.
Rapid7 traces an enterprise intrusion from a fake Teams IT-support message through ModeloRAT deployment and exploitation of CVE-2023-36036. Attackers harvested domain credentials; memory-dump exfiltration was considered likely, not confirmed.
A WhoisXML API analysis of ransomware-linked DNS, WHOIS and traffic data mapped 267 network IoCs across six 2025 top-10 ransomware families, identifying early-flagged Akira domains, look-alike registrations and associated infrastructure.
Symantec researchers say MuddyWater spent about a week inside an unnamed South Korean electronics maker in February 2026, as part of a campaign targeting at least nine organizations. The group used DLL sideloading, PowerShell and Node.js loaders.
StepSecurity reports that node-ipc versions 9.1.6, 9.2.3 and 12.0.1 published May 14, 2026, contain an obfuscated CommonJS payload that harvests developer credentials and exfiltrates them over HTTPS and DNS.
Researchers found malicious Linux assets on Cemu’s official v2.6 GitHub release page, containing a payload also linked to compromised npm and PyPI packages. The malware harvests credentials and exfiltrates data; maintainers confirmed a co-author’s account or token was|?
Three node-ipc releases published on May 14, 2026, contained a backdoor that runs when the CommonJS entrypoint is loaded, collects host and developer credentials, and attempts to exfiltrate them through DNS TXT queries.
Researchers describe a typosquatted npm package that steals npm and GitHub credentials, republishes trojanized packages through compromised maintainer accounts, and deploys a Tor-connected implant on Linux systems.
Darktrace details a campaign observed in customer environments since September 2025 that uses DLL sideloading and a modular .NET backdoor assessed with moderate confidence to align with Twill Typhoon tradecraft.
eSentire analyzes Amatera Stealer delivered through a ClickFix chain, detailing its shellcode loader, stronger C2 encryption, anti-analysis techniques, and expanded theft of browser, messaging, wallet, and Downloads-folder data.
Hunt IO analyzes TeamPCP’s 13-file Python toolkit, detailing its credential theft, layered exfiltration through C2 and GitHub, conditional wiper, and newly identified infrastructure.
Bitdefender attributed a multi-wave intrusion targeting an Azerbaijani oil and gas firm to FamousSparrow with moderate-to-high confidence. The activity reportedly reused an Exchange entry point and involved ProxyNotShell, Deed RAT, and TernDoor.
The report details Gamaredon’s campaign against Ukrainian state institutions, showing how CVE-2025-8088 weaponized archives install GammaDrop and GammaLoad, which establish persistence, profile hosts and retrieve tailored payloads.
Sysdig researchers traced KeyHunter activity exploiting Langflow CVE-2026-33017 to deploy credential-harvesting workers, validate AWS and AI keys, and use an ACL-enforced NATS server for C2; the operator also attempted container escape.
The profile details Keymous+’s DDoS methods, targets and defenses. It reports that NETSCOUT ATLAS independently verified 249 attacks in Feb–Sep 2024, while the group claimed more than 700 by 2025, and assesses an operator-level link to EliteStress.
Check Point Research analyzed a partial leak of The Gentlemen's Rocket backend and chats, linking nine accounts and eight affiliate TOX IDs while documenting alleged access workflows, exploit tracking, and a reported $190,000 ransom settlement.
A self-propagating worm attributed to TeamPCP reportedly compromised 170 npm packages and two PyPI packages, stealing CI credentials through OIDC and spreading via republished releases. The article details affected versions, persistence, exfiltration, and response steps
Datadog Security Labs describes the Clawsights Claude Code skill’s attempt to steal GitHub tokens and shows dynamic-context commands can run before model review. It recommends reviewing skill locations, disabling shell execution, and monitoring agents.
Socket researchers identified 155 RubyGems package artifacts that scrape UK council meeting portals and publish the collected pages in gem archives using embedded API credentials. RubyGems says existing accounts, packages, and installs were unaffected by a related spam-
ThreatFabric reports that TrickMo C targets banking and crypto-wallet users in France, Italy and Austria. The variant uses TON for C2 and adds reconnaissance, SSH tunneling and SOCKS5 proxying that can turn infected Android devices into network pivots.
Researchers analyzed 191 DNS, domain, IP and WHOIS indicators linked to eight Iran-affiliated APT groups, identifying historical resolutions, likely malicious registrations, look-alike domains and infrastructure assessed as part of an impersonation campaign.
