In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2486 articles
Socket reports 73 Open VSX extensions linked to GlassWorm, with at least six activated to deliver malware. The investigation describes cloned listings, dependency-based delivery, native binaries, and obfuscated JavaScript loaders.
Unit 42 analyzes a malicious @bitwarden/cli package attributed to a TeamPCP campaign. Its payload harvests developer and cloud credentials, exfiltrates them through C2 and GitHub, and backdoors npm packages to spread.
SentinelOne researchers describe fast16, a Lua-based Windows framework dating to 2005. Its kernel driver could alter engineering and simulation software calculations; the investigation details its components and propagation, and places it before Stuxnet.
Researchers linked Harvester’s Linux GoGra backdoor to its Windows variant through shared code and typos. It uses Microsoft Graph and Outlook for C2; researchers reported no observed victims in this activity.
ESET attributes a toolset of backdoors and injectors to China-linked GopherWhisper, which infected about 12 systems at a Mongolian government institution and likely targeted dozens more. Its tools use legitimate services for command and control and data exfiltration.
Cyble researchers report 16,800+ spoofed domains impersonating government services to harvest credentials and payment-card data. The campaign uses deceptive subdomains and hyphens; one infrastructure cluster was assessed as consistent with APT36.
A GitHub Actions script-injection flaw let an attacker forge a release of elementary-data 0.23.3, published to PyPI and GHCR with a credential-stealing .pth payload. The team removed the artifacts and released clean 0.23.4.
U.S. and U.K. agencies report that UAT-4356-attributed Firestarter persists on Cisco ASA/FTD firewalls through reboots and updates, using LINA hooks and crafted WebVPN requests. They link access to CVE-2025-20333 and/or CVE-2025-20362 and advise reimaging.
Cyfirma analyzes KYCShadow, an Android malware campaign distributed via WhatsApp. Its hidden payload uses fake KYC screens, SMS and call control, and a VPN; the report links its infrastructure to earlier e-Challan fraud with moderate-to-high confidence.
SentinelLabs analyzed Fast16, a Lua-based malware referenced in the ShadowBrokers leak and reportedly used in 2005. Its driver could patch precision-calculation software; researchers say evidence suggests US development, while specific targets remain unconfirmed.
SentinelLABS analyzed fast16, a 2005 Lua-based framework whose boot-start driver patched executable code in memory, apparently targeting high-precision engineering software. Researchers linked its name to ShadowBrokers’ Territorial Dispute signatures; exact targets are未
Researchers report Tropic Trooper campaigns used compromised home routers to hijack DNS and deliver trojanized updates, while targeting individuals in Japan, Taiwan, and South Korea with new malware, phishing decoys, and other lures.
Mandiant reports that UNC6692 uses email bombing and Microsoft Teams help-desk impersonation to deliver a modular SNOW toolkit, steal credentials, move laterally, and collect and exfiltrate data.
U.S. and U.K. agencies identified Firestarter, a backdoor that can persist on Cisco firewalls after patches and standard reboots. CISA found it on a federal device and ordered agencies to audit appliances and submit memory snapshots.
RH-ISAC describes CL-CRI-1116 targeting retail and hospitality with vishing and SSO phishing to steal credentials, abuse SaaS access to locate and exfiltrate sensitive files, and extort victims; it recommends caller-verification policies, training and technical controls
Google Threat Intelligence Group details UNC6692’s Teams-based social engineering and its modular SNOW malware suite, tracing credential theft, persistence, lateral movement, and exfiltration through a victim environment.
An analysis of 20 network IoCs tied to ForceMemo used DNS and WHOIS data to identify look-alike registrations, linked domains and additional IPs; the researchers caution that some flagged entities may prove harmless.
Symantec reports that Trigona affiliates used a custom uploader in March 2026, with parallel transfers, connection rotation and file filtering, after disabling defenses; intrusions also involved AnyDesk and credential-theft tools.
LevelBlue analyzes StepDrainer and EtherRAT, detailing how wallet-phishing drainers and a trojanized Windows installer combine crypto-focused operations with traditional malware techniques, including obfuscated payload delivery, on-chain configuration, and persistence.
Cisco Talos reports that UAT-4356 exploited two vulnerabilities to access Cisco Firepower devices and deploy FIRESTARTER, a backdoor that enables remote code execution in the LINA process.
Researchers detail a campaign active since at least 2020 that uses fake CAPTCHAs and traffic-distribution systems to trick users into sending large batches of international SMS messages, generating revenue for the operators and unexpected charges for victims.
Rapid7 analyzed Windows and ESXi Kyber ransomware samples recovered during a March 2026 response, finding distinct encryption implementations, shared campaign infrastructure, ESXi VM and datastore targeting, and Windows anti-recovery capabilities.
A LABScon 2025 investigation found Eken- and Tuck-branded cameras and doorbells share Allwinner hardware, hardcoded root credentials, and superficial firmware fixes. Researchers say traffic routes through China and Hong Kong and warn that opaque suppliers and remote re-
ESET researchers linked China-aligned GopherWhisper to an intrusion at a Mongolian government entity, documenting backdoors using Slack, Discord and Outlook drafts for C2, file exfiltration via file[.]io, and recovered operator messages supporting the investigation.
