In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2489 articles
Sekoia TDR details a pythonnet/dnlib workflow for decrypting strings in an APT28-modified Covenant Grunt, decompiling .NET malware, and automating analysis through its released RePythonNET-MCP server.
Sucuri analyzed an obfuscated PHP backdoor in a compromised Joomla site. The loader contacts remote C2 servers to retrieve instructions that can redirect visitors or inject spam and other content.
Proofpoint observed a cargo-theft actor in a decoy environment for over a month, using multiple remote management tools and a third-party signing service for persistence while conducting reconnaissance for financial and transportation-related access.
An analysis of Telegram activity finds Ashab al-Yamin’s attack claims and media circulate across Iranian-aligned channels, complicating attribution and leaving its status as a distinct operational group uncertain.
Panther reports that obfuscated npm packages found April 6–9, 2026, delivered OtterCookie through benign-looking wrappers. The malware searches for secrets, scans files via a Vercel-hosted C2, and installs an SSH key backdoor on Linux.
Validin details UNC1069 fake-meeting lures against crypto and Web3 targets, browser-based audio/video capture, and Windows, macOS and Linux payload chains deploying apparent updated Cabbage RAT variants and, on macOS, a sample identified as NukeSped.
Sysdig researchers recorded exploitation of marimo CVE-2026-39987 and analyzed credential harvesting, database pivoting, and an NKAbuse variant delivered via a typosquatted Hugging Face Space. They recommend patching and behavioral hunting.
CERT-UA links the UAC-0247 cluster to Ukraine-focused attacks using AgingFly against local governments and hospitals. The C# malware targets browser and WhatsApp data through a phishing-led LNK-to-HTA chain and dynamically compiles C2-delivered handlers.
Zscaler researchers detail Payouts King ransomware, linking some activity to former BlackBasta affiliates and describing its social-engineering access methods, evasion, persistence, encryption, and impact on security processes.
Huntress found Dragon Boss Solutions adware silently deploying SYSTEM-level MSI and PowerShell payloads that disable antivirus. Researchers observed over 23,500 infected hosts seeking instructions and sinkholed the unregistered update domain.
JUMPSEC reports a direct operational link between Muddy Water infrastructure and TAG-150’s CastleRAT, describing ChainShell, HVNC browser-session access, smart-contract-based C2, and payloads compiled before Feb. 28.
Malwarebytes analyzed a phishing-as-a-service kit targeting YouTube creators with personalized fake copyright notices and a Browser-in-the-Browser Google login overlay. It rotates domains, tracks affiliates, and exempts channels over 3 million subscribers.
Acronis TRU researchers describe a JanaWare campaign active since at least 2020, linking it to a customized Adwind RAT. The reported operation targets Turkish users through phishing and uses geofencing, obfuscation, defense evasion, and AES encryption.
Researchers analyzed 29 DNS and WHOIS indicators linked to the Keenadu Android firmware backdoor, finding related domains and IPs. Traffic data showed 339 client IPs contacting three indicator domains and 61 potential victim IPs contacting two indicator IPs.
Socket researchers identified 108 Chrome extensions (~20,000 installs) sharing C2 infrastructure. They detail Google identity harvesting, Telegram session theft, remote URL execution and defenses; the extensions were live when reported.
Researchers report more than 200 NPM packages posing as an AI coding agent. Their postinstall scripts deploy platform-specific infostealers that harvest credentials; packages removed from NPM may remain available through some mirrors.
ReliaQuest says a likely former Black Basta affiliate campaign pairs email bombing with Teams help-desk impersonation and RMM tools to target executives, reporting rapid access and recommending verification, tool controls, and targeted training.
Huntress analyzed Dragon Boss Solutions software that silently disabled antivirus and persisted on Windows systems. It found an unregistered update domain could let an attacker deliver arbitrary payloads; sinkholed requests came from 23,565 unique IPs in 24 hours.
Kaspersky says JanelaRAT targets Latin American financial institutions using phishing, DLL side-loading and a malicious Chromium extension. Telemetry recorded 14,739 attacks in Brazil and 11,695 in Mexico in 2025; successful compromises are unknown.
Proofpoint describes how attackers use Microsoft 365 mailbox rules to hide messages, exfiltrate email, persist after password resets and hijack threads. It reports malicious rules in about 10% of compromised accounts in Q4 2025 and details ATOLS automation and defenses.
Elastic Security Labs describes REF6598, a LinkedIn- and Telegram-led campaign that abused synced Obsidian plugins to deliver PHANTOMPULL and PHANTOMPULSE on Windows and an AppleScript dropper on macOS. Elastic says it blocked an observed attack early.
Varonis describes Storm, a subscription infostealer that sends encrypted Chromium and Gecko browser data to operators for server-side decryption, then automates cookie-based session restoration. Its panel showed 1,715 logs, though real-victim status was uncertain.
CIS details a MacSync Stealer campaign targeting U.S. SLTT macOS users through SEO-poisoned fake CAPTCHAs. The malware can steal credentials, system data and crypto assets, and trojanize Ledger apps to capture seed phrases.
The analysis details JanelaRAT’s evolving infection chain and its use of overlays, input injection and remote control to hijack banking sessions. 2025 telemetry recorded thousands of detections in Brazil and Mexico.
