In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2493 articles
Palo Alto Networks reports that CL-STA-1087 has targeted Southeast Asian military organizations since at least 2020, using custom backdoors, credential theft and long periods of dormant access to seek sensitive military files.
OpenSourceMalware links GlassWorm activity across GitHub, npm, VS Code and Python through shared Solana and server infrastructure, describing its obfuscation, Node.js infostealer and indicators. The Python campaign was still active on March 14, 2026.
Black Lotus Labs says Volt Typhoon used Silent Train, rotating chains of compromised devices, to reach enterprise management and SD-WAN platforms. Its three-year monitoring identified four confirmed and one likely zero-day campaigns.
Lumen says it tracks over 30 malicious proxy botnet clusters, with nearly 20 million distinct IPs daily. Its analysis describes how operators share and resell access, enabling abuse and rapid recovery after disruptions.
Lumen’s Black Lotus Labs describes a China-nexus infrastructure provider that combines target scanning, commercial proxy relays and operator access systems. Its telemetry links reconnaissance with later proxy traffic to high-value networks.
Lumen researchers describe BambooToken, a Windows and Linux malware family active since at least 2023 that uses MQTT for command and control. Their telemetry links the campaign to targets in Asia and South America.
Black Lotus Labs details PoeLLM, a campaign exploiting exposed AI and other services to mine cryptocurrency and scan for more victims. Its malware derives changing command-and-control addresses from a poem on GitHub.
The analysis details netd, a statically linked Linux backdoor with an encrypted configuration, custom RC4 C2 protocol, interactive shell, and file-transfer commands. A Mach-O variant named ChromeUpdates was also observed on VirusTotal.
StepSecurity traced three waves of malicious React Native npm releases to a maintainer account takeover and a dependency-chain loader for obfuscated malware using Solana for C2. It said technical overlaps suggest a link to GlassWorm.
Trend Micro details Warlock’s use of compromised SharePoint servers, web shells, remote-access and tunneling tools, DCSync, and a vulnerable NSec driver to evade security controls, exfiltrate data, and deploy ransomware across victim networks.
Genians analyzes a Konni campaign that used spear-phishing and malicious LNK files to install RATs, steal information, persist on victims’ systems, and spread additional malware through compromised KakaoTalk sessions.
Socket reports GlassWorm-linked Open VSX extensions using later-added extensionPack and extensionDependencies entries to install malicious extensions transitively. The campaign also rotates infrastructure and obfuscates staged JavaScript loaders, making version-history
StepSecurity says a Polymarket trading bot in the dev-protocol GitHub organization uses typosquatted npm packages to steal wallet and configuration files and install an SSH backdoor; sandbox testing captured exfiltration and firewall changes.
SOCRadar profiles Handala, which multiple vendors assess as an Iran MOIS-linked destructive persona. It details claimed operations, a phishing-to-wiper chain, and mitigations; Stryker confirmed global disruption, while Handala's wipe and data-theft figures remain claims
Seqrite Labs links campaigns targeting government, defense, diplomatic, and energy entities in four countries through a shared HOPPINGANT loader and Rclone configuration. The researchers say the activity is likely coordinated but do not attribute it to a known actor.
An investigation of PeckBirdy-related indicators analyzed DNS, WHOIS and threat-intelligence data, linking domains and IPs to phishing and malware activity and identifying additional infrastructure. The article attributes the framework to China-aligned APTs.
Unit 42 describes CL-STA-1087, a suspected China-nexus espionage cluster targeting Southeast Asian military organizations since at least 2020, and analyzes its AppleChris and MemFun backdoors, Getpass credential harvester, and evasion methods.
Unit 42 reports that suspected China-based operators have targeted Southeast Asian military organizations since at least 2020, using AppleChris, MemFun, and Getpass for stealthy access and targeted intelligence collection.
StepSecurity reports that ForceMemo is injecting malware into hundreds of GitHub Python repositories via account takeovers and stealthy force-pushes. Its analysis traces the payload to Solana-memo C2 and observes Node.js-based execution in a controlled run.
eSentire’s analysis of an open directory attributed to MuddyWater found a PowerShell stager deploying Tsundere, which retrieves C2 addresses from Ethereum smart contracts, uses AES-encrypted WebSockets, fingerprints hosts and persists via a Windows Run key.
Researchers describe a fake $TEMU airdrop using ClickFix to trick users into running a command, then deploy a victim-specific Python backdoor that retrieves and executes code in memory.
IBM X-Force researchers linked suspected LLM-generated PowerShell C2 tool Slopoly to a 2026 Hive0163 ransomware intrusion. Slopoly maintained access and ran commands; ClickFix, NodeSnake and InterlockRAT preceded Interlock ransomware.
Unit 42 describes CL-STA-1087, a suspected China-linked espionage cluster active in Southeast Asian military networks since at least 2020, using custom tools to maintain access and collect targeted C4I-related intelligence.
Socket researchers identified six malicious ophimcms Composer themes on Packagist that bundle JavaScript for URL exfiltration, redirects, ad injection and click hijacking. One redirect chain uses infrastructure linked to FUNNULL.
