In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2495 articles
CYFIRMA reports a campaign attributed to Transparent Tribe (APT36) using ZIP lures, LNK files and a macro-enabled PowerPoint add-in to deploy a .NET RAT with raw TCP C2, persistence, screen monitoring and file-exfiltration capabilities.
The profile describes Andariel as a DPRK-linked group conducting espionage and revenue-driven operations. It outlines the group’s access methods, malware, credential theft, data exfiltration and ransomware, and recommends defenses.
Zscaler ThreatLabz attributes the Ruby Jumper campaign to ScarCruft. Its malware uses Zoho WorkDrive for C2 and removable media to transfer commands and data between internet-connected and air-gapped systems.
ReliaQuest reports that ShinyHunters is combining subdomain impersonation, phone-guided mobile AiTM phishing, and outsourced vishing to steal SSO sessions and access SaaS data; it recommends stronger MFA and rapid session containment.
Researchers describe phishing campaigns that place malicious content behind IPv6 reverse-DNS names under .arpa, using A records, redirects and hijacked CNAMEs to evade reputation-based defenses.
Microsoft researchers describe a coordinated campaign using fake Next.js projects and coding tests to target developers. Opening or running malicious repositories can trigger in-memory JavaScript backdoors that enable remote code execution and staged data exfiltration.
Researchers say AirSnitch exploits Layer 1/2 identity desynchronization to bypass Wi-Fi client isolation—not break Wi-Fi encryption—enabling bidirectional interception on tested routers. An attacker needs some network access.
JPCERT/CC recaps JSAC 2026 Day 2 presentations on forensic journal analysis, phishing services, residential proxies, RapperBot, a WSUS exploit incident, Silver Fox malspam and Qilin ransomware.
ThreatLabz details APT37’s Ruby Jumper campaign, which uses malicious LNK files and a suite of tools to spread through removable media, relay commands and data across air-gapped systems, and deploy surveillance backdoors.
Cofense details campaigns using Windows File Explorer and WebDAV links hosted on short-lived Cloudflare Tunnel demos to deliver RATs. 87% of observed reports delivered multiple RATs, including XWorm, Async RAT and DcRAT.
Microsoft researchers traced malicious recruiting-themed Next.js repositories to three execution paths—VS Code workspace tasks, trojanized build assets, and backend startup—that run remote JavaScript, expose environment data, and enable staged C2 tasking and file exfil
Cyble analyzed 180+ SURXRAT samples, linking the Android RAT to ArsinkRAT and detailing its Telegram MaaS model, Firebase C2, surveillance and extortion features, and conditional download of a >23GB LLM for selected Free Fire apps.
Researchers detail 2025–2026 campaigns targeting telecom companies in Kyrgyzstan and Tajikistan with phishing documents and LuciDoor or MarsSnake backdoors, and identify related activity in China and a compromised MikroTik router used as C2.
A threat actor exploited an unpatched Apache ActiveMQ server twice using CVE-2023-46604, then used stolen credentials and RDP to deploy LockBit ransomware across the network.
A technical review of MuddyWater campaigns describes phishing with malicious documents and legitimate RMM installers, plus Rust-based payloads used for reconnaissance and C2 communications. The article recommends endpoint behavior monitoring and EDR.
Threat Fabric details Massiv, an Android banking Trojan distributed through IPTV-themed apps. It steals credentials and controls devices remotely, enabling fraudulent transactions; campaigns have been observed in southern Europe.
Wiz describes a pipeline for finding malicious Microsoft Entra OAuth apps and reports 19 apps in a 2025 campaign, plus seven apps dating to 2019 that it says appeared across more than 50 organizations.
Researchers analyzed a macOS ClickFix campaign using typosquatted Homebrew pages to steal credentials and deliver Cuckoo Stealer, a persistent RAT that can collect sensitive data and execute commands.
Huntress analyzed a ClickFix intrusion that delivered Matanbuchus 3.0 and a previously unseen RAT, AstarionRAT. The operator created rogue accounts and moved laterally, but Defender blocked later RAT deployments before the operator reached its suspected objective.
Bitdefender researchers detail LummaStealer’s resurgence after a 2025 law-enforcement disruption, tracing campaigns that use CastleLoader, social-engineering lures and fake CAPTCHA pages to steal credentials, sessions and other sensitive data.
Team Cymru used Scout and NetFlow queries to identify ORB nodes and communications involving Singapore telecom networks, contextualizing the findings with CSA’s account of UNC3886’s campaign and Singapore’s router-security rules.
Huntress traced two intrusions using Net Monitor for Employees and SimpleHelp for remote access and persistence. One involved an attempted Crazy ransomware deployment; shared infrastructure suggests the cases may share an operator.
CloudSEK says it infiltrated Gunra’s newly launched affiliate program and analyzed a Windows ransomware sample that uses ChaCha20 and RSA-4096, encrypts selected files offline, and leaves R3ADM3.txt ransom notes.
Researchers found 40 trojanized ClawHub skills directing users to a lookalike OpenClawCLI site, which served an obfuscated command to download and run malware. The site was offline as of February 9.
