Cluster of threat groups continues on trajectory to consolidate with shared victims, TTPs and evolving malware.
We uncovered a novel multiplatform threat named “NKAbuse”. The malware utilizes NKN technology for data exchange between peers, functioning as a potent implant, and equipped with both flooder and backdoor capabilities.
Rhadamanthys v0.5.0 is a modular information stealer with a broader feature set, including spying capabilities, a plugin system, and a multi-stage loading chain. The Check Point Research deep dive explains how its components load, decrypt, and execute across 3…
ESET researchers document a series of new OilRig downloaders, all relying on legitimate cloud service providers for C&C communications
The report analyzes a threat actor’s activity from an openly accessible directory, profiling their victims and techniques over more than a year with a mix of non-financial and crypto-mining operations. The actor relied on open-source tools (sqlmap, ghauri, htt…
Batloader is an evolving loader capable of delivering various threats (including stealers and ransomware) via a multi-stage infection chain with strong evasion techniques. The blog breaks down how Batloader loads payloads, obfuscates components, bypasses AMSI/…
Stockpiled domains are used by malicious actors to stockpile large numbers of domains and automate infrastructure setup, leaving traces in certificate transparency logs and passive DNS that defenders can detect with multi-source analysis. Palo Alto Networks de…
Sophos traces a multinational pig butchering network that uses fake DeFi apps and social engineering to drain victims’ crypto wallets across dozens of domains and contract wallets, laundering millions in proceeds. The operation appears to involve multiple affi…
Xorbot is a stealthy, from-scratch botnet with strong concealment and encrypted C2 communications, designed to evade mainstream AV detection. It uses junk code to inflate its footprint, hides its persistence, and can perform DDoS attacks while maintaining a co…
CYFIRMA analyzes a multi-stage Sidewinder campaign delivering a malicious Word document with embedded macros that installs the Nim backdoor (conhost.exe) and establishes C2 with the attackers. Attributed to the Sidewinder group (also known as Rattlesnake, Baby…
Lumen Black Lotus Labs describes the KV‑botnet, a SOHO router and camera malware campaign that creates multi‑hop covert tunnels and in‑memory payloads to relay data for advanced threat actors. Operators remove competing malware, spawn ephemeral listeners and i…
The article provides a technical breakdown of Cerber ransomware, covering unpacking of a packed payload, mutex-based execution checks, CryptoAPI usage to decrypt embedded configuration (including target/blocked extensions and an RSA public key), and an encrypt…
In this report, we share our latest crimeware findings: FakeSG malware distribution campaign delivering NetSupport RAT, new Conti-like Akira ransomware and AMOS stealer for macOS.
The article exposes a joint cyber extortion campaign attributed to three ransomware groups—BianLian, White Rabbit, and Mario—spanning a broad set of global IPs. It presents an extensive list of IP addresses and their geographic locations, likely reflecting att…
A two-stage MySQL-based malware infection uses SQL commands to infiltrate a server, establish a UDF-loaded backdoor, and run a Windows Trojan delivered via that foothold. The operation includes credential brute-forcing, environment discovery, payload deploymen…