New SteelFox Trojan mimics software activators, stealing sensitive data and mining cryptocurrency
CategoryDetailsThreat ActorsUnattributed (Crimeware authors behind "SteelFox").Campaign OverviewSteelFox crimeware bundle distributed via malicious torrents and forums,…
Cloudy With a Chance of RATs: Unveiling APT36 and the Evolution of ElizaRAT
CategoryDetailsThreat ActorsAPT36 (Transparent Tribe)Campaign OverviewTargeting Indian government organizations, diplomatic personnel, and military facilities. Focus on…
Best Laid Plans: TA453 Targets Religious Figure with Fake Podcast Invite Delivering New BlackSmith Malware Toolset
CategoryDetailsThreat ActorsIranian Threat actor TA453 (Charming Kitten), likely supporting Iranian government interests, specifically the IRGC…
Threat Actor Abuses Gophish to Deliver New PowerRAT and DCRAT
CategoryDetailsThreat ActorsUnknown Threat actor using Open-Source Gophish ToolkitCampaign OverviewPhishing campaign using modular infection chains (Maldoc…
Beyond the Surface: the evolution and expansion of the SideWinder APT group
CategoryDetailsThreat ActorsSideWinder (also T-APT-04, RattleSnake)Campaign OverviewProlific APT group active since 2012, targeting military & government…
The Crypto Game of Lazarus APT: Investors vs. Zero-days
CategoryDetailsThreat ActorsLazarus APT, BlueNoroff subgroupCampaign OverviewAttackers used a fake decentralized finance (DeFi) NFT-based tank game…
Threat Spotlight: WarmCookie/BadSpace
CategoryDetailsThreat ActorsTA866 (also known as Asylum Ambuscade)Campaign OverviewWarmCookie is distributed through malspam and malvertising campaigns…
Analysis of the Crypt Ghouls group: continuing the investigation into a series of attacks on Russia
CategoryDetailsThreat ActorsCrypt GhoulsCampaign OverviewTargeted Russian businesses and government agencies with ransomware.Target Regions (Or Victims)Russian businesses…
UAT-5647 targets Ukrainian and Polish entities with RomCom malware variants
CategoryDetailsThreat ActorsUAT-5647 (also known as RomCom) - Russian-speaking groupCampaign OverviewActive since late 2023, targeting Ukrainian…
Stealer here, stealer there, stealers everywhere!
CategoryDetailsThreat ActorsCybercriminals distributing information stealers, often via subscription services for novice hackers.Campaign OverviewDistribution of information…
