Threat Research

The StubMaker campaign is a RubyGems supply chain attack that distributed typosquatted Ruby packages containing malicious extconf.rb installer hooks to compromise Windows developer systems. During installation, the packages fingerprint the host, download a Rust-based loader from GitHub Releases, and decrypt an embedded Go infostealer entirely in memory for fileless execution....

ENIbot (also known as HuntBot) is an actively spreading IoT botnet that self-propagates across the internet and conducts Layer 7 DDoS attacks through its C2 infrastructure. Since March 2026, honeypots have recorded millions of exploitation attempts and 3,505 distinct malware samples linked to the campaign....

C2Looper is a newly identified Rust-based backdoor likely used by a ransomware-related threat actor to establish footholds for lateral movement. It supports remote command execution, system reconnaissance, and deployment of additional payloads, while using encrypted strings and dynamically resolved Windows APIs for evasion....

Lucid Stealer is an information-stealing malware designed to harvest sensitive personal and financial data from compromised systems. It uses a legitimate Node.js-based execution framework to hide malicious components and evade traditional static analysis....

This DCRat campaign combines phishing with SVG attachment, DLL sideloading, and process hollowing to establish stealthy remote access while evading endpoint defenses. By abusing trusted Windows utilities and requiring user interaction, the malware blends into legitimate activity and enables in-memory execution....

On July 31, Threat Intelligence reported an ongoing credential theft campaign tracked as CaptiveCrunch, attributed to Storm-2945, a sub-group of Russia-linked Midnight Blizzard (APT29). The campaign abuses captive portal networks at hotels, conference centers, and similar venues to redirect victims to attacker-controlled infrastructure....

The APT36 (Transparent Tribe)-linked PATCHCORD campaign is an evolving cyber espionage operation targeting telecommunications, government, defense, and critical infrastructure organizations across South Asia....

Recent weeks have seen a rise in ClickFix social engineering campaigns delivering the KongTuke malware through DLL sideloading. The campaign abuses legitimate, digitally signed Mozilla Firefox binaries, while attackers rotate lure domains but reuse the same payload infrastructure and tools. The malicious DLLs are written in Rust and disguised as legitimate Firefox components....

ClickFix campaign that used compromised WordPress websites and Cloudflare-themed social engineering lures to trick users into executing a malicious PowerShell command. The attack abused the legitimate Deno JavaScript runtime and winget to install Deno, execute remote JavaScript, and deliver a Python-based infostealer through an MSI staging chain....

Head Mare, now assessed as an APT group, exploited two vulnerabilities in unpatched TrueConf video conferencing servers to achieve SYSTEM-level code execution and deploy a web shell. The attackers used the compromised server to collect infrastructure data, access the TrueConf database, and replace legitimate TrueConf Client installers with trojanized versions....

A new Kimwolf v7 Android/IoT botnet variant has been identified with enhanced DDoS capabilities and stronger C2 resilience. The botnet mainly targets Android TV boxes and set-top boxes, adding an HTTP/2-based flood that mimics complete browser fingerprints....

Lazarus Group / DPRK-linked Operation Dream Job campaign targeting the defense, aerospace, and aviation sectors through spear-phishing, job-offer lures, impersonation websites, SEO poisoning, and trojanized PDF viewers....

Aeternum is a newly discovered C++ botnet loader that uses the Polygon blockchain as its command-and-control (C2) infrastructure. Instead of traditional servers or domains, attackers store encrypted and plaintext commands directly within blockchain smart contracts....

Abyssos is a newly identified C++-based modular Remote Access Trojan (RAT) that supports credential theft, file exfiltration, and VNC-based remote access. The malware uses LLVM-based code obfuscation, anti-analysis techniques, and a custom TCP protocol for C2 communication....

Gunra is a ransomware-as-a-service (RaaS) operation used by affiliates to target government, critical infrastructure, and other organizations through data encryption, data exfiltration, and double-extortion tactics. CVE-2024-55591 and CVE-2025-24472 allow threat actors to exploit scheduled tasks on vulnerable FortiOS firewall devices....