Threat ReportsTLP:AMBER
Latrodectus: The Black Widow Loader Quietly Replacing IcedID
Named after the black widow spider, Latrodectus is a lightweight but potent loader built by the people behind IcedID.
6 min readMalware
Resources
Threat Reports
Adversary infrastructure, malware teardowns and copy-ready IOCs.
Threat ReportsTLP:AMBER
CAKETAP and the Raspberry Pi Heist: How UNC2891 Tried to Rob a Bank From Inside Its Own Switch
UNC2891 cabled a 4G Raspberry Pi straight into a bank’s ATM network switch, hid its backdoor from forensic triage with a novel Linux bind-mount trick, and aimed…
6 min readAPT
Threat ReportsTLP:AMBER
Daxin Returns: A 13-Year-Old China-Linked Rootkit That Never Called Home
Symantec found the Daxin kernel rootkit still operational on a Taiwan manufacturing subsidiary in 2026, alongside a previously undocumented backdoor, Stupig, that runs SYSTEM commands from the Windows logon screen before anyone signs in.
6 min readAPT
Threat ReportsTLP:AMBER
Medusa Ransomware: The RaaS That Blinds Your EDR Before It Encrypts
Medusa is a ransomware-as-a-service operation that has hit 300+ organisations across healthcare, education, manufacturing and other critical sectors.
4 min readRansomware
Threat ReportsTLP:AMBER
GodDamn Ransomware Blinds EDR With the Microsoft-Signed PoisonX Driver
GodDamn is a fresh rebrand of the Beast/Monster ransomware lineage that switches off endpoint defenses before it encrypts.
4 min readRansomware
Threat ReportsTLP:AMBER
SPECTRALVIPER: The Obfuscated Backdoor Behind an APT32 Espionage Set
SPECTRALVIPER is a heavily obfuscated x64 Windows backdoor used against large, strategically important Vietnamese companies.
5 min readNation-State
Threat ReportsTLP:AMBER
MirrorFace: The APT10 Subgroup That Perfected Its Craft on Japan Then Turned to Europe
MirrorFace, a China-aligned espionage group inside the APT10 umbrella (also tracked as Earth Kasha), spent years quietly targeting Japan’s government, politicians, think tanks and defence-adjacent industry.
4 min readNation-State
Threat Reports
Anunak and Carbanak: A Billion-Dollar Heist
The crew that stopped robbing bank customers and learned to rob the bank itself.
4 min readFinancial Sector
Threat ReportsTLP:AMBER
Explosive MirrorBlast Campaign Targets Financial Firms and It Points to TA505
MirrorBlast hits financial-services organisations with an Excel document so lightweight it is nearly undetectable on VirusTotal.
5 min readFinancial Sector
Threat Reports
Below the Syscall Line: How eBPF and io_uring Rootkits Slip Past Linux EDR
Most Linux runtime security watches system calls. A growing class of stealth techniques, eBPF abuse and the io_uring asynchronous-I/O interface, does its work without the syscalls those tools hook.
4 min readLinux Rootkits
Threat ReportsTLP:AMBER
SprySOCKS for Windows: FishMonger’s Linux Backdoor Grows a Kernel Rootkit
China-aligned FishMonger (Earth Lusca) has ported its SprySOCKS backdoor to Windows and bolted on a kernel driver, RawWNPF, that hides processes, files, connections and registry keys, and turns any open TCP port into a hidden door and erases itself from every tool you’d use to find it.
6 min readAPT
Threat ReportsTLP:AMBER
PoisonX Rootkit: A Signed Kernel Driver That Turns Your EDR Into a Target
PoisonX: A Signed Kernel Driver That Turns Your EDR Into a Target A Microsoft-signed BYOVD driver used to kill CrowdStrike Falcon and other security tooling from Ring 0.
4 min readBYOVD
Threat ReportsTLP:AMBER
PamDOORa: A Linux PAM Backdoor Built to Steal SSH Credentials
A new post-exploitation implant abuses the Linux authentication stack (PAM) to harvest plaintext SSH credentials from every user who logs in, and hands the operator a covert, persistent backdoor.
3 min readLinux Backdoor
Threat Reports
Trash Panda as a Service: Raccoon Stealer Steals Cookies, Crypto, and More
Threat AdvisoryTLP:CLEAR Threat ReportsInfostealer Trash Panda as a Service: Raccoon Stealer Steals Cookies, Crypto, and More A $75-a-week stealer-as-a-service that harvests browser passwords, cookies and autofill, hijacks crypto transactions with a bundled…
4 min readInfostealer
Threat ReportsTLP:AMBER
Bugs & Betrayal: VECT Ransomware by Design, Wiper by Accident
Threat AdvisoryTLP:AMBER RansomwareMalware Bugs & Betrayal: VECT Ransomware by Design, Wiper by Accident Analysis of the VECT ransomware family suggests implementation flaws can undermine the operator’s own monetization objectives.
2 min readRansomware · Malware
Threat ReportsTLP:AMBER
Sneaky Umbreon Linux Rootkit Targets x86 Systems with Stealth-Focused Persistence
Threat AdvisoryTLP:AMBER LinuxRootkit Sneaky Umbreon Linux Rootkit Targets x86 Systems with Stealth-Focused Persistence A recently disclosed Linux rootkit known as Sneaky Umbreon demonstrates a renewed focus on kernel-level stealth for x86 environments.
2 min readLinux · Rootkit
Threat Reports
Tracking FIN7: Hidden Infrastructure Behind Global Intrusions
Threat Hunt Intelligence FIN7 Infrastructure Hunt, 26 Attributed Hosts C2 Panel · Malware · Loader · 26 attributed · 48 ambient commodity · 74 surfaced Hunt #45Scope C2 Panel · Malware · LoaderAttributed 26Ambient 48Generated 2026-07-07 19:08 UTC This report…
7 min readExposing the Invisible
Threat ReportsTLP:AMBER
Indian Cyber Force Targets Government Sites Amid Diplomatic Flashpoint
Threat AdvisoryTLP:AMBER HacktivismGov Web Disruption Indian Cyber Force Targets Government Sites Amid Diplomatic Flashpoint A recurring pattern of opportunistic hacktivism and low-sophistication distributed attacks has been observed against public-sector web…
2 min readHacktivism · Gov Web Disruption
Threat ReportsTLP:AMBER
Cyber Islamic Resistance and NoName057(16) Signal Intent for Coordinated Cyber Pressure Campaign Against France
Threat AdvisoryTLP:AMBER HacktivismDDoS Threat Intel Cyber Islamic Resistance and NoName057(16) Signal Intent for Coordinated Cyber Pressure Campaign Against France Intelligence indicators suggest overlapping messaging and tasking narratives between Cyber…
1 min readHacktivism · DDoS Threat Intel
Threat Reports
Mass Arch Linux Package Compromise Pushes Rootkit-Like Malware at Scale
Threat AdvisoryTLP:CLEAR Supply ChainLinux Security 400+ Arch Linux Packages Hijacked to Install Rootkit-Like Malware A large-scale compromise impacting hundreds of Arch Linux packages demonstrates how software supply-chain attacks can transform trusted…
2 min readSupply Chain · Linux Security
Threat ReportsTLP:AMBER
Ghost in the Shell: Unmasking the QLNX Rootkit
QLNX is an advanced Linux rootkit engineered for kernel-level stealth, privilege concealment and long-term covert access – hiding processes, tampering with telemetry, and evading detection across servers, cloud workloads and internet-facing systems.
2 min readRootkit · Linux
Threat ReportsTLP:AMBER
Deep Persistence: How Sandworm Weaponizes Tor for Long-Term Stealth
Sandworm Uses SSH-over-Tor Tunnels for Stealthy Long-Term Persistence Sandworm – the Russian state-sponsored actor linked to GRU Unit 74455 – leveraged SSH-over-Tor tunneling to establish covert, resilient, long-term access inside compromised environments…
2 min readAPT · Persistence
Threat ReportsTLP:AMBER
The Rootkit in Your Living Room: Anatomy of the Katana Botnet a Mirai Variant
Katana is a Mirai-derived botnet built to compromise vulnerable IoT devices at scale through credential abuse, remote code execution and aggressive propagation – delivering stealth persistence…
2 min readBotnet · IoT
Threat ReportsTLP:AMBER
Kazuar Unmasked: Inside Turla’s Persistent Cyber-Espionage Machine
Kazuar Backdoor: Inside Turla’s .NET Espionage Implant Indicators and behavioral telemetry align with Kazuar – a sophisticated espionage backdoor associated with Turla, the Russian state-sponsored APT known for stealth operations against government…
2 min readAPT · Backdoor
Threat ReportsTLP:AMBER
Abyss Rootkit Analysis: Unmasking Deep-System Threats
ABYSSWORKER: The EDR-Killer Driver Behind MEDUSA Ransomware ABYSSWORKER is a malicious signed Windows kernel driver used in the MEDUSA ransomware attack chain to blind and disable endpoint detection and response tools – masquerading as a CrowdStrike Falcon…
4 min readEDR Killer · Ransomware
Threat ReportsTLP:AMBER
Hunting Orbit Rootkit Part Open-Source Medusa Ransomware – IOC Deep Dive
OrBit: The Linux Rootkit That Hijacks the Dynamic Linker OrBit is a stealthy Linux userland rootkit that abuses the dynamic linker (ld.so) to load itself into every new process – hooking dozens of libc functions to hide files, processes and network sockets from standard tooling on the host.
3 min readRootkit · Linux
Threat ReportsTLP:AMBER
Mercenary Cyber Surveillance: Indian Hack-for-Hire Group Targets Android and iCloud Backups
Mercenary Surveillance: Hack-for-Hire Group Targets Android and iCloud Backups A commercial hack-for-hire operation runs a cross-platform surveillance model – deploying Android spyware on some targets while phishing Apple ID credentials to siphon entire…
3 min readSpyware · Hack-for-Hire
Threat ReportsTLP:AMBER
Operation NoVoice: Silent Persistence and the Rootkit Lifecycle
Operation NoVoice: The Android Rootkit That Survives a Factory Reset NoVoice is a mobile-espionage campaign that hid in 50+ Google Play apps (2.3M+ downloads), chained 22 legacy Android exploits to gain root, and planted a Zygote-level rootkit that hooks the…
4 min readRootkit · Android
Threat ReportsTLP:AMBER
Latest Qilin Ransomware IOCs Analysis Emerging Threat Indicators
Profile of 2025’s Most Active Extortion Operation Qilin (formerly Agenda) is a Rust-based ransomware-as-a-service operation that became the most active extortion brand of 2025 – absorbing displaced affiliates after RansomHub’s collapse, running double…
4 min readRansomware · Qilin
Threat ReportsTLP:AMBER
RegPhantom Rootkit: Persistence Mechanisms and Mitigation
RegPhantom Watch: A Suspicious Hash With Agreement SHA-256 703dfb12…e7c4 draws consensus from two trusted reputation feeds and possible RegPhantom rootkit ties, but no behavioural detonation confirms intent.
2 min readMalware
Threat ReportsTLP:AMBER
VGOD Ransomware Exposed: Actionable IOCs for Rapid Defense
VGOD Ransomware: Anatomy of a Backup-Killing Windows Extortion Strain VGOD is a Windows ransomware first seen in February 2025 that encrypts files, deletes Volume Shadow Copies to block recovery, and runs double extortion behind a ‘Decryption…
4 min readRansomware
Threat ReportsTLP:AMBER
Dynowiper Exposed: Forensic Analysis of a Sandworm Cyberweapon
DYNOWIPER: Anatomy of the Wiper That Struck Poland’s Energy Grid The ‘critical, unattributed PE’ from automated triage is DYNOWIPER, a deliberately simple data-destruction wiper used on 29 December 2025 against 30+ Polish renewable sites and a major CHP…
4 min readWiper
Threat ReportsTLP:AMBER
Inside Luca Stealer: A Technical Decomposition of the Rust-Based Malware
Beyond the Binary: How Luca Stealer Uses the Rust Runtime to Slip Past Detection A 4.6 MB Rust PE scored 100/100 with heavy anti-analysis and a Telegram exfiltration channel, behaviour that lines up with Luca Stealer, the leaked Rust infostealer.
5 min readMalware
Threat ReportsTLP:AMBER
Luke Ransomware Uncovered: A Deep Dive into Encryption and Exfiltration Tactics
Luke Ransomware: A Critical-Severity Encryptor That Also Steals A small (~558 KB) Windows PE flagged critical (90/100) is Luke, a ransomware sample that is also an information-stealer.
4 min readRansomware
Threat ReportsTLP:AMBER
The Anatomy of a Qilin Attack: Technical Indicators and C2 Infrastructure
The Qilin Surge: How Agenda’s Rust Rewrite Became the Most Active Ransomware of 2025 Qilin published more than 1,000 victims in 2025 and now names 40-plus organisations a month on its leak site.
4 min readRansomware
Threat ReportsTLP:AMBER
What is Klingpremium.xyz? Malware Analysis and Mitigation Guide
Under the Hood of klingpremium.xyz: an Obfuscated Batch Loader Your ML Model Rated 0% Malicious A 314 KB Windows .bat flagged critical (90/100) is a multi-stage loader that geofences, then uses PowerShell to pull a next-stage payload from klingpremium.xyz and…
4 min readMalware
Threat ReportsTLP:AMBER
GoAskBobby.exe Malware Analysis: Technical Breakdown of a Stealthy Stealer
GoAskBobby.exe: The ‘AI Helper’ That’s Really JustAskJacky Malware An automated scan shrugged this 20 MB signed installer off as UNKNOWN with zero indicators.
5 min readMalware
Threat ReportsTLP:AMBER
What is Indeanapolice.cc? Malware Analysis and Removal Guide
Blocking the Breach: Inside the indeanapolice.cc PowerShell Dropper A tiny, heavily obfuscated PowerShell script flagged in triage turns out to be the download-cradle stage of the indeanapolice.cc dropper, a recently-registered, low-reputation campaign that…
4 min readMalware
Threat Reports
Is Your Data Safe? The Rising Threat of FredyStealer Malware
Malware Analysis Report FredyStealer: The Silent Thief in Your System Published March 26, 2026 · Threat Intelligence Team · A critical-severity script sample was processed by the malware analysis suite.
3 min read
Threat ReportsTLP:AMBER
Wiped Out: Unmasking the Arid Viper Tactics Behind BiBi Malware
BiBi Wiper: What the Malware Really Does, and Why This Sample Does Not Confirm It BiBi is a destructive wiper used against Israeli organisations in 2023 that shreds files and appends a .BiBi extension.
5 min readMalware
Threat Reports
When Trust Breaks: The Microsoft‑Signed Rootkit That Bypasses Endpoint Security
Signed Is Not Safe: How Vulnerable Kernel Drivers Are Weaponised to Kill EDR Kernel drivers run in Ring 0, below your endpoint protection.
5 min readEndpoint Security
Threat Reports
When Routes Become Rootkits: The Hidden Cyber Risk in Modern Supply Chains
A rootkit hides inside normal operations and hands an attacker persistent, trusted access without tripping an alarm. A predictable transport route does the same thing to a supply chain.
5 min readThreat Intelligence · Supply Chain Security
Threat Reports
One Click to God Mode: How OpenClaw’s Fatal Flaw Gave Attackers Your Master Keys
In the cybersecurity world, we often talk about “defense in depth.” But what happens when the very vault meant to protect your secrets becomes the front door for an intruder?
2 min read
Threat Reports
Vintage Malice: Unmasking APT29’s Wine-Tasting Trap
APT29 a notorious Russian cyber espionage group has recently targeted European diplomats using GRAPELOADER malware.
4 min read
Threat Reports
Credential Theft to Ransomware: The Arkana Group’s New Tactic on WoW
In a sophisticated cyberattack that rocked WideOpenWest (WoW), the Arkana Ransomware Group used a subtle yet dangerous strategy that started with an infostealer infection.
4 min read
Threat Reports
Silencing the Panic Button: Inside the Linux SysRq Rootkit That Evades Forensics
Imagine your server starts behaving erratically. You suspect a breach, but your monitoring tools are silent.
2 min read
Threat Reports
The VoidLink Evolution: AI-Generated Stealth Rootkit Targeting the Linux Kernel
In January 2026, researchers at Check Point Research published what may be the first clearly documented case of advanced AI-generated malware at scale: VoidLink.
3 min read
Threat Reports
Interlock RAT: The Kongtuke Connection Unmasked
In today’s cybersecurity landscape, advanced persistent threats (APTs) like the Interlock RAT are becoming increasingly sophisticated.
3 min read
Threat Reports
Storm-0501: When “The Intruder is in the House” Means Your Azure Cloud is Compromised.
It is the notification no administrator wants to see: not a firewall alert, but a Microsoft Teams message from an intruder already sitting inside the tenant.
4 min read
Threat Reports
Indian Cyber Force & #OpCanada: Why Your Website is the New Diplomatic Battlefield.
When geopolitical tensions boil over, the first shots aren’t always fired on the battlefield they’re fired in the browser.
3 min read
Threat Reports
Hunting the Hunters: How We Discovered the Iranian Spy Network in Your Inbox.
The “SiameseKitten” APT (also known as Lyceum) represents one of the most persistent and calculated threat actors operating out of Iran.
3 min read
Threat Reports
Mapping the Malice: A Deep Dive into DanBot’s Infrastructure
In the world of targeted espionage, what you don’t see isn’t just a blind spot it’s an open door.
2 min read
Threat Reports
The Anatomy of an Attack: Mapping the dAn0n Threat Landscape
In the rapidly shifting ecosystem of cybercrime, new actors often emerge from the shadows of fallen giants.
2 min read
Threat Reports
From Rootkits to Ransomware: Decoding SideWinder’s Newest Indian Campaign
Tax season is stressful enough without an Advanced Persistent Threat (APT) group living in your network.
3 min read
Threat Reports
RAMP is Dead. Is Your Defensive Strategy Still Stuck in 2023?
The digital underground just lost one of its most notorious meeting spots.
2 min read
Threat Reports
Rome is Burning: How Indian Hackers Outmaneuvered Italian Diplomacy
The digital battlefield just got a lot bigger. For years, Western organizations viewed South Asian hacking collectives as a localized threat nuisances confined to their own backyard.
2 min read
Threat Reports
Windows God Mode is No Longer Just for Shortcuts It’s the New Front Line for Malware
We’ve all seen te tech tips: create a folder, paste a string of code, and boom you have “God Mode,” a one-stop shop for every Windows setting imaginable.
2 min read
Threat Reports
Behind the Booking.com Scam: ClickFix and a Phishing-as-a-Service Operation
Executive Summary A sophisticated phishing campaign dubbed “I Paid Twice” is actively targeting Booking.com hotels and their customers, abusing brand trust to deliver malware and remote access tooling.
3 min read
Threat Reports
Trillions-Dollar Heist: Mapping the Shadow Infrastructure of APT-41 (Winnti)
The digital landscape is currently haunted by one of the most sophisticated and relentless state-sponsored threats in history: APT-41 (also known as Winnti, BARIUM, or Double Dragon).
3 min read
Threat Reports
Decoding Akira Ransomware: Your Defense Against Advanced EDR Evasion
Akira Ransomware is a formidable threat, known for its sophisticated tactics and ability to bypass even robust security measures.
2 min read
Threat Reports
Infrastructure Unmasked: The Evolution of Emennet Pasargad
(ASA) In mid-2024, a joint advisory from the U.S. Department of Treasury, and the Israel National Cyber Directorate sounded a critical alarm.
2 min read
Threat Reports
MedusaLocker Ransomware: Unmasking the Threat through Infrastructure Mapping
In the evolving world of cyber threats, ransomware campaigns like MedusaLocker are becoming more sophisticated and difficult to combat.
3 min read
Threat Reports
Busting GodRat: Analyzing the Rat and Its Infrastructure
Cracking the GodRat Campaign: Unmasking Its Infrastructure & How to Block It The GodRat Trojan is believed to be operated by the Chinese threat group Winnti (APT41), known for targeting financial institutions, including trading and brokerage firms.
4 min read
Threat Reports
Exposing the LinkPro Rootkit Infrastructure Breakdown & Key Defenses
The LinkPro Rootkit is a highly sophisticated malware that continues to make waves in the cybersecurity landscape.
4 min read
Threat Reports
Toneshell Rootkit Inside the Silent Threat
In the modern threat landscape, stealth is the ultimate weapon.
3 min read
Threat Reports
Unmasking Mobile Espionage: Forensic Analysis on Donot Indian APT’s Android Malware Operations
Advanced Persistent Threats (APTs) are expanding their offensive footprint into mobile ecosystems and organizations in South Asia remain prime targets.
3 min read
Threat Reports
Forensic Deep Dive: Shellcode Injection via Donot an Indian APT’s Malicious XLS
Donot Team (also known as APTC35, Viceroy Tiger, or Mint Tempest) is a highly organized Advanced Persistent Threat group strongly suspected to operate with ties to the Indian state.
3 min read
Threat Reports
CyberRoot Exposed: Unmasking the Indian Hack-for-Hire Operation Behind the Scandal
A Wake-Up Call for Corporate Security A major cybersecurity and legal battle concluded this week, resulting in a landmark settlement that underscores the growing threat of corporate espionage and “hack-for-hire” schemes.
2 min read
Threat Reports
SpearSpecter Unveiled Iranian Hackers APT42 Targeting Defense and Government How to Block Their Cyber Assault
The world of cybersecurity is constantly evolving, and so are the tactics used by advanced persistent threats (APTs).
2 min read
Threat Reports
Dropping Elephant APT Escalates Attacks on Defense Sector with MSBuild-Delivered Backdoor
In the ever evolving world of cybersecurity, advanced persistent threat (APT) groups continue to develop increasingly sophisticated tactics to breach highly sensitive sectors.
4 min read
Threat Reports
Unveiling the ‘Bad News’ Backdoor: A Deep Dive into Indian APT Exploits
The cybersecurity landscape is constantly evolving, and the rise of Advanced Persistent Threats (APTs) remains one of the most dangerous challenges for businesses globally.
4 min read
Threat Reports
The Sandworm Hackers Cauldron: Unraveling the Threat with Strategic Infrastructure Mapping
In the vast and often unseen world of cyber threats, there exists a particularly nasty breed of hackers that thrive in the shadows: the Sandworm hackers.
3 min read
Threat Reports
Here Come the Sandworm: The Shai-Hulud Attack Explained
In the world of cybersecurity, new and increasingly sophisticated threats emerge daily.
3 min read
Threat Reports
Sneaky “FruitFly” RAT Rat: Visualizing the Infrastructure Behind a Long-Running Threat
For years, the stealthy FruitFly remote access trojan (RAT) quietly operated beneath the radar, targeting macOS systems with an unusual blend of simplicity and persistence.
2 min read
Threat Reports
MetadataBin Ransomware What it is, how it spreads, and how we can stop it
In the world of cyber threats, ransomware continues to be one of the most destructive forces, and Metadatabin is no exception.
4 min read
Threat Reports
KongTuke: K is for Keylogging and Kidnapping Your Data
KongTuke is a recent, aggressive campaign that delivers a modified Interlock RAT (PHP variant) via a PyInstaller packed payload.
3 min read
Threat Reports
The Year of The Phish: How Rancor Targets Your Business
In 2019, a sophisticated cyber threat group known as Rancor made headlines with an innovative and devastating phishing campaign.
3 min read
Threat Reports
Unmasking APT-37 (ScarCruft) and Rokrat Malware: Key IOCs and Defense Strategies
Advanced Persistent Threat (APT) groups are known for their sophisticated, long term campaigns that target high value organizations, governments, and industries.
4 min read
Threat Reports
Defending Against RID Hijacking: A Critical Vulnerability Exploited by Andariel APT
Cyber threats continue to evolve, becoming more sophisticated and harder to detect. One of the most insidious techniques used by the notorious Andariel APT (Advanced Persistent Threat) group is RID Hijacking.
4 min read
Threat Reports
Unmasking Dora RAT: Defend Against Andariel APT with Effective Infrastructure Mapping
In the ever evolving landscape of cybersecurity, threat actors are continuously adapting and refining their tactics to bypass traditional defenses.
4 min read
Threat Reports
New Insights on Laundry Bear Hackers’ Infrastructure: How Mapping Can Stop Them in Their Tracks
In the ever evolving world of cyber threats, staying ahead of sophisticated attackers is crucial. One such group Laundry Bear (also known as Void Blizzard) has been making headlines for its advanced cyber espionage tactics.
4 min read
Threat Reports
Stay Ahead of Emerging Threats: Mapping Your Infrastructure to Combat Void Blizzard (Laundry Bear)
) In today’s cybersecurity landscape, being proactive is your best defense against evolving threats. Cybercriminals no longer rely on random attacks they carefully target critical sectors, using advanced techniques to infiltrate networks.
4 min read
Threat Reports
Mysterious Elephant an infrastructure map & IOC blocklist to protect Asia’s governments
Summary: A stealthy, targeted campaign we’ll call “Mysterious Elephant” is actively exploiting government targets in Asia.
5 min read
Threat Reports
Exposing Fancy Bear’s Phantom Net: Decoding the BearedShell & SlimAgent Campaigns
The notorious Fancy Bear, also known as APT28, has once again surfaced with a new wave of attacks targeting high-value targets across various sectors.
5 min read
Threat Reports
R is for Rootkit: Securing Against Advanced Cyber Threats by Mapping the R77 Rootkit
In the ever-evolving world of cybersecurity, advanced threats like rootkits remain among the most dangerous. One such example is the R77 Rootkit, a highly sophisticated malware that stealthily infiltrates systems and provides backdoor access to cybercriminals.
3 min read
Threat Reports
Graphing Fake “Kling AI” Malvertising Map, Block, Protect
Malvertisements promising AI tools and “instant video/article editing” are a lucrative bait for attackers.
4 min read
Threat Reports
Graphing Klingon RAT Infrastructure: Defend Against Evolving Threats
The threat landscape is constantly evolving, and as adversaries grow more sophisticated, defenders must stay one step ahead. One of the more persistent and damaging threats we’ve recently encountered is the Klingon RAT (Remote Access Trojan).
3 min read
Threat Reports
Graphing FuRootkit Infrastructure Rapid Infra Mapping & IOC Blocklist
FuRootkit is not a single binary, it’s an infrastructure. Our Graphing FuRootkit Infrastructure service builds an actionable map of how this rootkit’s campaign is assembled (drop points → loaders → kernel hooks → C2/beacons → persistence), so defenders can see choke points, prioritize takedowns, and automate containment without calling out any mapping product names.
3 min read
Threat Reports
Mapping IndigoDrop Malware & Blocking Critical IOCs
Malicious campaigns like IndigoDrop are no longer single files or lone command-and-control servers. They behave like distributed, evolving infrastructures.
3 min read
Threat Reports
Unmasking SideWinder: LNK Phishing Attack Mapping for Enhanced Protection
The APT-C-24 (also known as SideWinder) hacker group has been actively employing LNK file phishing techniques in their recent attacks, posing significant risks to organizations worldwide.
2 min read
Threat Reports
Exposing the Indian SideWinder Hacker Group: Targeting Users with Fake Outlook/Zimbra
Blocking Critical IP and Domain IOCs In the world of cyber threats, attribution is key to understanding and mitigating attacks.
3 min read
Threat Reports
Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits
Summary: A targeted campaign dubbed Operation Zero Disco has been observed exploiting a Cisco SNMP vulnerability to gain footholds and deploy rootkits on compromised systems.
3 min read
Threat Reports
Inside the Indian Hack-for-Hire Scandal: How Appin Exposed Global Cybersecurity Gaps
Cybercrime-as-a-service is no longer science fiction it’s here.
2 min read
Threat Reports
Mysterious Elephant Moves Beyond Recycled Malware: Infrastructure Mapping of a Harassment-Driven Cyber Campaign
Mysterious Elephant, a persistent threat group long associated with espionage operations in South Asia, is showing signs of evolution, moving beyond reusing old malware.
2 min read
Threat Reports
Stopping the Steal: Mapping Infrastructure Behind Fake Indian Banking Apps on Android
Fraudsters are luring users with convincing fake banking apps on Google Play and third‑party stores to harvest login credentials, OTPs, and other sensitive data.
2 min read
Threat Reports
Exposing Alice ATM Stealer: Infrastructure Mapping of a Financial Threat
Financial institutions remain top targets for cybercriminal groups focused on high-reward operations.
2 min read
Threat Reports
Exposing the Hidden Network: Mapping APT27’s ZXShell Rootkit Infrastructure
APT27, also known as Emissary Panda, is a well-documented threat group associated with cyber-espionage campaigns targeting government, defense, technology, and financial institutions worldwide.
2 min read
Threat Reports
NoName057(16) Targets NATO Exposing DDosia / Bobik Infrastructure
Overview NoName057(16) is a pro‑Russian hacktivist group that has publicly targeted NATO‑aligned entities using the DDosia DDoS toolkit and related tooling (and overlaps observed with Bobik infrastructure).
3 min read
Threat Reports
Kematian Info Stealer: Infrastructure Map & IOCs to Block
Overview Kematian is an info‑stealer that targets credentials, cookies, and local artifacts to support espionage and fraud.
3 min read
Threat Reports
From IcedID to Dagon Locker in 29 Days Rapid Escalation Infrastructure Map & Technical Deep Dive
Overview A rapid intruder progression has been observed in which IcedID initial access and loaders lead, within weeks, to Cobalt Strike activity and final Dagon Locker ransomware deployment.
6 min read
Threat Reports
Rancor APT: DDKong Plugin “King Kong Ain’t Got Nothin’ on Our Network”
Below is an expanded, technical explanation of how the DDKong plugin campaign operates, what to hunt for in logs and forensic artifacts, and additional detection / mitigation content you can drop directly into tooling.
3 min read
Threat Reports
Tracking NoName057(16): DDoS & Bobik Stealer Infrastructure
The pro-Russian advanced persistent threat (APT) group NoName057(16) continues to escalate its cyber operations, targeting entities that support Ukraine.
2 min read
Threat Reports
Exposing BPFDoor Rootkit Mapping a Hidden Infrastructure Threat
In the ever-evolving threat landscape, few threats demonstrate the stealth and persistence of BPFDoor, a Linux-based rootkit used by advanced threat actors to backdoor systems while remaining virtually invisible to traditional security controls.
4 min read
Threat Reports
Exposing Darkmegi an Infrastructure Map Service to Find and Remove a Kernel Rootkit
Malicious kernel‑level malware like Darkmegi is one of the highest‑risk threats an enterprise can face: stealthy persistence, ability to tamper with security controls, and the power to hide lateral movement.
4 min read
Threat Reports
Stop the Silent Saboteur: Blocking “HTTP‑iframe Injecting” Linux Rootkits
Malicious rootkits that inject HTTP iframes into web traffic are a stealthy, high-impact threat to Linux servers and the organizations that rely on them.
4 min read
Threat Reports
Info-Stealing Malware Propagated Through Indian Software Products
In today’s digital age, cyber threats are becoming increasingly sophisticated and widespread, leaving organizations vulnerable to serious data breaches.
3 min read
Threat Reports
Unmasking Rana (APT‑39) Infrastructure Map Centered on the redjewelry.biz Malicious Domain
APT‑39, also known as “Chafer” or “Remix Kitten”, is a sophisticated Iranian cyber espionage group primarily associated with Iran’s Islamic Revolutionary Guard Corps (IRGC) and its intelligence agencies.
3 min read
Threat Reports
Mapping FredMaster (aka Brox) Android Banking Trojan: Infrastructure & Defense
FredMaster, also tracked as Brox, is a modular Android banking trojan family that harvests credentials and performs fraudulent transactions through overlay attacks, accessibility abuse and SMS interception.
4 min read
Threat Reports
Defending Against Shrink Locker Ransomware: Infrastructure and IOCs to Block
Ransomware attacks have become one of the most significant cybersecurity threats in recent years, targeting both individuals and organizations across the globe.
5 min read
Threat Reports
DeerStealer Rootkit Stealer Campaign: Infrastructure and Defense
In the ever-evolving landscape of cybersecurity threats, one of the most concerning emerging threats is the DeerStealer Rootkit Stealer Campaign.
6 min read
Threat Reports
Mapping GodRouter Backdoor: Understanding FunnySwitch Backdoor and Defend Against It
In the world of cybersecurity, protecting your network and critical infrastructure from advanced persistent threats (APTs) is paramount.
4 min read
Threat Reports
Mapping Chinese APT Violin Panda (AKA theb3g) C2 2014year.qpoe.com: Enhancing Your Defense Strategy
In the world of cybersecurity, Advanced Persistent Threats (APT) are some of the most sophisticated and dangerous attacks. One such threat is Violin Panda, a Chinese-based APT group also known as theb3g, which has been linked to various espionage campaigns.
3 min read
Threat Reports
Behind the Trap: Mapping APT TH3BUG’s AKA Violin Panda Watering Hole Campaign with Poison Ivy
Advanced Persistent Threat (APT) actors continue to evolve but so do our methods to uncover and counter them.
3 min read
Threat Reports
Ghost in Action: Unmasking the Specter Botnet Infrastructure
As threat actors evolve, so do their methods of staying hidden. Modern botnets no longer rely solely on brute force or noisy traffic they’re stealthy, modular, and highly resilient.
3 min read
Threat Reports
Exposing Godlike12 Backdoor Using Covert Google Drive C2 Channels
In today’s rapidly evolving threat landscape, adversaries are engineering malware to blend into trusted cloud platforms.
3 min read
Threat Reports
Graphing Fancy Bear’s Attack on Ubiquiti Routers: Infrastructure Mapping as a Service
In the ever-evolving cyber threat landscape, advanced persistent threats (APTs) continue to grow in complexity and scale.
2 min read
Threat Reports
Mapping Fancy Bear’s Gamefish Infrastructure
Unmasking Advanced Threat Operations Behind the Hash: 9b10685b774a783eabfecdb6119a8aa3 In the evolving world of cyber conflict, few adversaries operate with the consistency and sophistication of Fancy Bear (APT28).
2 min read
Threat Reports
Mapping Shifu Banking Trojan Infrastructure
As the cybersecurity landscape evolves, sophisticated banking trojans continue to exploit digital vulnerabilities, putting financial institutions and their clients at constant risk.
2 min read
Threat Reports
Violet Typhoon’s Warlock Ransomware Campaign: Mapping SharePoint Vulnerability Exploits
How Enterprise Collaboration Tools Became a Gateway for Advanced Ransomware Campaigns The cyber threat landscape has shifted from opportunistic attacks to highly coordinated, multi-stage operations orchestrated by some of the most advanced adversaries in the world.
4 min read
Threat Reports
Patchwork Unmasked: Mapping the Espionage Infrastructure Behind chinastrats.com
From Governments to Global Industry The Growing Reach of a Persistent Threat Group Cyber-espionage is no longer confined to state secrets.
2 min read
Threat Reports
Mapping Dropping Elephant’s AKA ChinastRats AutoIT Malware Campaign Infrastructure
With a Surprising Twist: Shared Infrastructure Linked to GandCrab Ransomware Sophisticated, stealthy, and persistent. These are the hallmarks of the latest campaign attributed to the Dropping Elephant (aka Chinastrats) threat group.
2 min read
Threat Reports
Graphing Rhadamanthys bonus-mirror.com Phishing Domain: Deep Infrastructure Mapping to Protect Your Organization
Phishing attacks continue to be one of the most effective and damaging methods used by cybercriminals to infiltrate organizations worldwide.
2 min read
Threat Reports
Inside Fancy Bear’s Latest Attack Vector: Outlook-Based Backdoor with DNS & Email Exfiltration
In today’s threat landscape, attackers aren’t just breaking down doors they’re walking right through the front, disguised as trusted tools and workflows.
3 min read
Threat Reports
Dropping Elephant India-Linked Hackers Target Missile Firm in Sophisticated Cyber Espionage
2025 has seen a dramatic escalation in nation-state cyber threats, with “Dropping Elephant” an India-linked APT group (also known as Patchwork) spearheading a highly targeted campaign against Türkiye’s defense sector.
2 min read
Threat Reports
Qilin Ransomware’s Evolving Threat: A New Botnet Alliance
At Alpha Cyber, our threat intelligence division constantly monitors the evolving threat landscape, analyzing attacker behavior, infrastructure, and payload delivery methods.
3 min read
Threat Reports
Sophisticated Indian Cyber Threats Are Imitating Governments and Militaries Are You Prepared?
How Spoofed Government & Military Interfaces Are Used to Harvest Login Credentials, and How to Shield Against It Recent intelligence has exposed a highly adaptive cyber campaign that targets government and defense institutions by deploying near-authentic fake login portals.
2 min read
Threat Reports
GodRAT: A Stealthy RAT Targeting Financial Institutions Through Complex Malware Infrastructure
A newly observed Remote Access Trojan (RAT) campaign is targeting financial institutions, using stealth and social engineering to penetrate secure environments.
2 min read
Threat Reports
How Attackers Hijack Web Traffic Through System-Level CeidPageLock Rootkits
CeidPageLock is a stealthy, kernel-level Chinese rootkit primarily distributed through the RIG exploit kit.
2 min read
Threat Reports
Meta Illegally Collected Flo Users’ Menstrual Data: A Wake-Up Call for Businesses on Data Privacy
In today’s data-driven world, the privacy and security of user information have become more than just a technical issue, they’re a matter of public trust, legal compliance, and business survival.
2 min read
Threat Reports
Akira Exploits SonicWall SSLVPN Rootkit in Suspected Zero-Day Attacks
How Infrastructure Mapping Can Help Detect and Prevent the Next Breach In the latest wave of targeted ransomware attacks, the Akira ransomware group is now exploiting a previously unknown vulnerability in SonicWall SSLVPN appliances, giving them direct access to corporate networks.
2 min read
Threat Reports
Inside Scranos Mapping a Cross-Platform, Rootkit-Enabled Spyware Operation
In today’s threat landscape, cybercriminals are no longer relying on single-layer malware. Instead, they’re deploying fully integrated infrastructures to maintain persistence, monetize user data, and avoid detection.
2 min read
Threat Reports
Coordinated Cyber Strike: Five Families Syndicate Targets Alpha Automation in Brazil
A new wave of coordinated cyberattacks has emerged from a threat actor group known as the Five Families Collective, recently targeting Alpha Automation, a leading industrial automation firm in Brazil.
1 min read
Threat Reports
Signed to Deceive: The Return of FiveSys Rootkits
How Nation-State-Grade Malware is Bypassing Defenses – and What You Can Do About It In today’s rapidly evolving threat landscape, attackers are using increasingly advanced techniques to bypass endpoint security, including digitally-signed rootkits.
1 min read
Threat Reports
Bobby Trapped Phishing Attacks Hijack Microsoft Teams to Spread Malware Is Your Organization at Risk?
Cybercriminals are exploiting legitimate collaboration tools in increasingly sophisticated ways.
1 min read
Threat Reports
Mapping the Invisible Enemy: Sidewinder (APT-04) Indian-Linked Cyber Threat Infrastructure
In the modern threat landscape, advanced persistent threats (APTs) operate like invisible war machines, strategic, highly coordinated, and capable of maintaining long-term access to their targets.
1 min read
Threat Reports
Mapping “Indian Cyber Force” Infrastructure Using Social Media & OSINT
As geopolitical tensions increasingly manifest online, the Indian Cyber Force (ICF), a politically motivated hacktivist group has emerged as a visible threat through waves of DDoS attacks, website defacements, and alleged data leaks.
1 min read
Threat Reports
Microsoft Identifies China-Backed Nation-State Hackers Targeting SharePoint: Protect Your Infrastructure
Microsoft recently confirmed that China-backed nation-state hackers, including the notorious group known as Violet Typhoon, are actively targeting Microsoft SharePoint servers worldwide.
1 min read
Threat Reports
SecondDate_CnC Equation Group God of Espionage Lurks in Your Network
A highly sophisticated backdoor, SecondDate_CnC, attributed to the elite Equation Group, has resurfaced in targeted infrastructure attacks.
1 min read
Threat Reports
Threat Spotlight: SonicWall VPNs Compromised by Stealthy Rootkit Backdoor
A sophisticated cyber campaign has been discovered targeting SonicWall VPN appliances, embedding a stealthy rootkit backdoor deep in the system, invisible to standard endpoint protection.
1 min read
Threat Reports
Chinese Group “Silver Fox” Uses Fake Sites to Deliver Sainbox RAT & Hidden Rootkit
A sophisticated campaign attributed to the China-affiliated group Silver Fox (aka Void Arachne) is targeting Chinese‑speaking users via spoofed websites mimicking popular apps like WPS Office, Sogou, and DeepSeek.
1 min read
Threat Reports
GodLoader Malware: How Attackers Exploit the Godot Engine Threat Insights
Cybercriminals are exploiting the Godot Engine in a new wave of attacks using the GodLoader malware, infecting over 17,000 systems in just three months.
1 min read
Threat Reports
Unmasking GodLua: A Glimpse into Malware’s Hidden Infrastructure
Unveiling the GodLua DNS over HTTPS Malware Infrastructure In today’s rapidly evolving cyber threat landscape, GodLua DNS over HTTPS (DoH) malware stands out as a sophisticated and stealthy adversary.
1 min read
Threat Reports
Unmasking the “God of Espionage” Bvp47 Backdoor’s Infrastructure Revealed!
The Bvp47 backdoor, dubbed the “God of Espionage,” is a top-tier Linux malware platform attributed to the Equation Group, with strong ties to the US NSA.
1 min read
Threat Reports
Bert Ransomware Mapping the 185.100.157.74 Infrastructure
A new ransomware threat called Bert is targeting organizations across Asia, Europe, and the US, especially in healthcare, technology, and event services.
1 min read
Threat Reports
Beyond the Surface: Mapping the Facefish Rootkit’s Digital Footprint
In the shadowy world of cyber threats, some malware aims not just to steal data, but to disappear.
2 min read
Threat Reports
Beyond the Inbox: Mapping SideWinder’s Stealthy C2 Infrastructure
The Threat:The Sidewinder APT group, believed to be aligned with Indian interests, is actively targeting government, military, and critical infrastructure across South Asia, including Bangladesh, Pakistan, and Sri Lanka.
1 min read
Threat Reports
Sneaky 2FA Phishing: Unmasking the Invisible Threat
Two-Factor Authentication (2FA) is vital, but attackers are bypassing it with 2FA Phishing-as-a-Service (PhaaS). These sophisticated platforms, like “Sneaky 2FA,” act as a “reverse proxy,” intercepting real-time credentials and 2FA codes.
1 min read
Threat Reports
Experts Sound Alarm on DCRat Backdoor Being Sold on Russian Hacking Forums
Cybersecurity researchers have shed light on an actively maintained remote access trojan called DCRat (aka DarkCrystal RAT) that’s offered on sale for “dirt cheap” prices, making it accessible to professional cybercriminal groups and novice actors alike.
2 min read
Threat Reports
Praying Mantis APT Hackers Group Using ASP.NET Exploits To Attack Windows IIS
Thanks to cybersecuritynews for this great article Sygnia Incident Response Team found an advanced and persistent threat actor named “Praying Mantis” or “TG2021”, operating completely in memory.
1 min read
Threat Reports
North Korean Hackers Targeting Journalists With Novel Malware
North Korean state-sponsored hackers known as APT37 have been discovered targeting journalists specializing in the DPRK with a novel malware strain.
2 min read
Threat Reports
DanderSpritz Framework Is Causing Problems
In April 2017, the hacking collective known as the Shadow Brokers leaked a sophisticated malware framework attributed to the NSA’s Equation Group.
2 min read
Contact
Talk to someone who has seen this before.
You speak directly to the people doing the work, wherever in the world you operate.
Or email [email protected]