Intel Exchange

IronChain is a destructive malware build packaged with PyInstaller that utilizes multiple kernel drivers for process termination and persistence while intentionally discarding encryption keys to prevent data recovery.

Water Hydra (EvilNum) has transitioned from complex zero-day exploits to social engineering-driven campaigns using .PIF files and non-standard protocol handlers to deliver the DarkMe RAT.

INC Ransomware threat actors utilize Bring Your Own Vulnerable Driver (BYOVD) tactics and dual ransom notes to pressure victims after exfiltrating data via tools like MEGASync.

An unidentified ransomware-related threat actor is using SloppyRAT, a new multi-stage malware, to establish network footholds via ClickFix lures and blockchain-based C2 resolution.

Kimsuky (APT-C-55) utilizes multi-stage PowerShell and C# malware delivered via disguised installers to target South Korean institutions for intelligence theft.

The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.

Oldphantomoftheopera and Phantom Softwares operate Phantom Stealer, a Malware-as-a-Service infostealer targeting Windows systems through multi-stage in-memory execution and obfuscated PowerShell to harvest credentials and cryptocurrency data.

CRPx0 is a sophisticated cross-platform ransomware-as-a-service operation using ClickFix social engineering lures to deliver multi-stage Python-based payloads via clipboard hijacking.

SilkParasite is a China-nexus cyberespionage cluster targeting Central Asian government entities using a modular arsenal of seven RAT families, including five previously undocumented tools and AI-assisted tradecraft.

Gamaredon, a Russian FSB-operated group, uses a multi-stage modular framework (GammaPhish, GammaLoad, GammaWorm, GammaSteel) to maintain persistent access and exfiltrate sensitive documents from Ukrainian government and critical infrastructure.