Intel Exchange

Sauron Loader is a novel Russian-language Malware-as-a-Service that utilizes social engineering, DLL side-loading, and in-memory decryption to deliver multi-stage payloads.

Kothamine Agent is a C/C++ remote access Trojan distributed via malicious npm packages that leverages Tailscale’s tailcat tool for encrypted C2 communication to bypass network detection.

TASK#STOMP uses a VBScript-orchestrated execution chain to deploy a multi-stage PowerShell backdoor focused on automated document exfiltration, credential theft, and remote access.

The Rapuncel infostealer is distributed via SEO-optimized fake GitHub organizations, utilizing a Microsoft-signed kernel driver to disable security software.

Adversary Pursuit Group identified ChainScript, a Node.js RAT that utilizes Polygon smart contracts for resilient C2 infrastructure rotation and delivery via ClickFix lures.

The Iranian Ministry of Intelligence and Security (MOIS) uses HEAVYGRAM (aka CHOSEN BRICK) malware to target dissidents and journalists via social engineering and Telegram-based command-and-control.

A variant of SectopRAT uses a multi-stage loader and tampered legitimate DLLs to exfiltrate credentials and control systems via encrypted C2 communication.

VK Group’s Max messenger facilitates state-level surveillance by providing unencrypted message access, mandatory pre-installation, and granular behavioral tracking of Russian users.

Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.

Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.