Subhankar H

The suspected Muddywater (APT28 variant) actor is deploying the Moodleuni C2 RAT using a fake Inno Setup installer to establish persistence via COM registration and startup shortcuts.

LegionLoader uses a multi-stage infection chain involving MSI files, DLL sideloading, and Python-based components to achieve stealthy execution and C2 communication.

The Ethereum Loader is a sophisticated multi-stage malware that uses blockchain-based C2 communication and masquerades as VMware components to evade detection.

DirtyFrag is a sophisticated Linux kernel Local Privilege Escalation toolkit that uses page cache corruption and RxRPC/AF_ALG abuse to gain root access.

Phantom Stealer utilizes obfuscated VBScript droppers and .NET loaders with Telegram-based C2 infrastructure to exfiltrate browser credentials and system data.

Kimsuky APT utilizes a multi-stage JScript loader to deploy the NUKESPED backdoor, targeting South Korean entities through social engineering lures.

The Reynolds ransomware group utilizes the NSecKrnl kernel driver to terminate EDR processes and employs double-extortion tactics against enterprise targets.

The Vile Collective utilizes a Go-based ransomware that employs double extortion, HPKE-v1 encryption, and extensive anti-analysis techniques to target a wide range of global sectors.

BQTLock ransomware utilizes a multi-stage PyInstaller-packed architecture, leveraging Remcos RAT for initial access and Discord/Telegram for covert command-and-control.

TrymeLocker (also known as RageCore) is a destructive .NET ransomware attributed to actor 'inwormmap' that implements aggressive persistence, system sabotage, and C2 via Telegram.