Subhankar H

A Mirai botnet variant targets IoT devices using architecture-specific ELF binaries and a multi-stage shell script for persistence and DDoS attacks.

The threat actor RareWolf uses a multi-stage batch script to deploy AnyDesk for unauthorized remote access, archive local data, and exfiltrate information via SMTP using the Blat utility.

A Ukrainian-themed phishing campaign utilizes a multi-stage VBScript dropper to download decoy documents and execute payloads from external file-hosting infrastructure.

Op nKe y is a c o n f i g u r a b l e r a n s o m w a r e k i t u t i l i z i n g D i s c o r d w e b h o o k s f o r C2 c o m m u n i c a t i o n a n d m a s q u e r a d i n g a s l e g i t i m a t e W i n d o w s s e r v i c e s.

The threat actor zdn2pwn utilizes XHOPELESS v1.0, a sophisticated multi-phase wiper designed to permanently brick Windows systems by corrupting UEFI firmware, destroying disk partitions, and disabling all recovery mechanisms.

Stealer/1.0 is a hybrid malware designed to exfiltrate cloud, browser, and developer credentials via Discord webhooks before executing a highly destructive wiper routine that formats the C: drive.

The gaiadeqi.com campaign utilizes highly obfuscated JavaScript droppers to deliver credential-stealing trojans disguised as VLC Media Player installers.

The RMRLX malware family uses a multi-stage JavaScript and PowerShell loader to deploy LxBaseRAT, a sophisticated .NET tool targeting browser credentials, cryptocurrency wallets, and Discord tokens.

pyCodeV3 is a multi-stage Python loader using dynamic domain generation and pickle deserialization to execute arbitrary code from C2 servers.

Threat actors are deploying the NetSupport Manager RAT through a multi-stage chain involving phishing PDFs and obfuscated JavaScript to disguise legitimate binaries in a 'Stereo' folder.