Duo Tech

The StopAndProtect operation abuses compromised WordPress sites to distribute a multi-component toolkit for file encryption, data theft, and lateral movement via social engineering.

China-based Jewelbug APT utilizes the XG-Web platform to conduct dual-mission operations involving government espionage across the Middle East and Asia alongside large-scale cryptocurrency fraud.

Adversaries are globally leveraging the ClickFix social engineering technique to trick Windows and macOS users into executing malicious terminal commands that deliver infostealers and RATs.

The ENIBot IoT botnet actively self-propagates via Telnet and ADB brute-forcing to conduct high-volume Layer 7 DDoS attacks.

Outsider Enterprise utilizes the JWR phishing framework, a variant of The Outsider, to perform real-time credential and PII theft through SMS lures and encrypted WebSockets.

Evooo1Bot is a highly modular Linux botnet leveraging Mirai's DDoS engine alongside advanced SOCKS relay, SSH brute-forcing, and an extensive CVE exploit arsenal to compromise Internet-facing edge devices.

An Akira ransomware affiliate targeted a SonicWall VPN to exfiltrate data and attempted to bypass security controls by rebooting the victim host into Safe Mode.

Kynx is a C++ infostealer developed with AI assistance that targets browser credentials, crypto wallets, gaming platforms, and AI coding assistants like Claude and Cursor.

Gunra (also known as Golden Community) is a RaaS operation using a double-extortion model targeting critical infrastructure by exploiting vulnerabilities in Fortinet appliances and leveraging Impacket for lateral movement.

Suspected Famous Chollima operatives infiltrated a decoy DeFi startup to gain access to corporate infrastructure, code, and financial assets using forged identities and remote access tools.