Duo Tech

Abyssos is a new modular C++ RAT utilizing LLVM-based obfuscation and a custom TCP protocol to perform credential theft, remote access via VNC, and network reconnaissance.

Storm-2755 (Payroll Pirates) uses AiTM phishing and residential proxies to compromise Microsoft 365 accounts for financial data theft and payroll diversion.

UNC6671 and associated clusters utilize sophisticated vishing and AiTM panels to harvest credentials and exfiltrate data from enterprise cloud and financial platforms.

The Aeternum botnet utilizes the public Polygon blockchain as a decentralized command-and-control infrastructure to distribute XWorm, XMRig, and data-stealing payloads.

Head Mare APT exploits a chain of vulnerabilities in TrueConf Server to distribute PhantomCore and PhantomGraph backdoors via Trojanized client installers.

AISURU threat actors deployed Kimwolf v7 targeting Android TV boxes and IoT devices using Ethereum Name Service (ENS) for resilient C2 and advanced HTTP/2 DDoS fingerprinting.

Armored Likho (Eagle Werewolf) is utilizing a new Rust-based 'Still Toolkit' to steal Telegram session data and conduct covert audio surveillance against targets in Russia.

Project CAV3RN is a modular espionage framework targeting Israel that uses Google Apps Script as a C2 relay and DNS A-records for channel selection.

Adversaries may use GenAI coding agents like Claude Code as trusted parents to deploy reverse tunnels, steal credentials, and establish LaunchAgent persistence on macOS.

Twill Typhoon leverages a supply chain compromise of the QuickFox VPN proxy to deliver the FDMTP implant through multi-stage loaders and execution guardrails.