Tim Peck

Russian-linked threat actor UAT-10820 utilizes ClearFake infection chains and WebDAV-hosted DLLs to deploy Amatera stealer and follow-on payloads like ZigCryptoStealer and NetSupport Manager.

Threat actors are exploiting ScreenConnect to deploy a four-stage VBScript chain that propagates across active remote sessions, ultimately delivering miners and backdoors.

Silk Typhoon is suspected of exploiting a pre-authentication RCE chain in PaperCut NG and MF involving improper access control and unsafe class loading.

APT28 and MuddyWater utilize ClickFix variants to compromise organizations via social engineering, deploying multi-stage payloads including steganography and Python-based reverse tunnels for internal network pivoting.

Tengu is a Linux-based botnet targeting IoT and server environments, utilizing kernel-worker masquerading and multiple persistence mechanisms to facilitate DDoS attacks.

Lazarus Group is targeting macOS users with trojanized application installers that deliver the OtterCookie RAT through a multi-stage infection chain.

Virtualizor update infrastructure was compromised to deliver the 'nerat' RAT via malicious PHP modifications and a Java-based persistence mechanism on hypervisor nodes.

A Russian-speaking Aurora ransomware affiliate utilizes AI-assisted planning and Active Directory exploits to compromise over twenty organizations globally before deploying a Zig-based encryptor.

The BlueKit threat actor group is conducting a sophisticated Phishing-as-a-Service campaign targeting financial sector CEOs using browser-in-the-middle techniques and post-authentication ScreenConnect delivery.

Mini Shai-Hulud threat actors compromised the '@7nohe/openapi-react-query-codegen' npm package by abusing comment-triggered GitHub Actions workflows to publish malicious versions targeting cloud and registry credentials.