Tim Peck

Chaotic Eclipse is leveraging zero-day vulnerabilities YellowKey and MiniPlasma to bypass BitLocker and achieve SYSTEM-level privilege escalation on Windows 11 and Server environments.

Microsoft Defender now utilizes Windows Filtering Platform (WFP) integration to monitor inbound remote RPC calls at the OpNum level to detect lateral movement, credential theft, and discovery.

A threat actor operating as Leda Elacoate is conducting a supply chain campaign using trojanized installers for crypto-trading and VPN software to deploy the STX RAT infostealer via DLL sideloading.

An unknown threat actor is using JavaScript and PowerShell to deliver .NET malware hidden via steganography in MSI-branded JPEG images hosted on legit services.

A campaign using Amazon-themed phishing and ClickFix social engineering to deliver the HarborWatch Agent RAT, managed via the Harbor Sentinel Chinese-language admin panel.

Play Ransomware Group's custom Grixba infostealer has evolved from a monolithic tool to a modular, evasive scanner frequently deployed by DPRK-linked initial access brokers.

Threat actors can leverage WSL2's virtualized environment to download and stage payloads on Windows while remaining invisible to host-based network and process-attribution telemetry.

The Miasma threat actor group has expanded its supply chain campaign with 23 new malicious PyPI packages targeting bioinformatics and AI developers through trojanized native extensions and split-payload loaders.

A vulnerability in Hugging Face Transformers allows attackers to execute arbitrary Python code via crafted config.json files in model repositories, bypassing the trust_remote_code protection.

Lazarus, Turla, and other advanced actors utilize kernel-level ETW tampering, including DKOM and hardware breakpoints, to blind EDR and anti-cheat telemetry on Windows 11.