Tim Peck

Threat actor UNG0002 is targeting Chinese universities using spear-phishing lures related to national fitness standards to deliver Cobalt Strike via DLL side-loading.

The TAX#TRIDENT campaign utilizes fake Indian income tax assessment lures to deliver YTSCRat or unauthorized ManageEngine UEMS agents through various VBScript and ZIP-based infection paths.

SHADOW-WATER-063 uses the polymorphic Banana RAT banking trojan to target Brazilian financial institutions via fileless execution and social engineering.

Fox Tempest operates a malware-signing-as-a-service (MSaaS) operation that abuses Microsoft Artifact Signing to help ransomware affiliates and malware operators evade security controls.

The PoisonX threat actor utilizes a complex multi-stage attack chain involving DLL sideloading and vulnerable driver exploitation (BYOVD) to deploy a modular RAT with EDR-bypass capabilities.

A critical argument injection vulnerability in Gogs allows authenticated users to achieve RCE by injecting the --exec flag into git rebase during pull request operations.

An attacker can achieve arbitrary command execution on macOS by embedding malicious metadata in image files and processing them with ExifTool using the -n flag.

The threat actor Storm-2949 leverages social engineering and SSPR abuse to compromise identities, pivoting to Azure control-plane operations for massive data exfiltration.

Twill Typhoon is conducting a modular intrusion campaign in the APJ region using updated FDMTP backdoors and DLL sideloading via legitimate binaries like Sogou Pinyin and ClickOnce.

TamperedChef clusters leverage trojanized productivity software distributed via malvertising to deliver infostealers, RATs, and browser hijackers.