Do Son Silver Fox APT targets users with fake LINE installers delivering ValleyRat. New campaign uses rare "PoolParty" injection to evade detection.
Cybereason
Cybereason exposed The Gentlemen, a new, technically advanced Go-based RaaS using XChaCha20/Curve25519 crypto. The group claimed 48 victims in 3 months, leveraging WMI and PowerShell for propagation.
A new malicious Chrome extension, "Madgicx Plus," is targeting Meta advertisers. It promises AI ad optimization but hijacks accounts and steals credentials.
BlackSuit, a rebranded Royal/Conti ransomware, unleashes destructive multi-stage attacks. It uses Cobalt Strike, rclone for data exfil, and deletes shadow copies for stealth and speed.
Cybereason exposes a deceptive malware campaign using compromised WordPress sites and the "ClickFix" technique to deliver weaponized NetSupport Manager RAT clients for remote access.
Qilin ransomware is rapidly dominating the RaaS landscape, as rivals like RansomHub and LockBit face collapse, internal chaos, and public defacements by "XOXO from Prague."