Darktrace Archives • Daily CyberSecurity

Twill Typhoon RAT Campaign Uses DLL Side Loading to Target APJ Networks

Twill Typhoon RAT campaign DLL side loading tradecraft

Twill Typhoon RAT Campaign Uses DLL Side Loading to Target APJ Networks

Do Son June 2, 2026

A stealthy Twill Typhoon RAT campaign targets APJ organizations. Discover how this threat exploits DLL side loading tradecraft to evade security.

Twill Typhoon Exploits CDN Masquerading and DLL Sideloading to Breach APJ Networks Twill Typhoon DLL Sideloading

Twill Typhoon Exploits CDN Masquerading and DLL Sideloading to Breach APJ Networks

Do Son May 22, 2026

Darktrace exposes Chinese APT Twill Typhoon’s latest campaign using DLL sideloading and Yahoo/Apple CDN lookalikes to deploy a modular .NET RAT.

New DDoS Botnet Exploits Jenkins to Target Gaming Servers Jenkins DDoS Botnet Gaming Industry Cyberattacks

New DDoS Botnet Exploits Jenkins to Target Gaming Servers

Do Son May 1, 2026

Darktrace uncovers a new DDoS botnet hijacking Jenkins servers to target game servers. Protect your CI/CD pipeline from specialized gaming-layer attacks.

ZionSiphon: The “Defanged” Malware Aiming for the Water Supply Energy Meter RCE CVE-2025-41709 ICS Exposure, Power Grid Security CVE-2025-1393 & CVE-2024-23943

Energy Meter RCE CVE-2025-41709 ICS Exposure, Power Grid Security CVE-2025-1393 & CVE-2024-23943

ZionSiphon: The “Defanged” Malware Aiming for the Water Supply

Do Son April 21, 2026

Darktrace uncovers ZionSiphon, a malware strain targeting water treatment via Modbus logic. Discover the new frontier of Israel-focused industrial sabotage.

The Rise of Vibecoding: AI-Generated Malware Exploits React2Shell Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

The Rise of Vibecoding: AI-Generated Malware Exploits React2Shell

Do Son February 12, 2026

Darktrace detects AI-generated "vibecoding" malware exploiting React2Shell (CVE-2025-55182). Attackers use AI to deploy XMRig miners on Docker.

The “Compatibility” Trap: New Mac Malware Tricks Users into Bypassing TCC OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

The “Compatibility” Trap: New Mac Malware Tricks Users into Bypassing TCC

Do Son February 9, 2026

Darktrace finds Mac malware using a fake "Compatibility Wizard" to trick users. The AppleScript attack bypasses TCC to drop a Node.js backdoor.

Phantom in the Machine: Inside Salt Typhoon’s “SnappyBee” Backdoor axios Supply Chain Attack WAVESHAPER.V2 SnappyBee Malware Salt Typhoon Stately Taurus ScoringMathTea RAT, Lazarus Reflective DLL

axios Supply Chain Attack WAVESHAPER.V2 SnappyBee Malware Salt Typhoon Stately Taurus ScoringMathTea RAT, Lazarus Reflective DLL

Phantom in the Machine: Inside Salt Typhoon’s “SnappyBee” Backdoor

Do Son February 6, 2026

Darktrace dissects SnappyBee (Deed RAT), a stealthy Salt Typhoon backdoor. Learn how it uses DLL side-loading & memory hooking to evade modern AV.

The Developer’s Backdoor: North Korea Weaponizes Visual Studio Code Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

The Developer’s Backdoor: North Korea Weaponizes Visual Studio Code

Do Son January 26, 2026

DPRK spies weaponize Visual Studio Code tunnels to bypass security. Darktrace reveals a campaign targeting South Korea with government decoys.

New MaaS Operator TAG-150 Uses ClickFix Lure and Custom CastleLoader to Compromise 469 US Devices TAG-150 CastleLoader, ClickFix MaaS NetSupport RAT ClickFix, Multi-Cluster RMM

TAG-150 CastleLoader, ClickFix MaaS NetSupport RAT ClickFix, Multi-Cluster RMM

New MaaS Operator TAG-150 Uses ClickFix Lure and Custom CastleLoader to Compromise 469 US Devices

Do Son December 1, 2025

Darktrace exposed TAG-150, a new MaaS operator compromising 469+ US devices in months. The group uses ClickFix to trick victims into running malicious PowerShell that deploys the CastleLoader/CastleRAT backdoor.

Next-Gen Threat: Xillen Stealer v4 Targets 100+ Browsers/70+ Wallets with Polymorphic Evasion and DevOps Theft Xillen Stealer, Polymorphic Evasion

Next-Gen Threat: Xillen Stealer v4 Targets 100+ Browsers/70+ Wallets with Polymorphic Evasion and DevOps Theft

Do Son November 24, 2025

Darktrace exposed Xillen Stealer v4/v5, a new MaaS threat using Rust polymorphism and an AIEvasionEngine to target 100+ browsers and Kubernetes/DevOps secrets. It uses steganography for exfiltration.

DragonForce Ransomware Strikes Manufacturing Sector with Brute-Force, Exfiltrating Data Over SSH to Russian Host DragonForce RaaS, Manufacturing Ransomware

DragonForce RaaS, Manufacturing Ransomware

DragonForce Ransomware Strikes Manufacturing Sector with Brute-Force, Exfiltrating Data Over SSH to Russian Host

Do Son November 7, 2025

Darktrace exposed a DragonForce RaaS attack on a manufacturer. The multi-phase intrusion used brute force and OpenVAS for recon, then exfiltrated data over SSH to a Russian-based malicious host.

Akira Ransomware Revives SonicWall Flaw CVE-2024-40766, Uses ‘UnPAC the Hash’ to Breach Networks

Do Son October 13, 2025

Akira ransomware is actively exploiting the unpatched/misconfigured SonicWall flaw (CVE-2024-40766) and using the rare "UnPAC the Hash" Kerberos technique for lateral movement.

Darktrace Exposes “Fake Startup” Malware Campaign: Lures Crypto Users with AI/Web3 Apps to Steal Wallets startup

Darktrace Exposes “Fake Startup” Malware Campaign: Lures Crypto Users with AI/Web3 Apps to Steal Wallets

Do Son July 14, 2025

Darktrace uncovers a crypto scam using fake software startups (AI, gaming, Web3 themes) with professional online presences to distribute Electron malware (Windows) and Atomic Stealer (macOS) for crypto theft.

PumaBot: New Stealthy Linux Botnet Evades Detection, Targets IoT Devices PumaBot, Linux Botnet

PumaBot: New Stealthy Linux Botnet Evades Detection, Targets IoT Devices

Do Son June 1, 2025

Darktrace uncovers PumaBot, a stealthy Linux botnet using Go binaries, SSH brute-force, and rootkits to compromise IoT devices, aiming for persistent, undetected access.

SocGholish Reloaded: Darktrace Uncovers Ransomware-Primed Loader Campaign SocGholish, RansomHub

SocGholish Reloaded: Darktrace Uncovers Ransomware-Primed Loader Campaign

Do Son May 5, 2025

Darktrace uncovers a SocGholish campaign using obfuscated loaders and legacy Windows exploits to harvest NTLM hashes and deliver ransomware payloads.