evasion

Matanbuchus 3.0 Downloader Pivots to Ransomware, Using Protobufs and QuickAssist for Stealth Access

• Malware

Matanbuchus 3.0 Downloader Pivots to Ransomware, Using Protobufs and QuickAssist for Stealth Access

Do Son December 4, 2025 0

A sophisticated C++ downloader known as Matanbuchus has resurfaced with a major technical overhaul, signaling a dangerous...

Read More Read more about Matanbuchus 3.0 Downloader Pivots to Ransomware, Using Protobufs and QuickAssist for Stealth Access

Rhadamanthys Stealer v0.9.2 Drops: New PNG Payloads and Anti-Analysis Tricks Make Malware Deadlier

• Malware

Rhadamanthys Stealer v0.9.2 Drops: New PNG Payloads and Anti-Analysis Tricks Make Malware Deadlier

Do Son October 2, 2025 0

The notorious Rhadamanthys stealer, first released in 2022, has returned with a powerful new update that underscores...

Read More Read more about Rhadamanthys Stealer v0.9.2 Drops: New PNG Payloads and Anti-Analysis Tricks Make Malware Deadlier

DarkCloud Stealer Evolves: New VB6 Obfuscation and Crypto Wallet Theft Make Malware More Dangerous Than Ever

• Cybercriminals

DarkCloud Stealer Evolves: New VB6 Obfuscation and Crypto Wallet Theft Make Malware More Dangerous Than Ever

Do Son September 29, 2025 0

Recently, eSentire’s Threat Response Unit (TRU) identified a spear-phishing campaign targeting a manufacturing client that attempted to...

Read More Read more about DarkCloud Stealer Evolves: New VB6 Obfuscation and Crypto Wallet Theft Make Malware More Dangerous Than Ever

LNK Stomping: Attackers Bypass Windows Security by Stripping the ‘Mark of the Web’

• Cybercriminals

LNK Stomping: Attackers Bypass Windows Security by Stripping the ‘Mark of the Web’

Do Son September 26, 2025 0

Windows shortcut files (.LNK) were designed to simplify user navigation, but for years, they’ve been a favorite...

Read More Read more about LNK Stomping: Attackers Bypass Windows Security by Stripping the ‘Mark of the Web’

DarkCloud Rises: New Fileless Stealer Uses PowerShell & Process Hollowing to Evade Detection

• Malware

DarkCloud Rises: New Fileless Stealer Uses PowerShell & Process Hollowing to Evade Detection

Do Son August 11, 2025 0

Researchers from Fortinet’s FortiGuard Labs detected a new DarkCloud campaign deploying a stealthy, fileless payload through a...

Read More Read more about DarkCloud Rises: New Fileless Stealer Uses PowerShell & Process Hollowing to Evade Detection

BYOVD Attack: A New AV Killer Exploits a Legitimate Driver to Neutralize Defenses for MedusaLocker Ransomware

• Malware
• Vulnerability Report

BYOVD Attack: A New AV Killer Exploits a Legitimate Driver to Neutralize Defenses for MedusaLocker Ransomware

Do Son August 7, 2025 0

A recent incident response operation in Brazil has revealed a stealthy and destructive threat abusing the trusted...

Read More Read more about BYOVD Attack: A New AV Killer Exploits a Legitimate Driver to Neutralize Defenses for MedusaLocker Ransomware

New PXA Stealer Campaign Hits 62 Countries with Stealthy DLL Sideloading and Telegram Exfiltration

• Malware

New PXA Stealer Campaign Hits 62 Countries with Stealthy DLL Sideloading and Telegram Exfiltration

Do Son August 5, 2025 0

A new report by SentinelLABS and Beazley Security unveils an expansive and rapidly evolving infostealer operation powered...

Read More Read more about New PXA Stealer Campaign Hits 62 Countries with Stealthy DLL Sideloading and Telegram Exfiltration

The Evolution of Evasion: Raspberry Robin Malware Upgrades with New Encryption & UAC Bypass Exploit

• Malware

The Evolution of Evasion: Raspberry Robin Malware Upgrades with New Encryption & UAC Bypass Exploit

Do Son August 5, 2025 0

ThreatLabz has released a fresh technical update on Raspberry Robin, the elusive USB-propagated malware also known as...

Read More Read more about The Evolution of Evasion: Raspberry Robin Malware Upgrades with New Encryption & UAC Bypass Exploit

LockBit Ransomware Evolves: New Stealthy Tactics Use DLL Sideloading & Masquerading to Bypass Defenses

• Cybercriminals

LockBit Ransomware Evolves: New Stealthy Tactics Use DLL Sideloading & Masquerading to Bypass Defenses

Do Son August 1, 2025 0

LockBit isn’t just another ransomware group—it’s an evolving threat that continues to adapt its tactics to evade...

Read More Read more about LockBit Ransomware Evolves: New Stealthy Tactics Use DLL Sideloading & Masquerading to Bypass Defenses

GOLD BLADE Unleashes RedLoader with Novel Attack Chain: LNK Files + WebDAV + DLL Sideloading Evades Detection

• Malware

GOLD BLADE Unleashes RedLoader with Novel Attack Chain: LNK Files + WebDAV + DLL Sideloading Evades Detection

Do Son July 31, 2025 0

Sophos analysts have uncovered a newly combined infection technique used by the GOLD BLADE cybercriminal group to...

Read More Read more about GOLD BLADE Unleashes RedLoader with Novel Attack Chain: LNK Files + WebDAV + DLL Sideloading Evades Detection

0bj3ctivityStealer: Stealthy Info-Stealer Uses Steganography & PowerShell to Evade Detection

• Malware

0bj3ctivityStealer: Stealthy Info-Stealer Uses Steganography & PowerShell to Evade Detection

Do Son July 30, 2025 0

A recent analysis from the Trellix Advanced Research Center (ARC) has unveiled a sophisticated and stealthy info-stealer...

Read More Read more about 0bj3ctivityStealer: Stealthy Info-Stealer Uses Steganography & PowerShell to Evade Detection

XWorm 6.0: New Variant Uses AMSI Bypass & Critical Process Trick to Evade Detection and Crash Systems

• Malware

XWorm 6.0: New Variant Uses AMSI Bypass & Critical Process Trick to Evade Detection and Crash Systems

Do Son July 29, 2025 0

According to the latest report from Netskope Threat Labs, a new version of the XWorm malware—XWorm 6.0—has...

Read More Read more about XWorm 6.0: New Variant Uses AMSI Bypass & Critical Process Trick to Evade Detection and Crash Systems

SHUYAL: New Stealthy Infostealer Plunders Browser Credentials, System Data, & Screenshots to Telegram

• Malware

SHUYAL: New Stealthy Infostealer Plunders Browser Credentials, System Data, & Screenshots to Telegram

Do Son July 28, 2025 0

In a deep-dive technical investigation, Hybrid Analysis has uncovered a powerful new information stealer dubbed SHUYAL, a...

Read More Read more about SHUYAL: New Stealthy Infostealer Plunders Browser Credentials, System Data, & Screenshots to Telegram

EdskManager RAT: New Stealthy Malware Leverages HVNC for Covert Remote Access & Evasion

• Malware

EdskManager RAT: New Stealthy Malware Leverages HVNC for Covert Remote Access & Evasion

Do Son July 24, 2025 0

In its latest threat intelligence report, CYFIRMA has detailed the discovery of EdskManager RAT, a sophisticated remote...

Read More Read more about EdskManager RAT: New Stealthy Malware Leverages HVNC for Covert Remote Access & Evasion

First in the Wild: Coyote Banking Trojan Exploits Microsoft’s UI Automation to Steal Credentials Undetected

• Malware

First in the Wild: Coyote Banking Trojan Exploits Microsoft’s UI Automation to Steal Credentials Undetected

Do Son July 24, 2025 0

Akamai has confirmed the first observed abuse of Microsoft’s UI Automation (UIA) framework by malware in the...

Read More Read more about First in the Wild: Coyote Banking Trojan Exploits Microsoft’s UI Automation to Steal Credentials Undetected

AmateraStealer (ACRStealer) Evolves: New Version Uses Low-Level NTAPIs & Heaven’s Gate for Evasion

• Malware

AmateraStealer (ACRStealer) Evolves: New Version Uses Low-Level NTAPIs & Heaven’s Gate for Evasion

Do Son July 23, 2025 0

ACRStealer—recently rebranded as AmateraStealer—has emerged as one of the most sophisticated infostealers in the wild, marked by...

Read More Read more about AmateraStealer (ACRStealer) Evolves: New Version Uses Low-Level NTAPIs & Heaven’s Gate for Evasion

Ghost Crypt & PureRAT: New Stealthy Malware Targets Accounting Firm via “Process Hypnosis”

• Malware

Ghost Crypt & PureRAT: New Stealthy Malware Targets Accounting Firm via “Process Hypnosis”

Do Son July 22, 2025 0

eSentire’s Threat Response Unit (TRU) uncovered a sophisticated attack against a certified public accounting firm in the...

Read More Read more about Ghost Crypt & PureRAT: New Stealthy Malware Targets Accounting Firm via “Process Hypnosis”

Katz Stealer: The $100/Month MaaS Threat Plundering Digital Identities Undetected

• Malware

Katz Stealer: The $100/Month MaaS Threat Plundering Digital Identities Undetected

Do Son July 21, 2025 0

In the crowded arena of information-stealing malware, Katz Stealer is quickly establishing itself as one of the...

Read More Read more about Katz Stealer: The $100/Month MaaS Threat Plundering Digital Identities Undetected

Beyond Detection: PyBitmessage Protocol Used for Covert Monero Mining Campaign

• Malware

Beyond Detection: PyBitmessage Protocol Used for Covert Monero Mining Campaign

Do Son May 22, 2025 0

In a new and deeply evasive malware campaign, cybercriminals are leveraging the PyBitmessage protocol to hide a...

Read More Read more about Beyond Detection: PyBitmessage Protocol Used for Covert Monero Mining Campaign

Sneaky Email Attack Targets Spain, Italy, Portugal with RATty Trojan

• Cybercriminals
• Malware

Sneaky Email Attack Targets Spain, Italy, Portugal with RATty Trojan

Do Son May 12, 2025 0

The FortiMail IR team has uncovered a highly sophisticated email campaign delivering the RATty Remote Access Trojan,...

Read More Read more about Sneaky Email Attack Targets Spain, Italy, Portugal with RATty Trojan