FortiGuard

SectopRAT Malware Variant Hidden in Legitimate Software

• Malware

SectopRAT Malware Variant Hidden in Legitimate Software

Do Son September 29, 2026 0

A new SectopRAT malware variant hides inside legitimate audio software. Learn how SectopRAT malware extracts data and controls devices.

Evooo1Bot Linux Botnet Employs SOCKS Relays and DDoS

• Malware

Evooo1Bot Linux Botnet Employs SOCKS Relays and DDoS

Do Son August 20, 2026 0

FortiGuard Labs discovered the Evooo1Bot Linux botnet. Read our Evooo1Bot Linux botnet analysis to learn how this malware turns devices into proxy nodes.

ShadowV2 Mirai Botnet Launched Coordinated IoT Test Attack During Global AWS Outage

• Malware

ShadowV2 Mirai Botnet Launched Coordinated IoT Test Attack During Global AWS Outage

Do Son December 1, 2025 0

FortiGuard exposed ShadowV2, a new Mirai botnet variant that launched an IoT test attack specifically during a global AWS outage. The XOR-encoded malware targets routers and uses a hardcoded fallback C2 for resilience.

FortiGuard Tracks HoldingHands Malware Shift: Cross-Regional APT Uses Task Scheduler Hijack to Evade Detection

• Malware

FortiGuard Tracks HoldingHands Malware Shift: Cross-Regional APT Uses Task Scheduler Hijack to Evade Detection

Do Son October 20, 2025 0

FortiGuard exposed a cross-regional campaign that expanded to Malaysia using HoldingHands malware. The malware hijacks Task Scheduler via TimeBrokerClient.dll to achieve stealthy persistence.

New Stealit Infostealer Abuses Node.js SEA Feature and Telegram C2 in Malware-as-a-Service Campaign

• Malware

New Stealit Infostealer Abuses Node.js SEA Feature and Telegram C2 in Malware-as-a-Service Campaign

Do Son October 13, 2025 0

FortiGuard Labs identified a new Stealit malware variant abusing Node.js SEA for stealthy distribution. The campaign features a public C2 panel and uses Telegram for data exfiltration.

Chaos Ransomware Evolves to C++, Uses Destructive Extortion to Delete Large Files and Hijack Bitcoin Clipboard

• Malware

Chaos Ransomware Evolves to C++, Uses Destructive Extortion to Delete Large Files and Hijack Bitcoin Clipboard

Do Son October 9, 2025 0

FortiGuard uncovered Chaos-C++, a dangerous new ransomware strain. It deletes file content over 1.3 GB and uses clipboard hijacking to steal Bitcoin during payments.

FortiGuard Labs Uncovers Global Phishing Campaign Using UpCrypter to Deploy RATs

• Malware

FortiGuard Labs Uncovers Global Phishing Campaign Using UpCrypter to Deploy RATs

Do Son August 26, 2025 0

A new report reveals a rapidly growing global phishing campaign using fake voicemails and purchase orders to distribute UpCrypter, a sophisticated malware loader.

FormBook Returns: Exploiting CVE-2017-0199 via Malicious Excel Attachments in New Phishing Campaign

• Malware

FormBook Returns: Exploiting CVE-2017-0199 via Malicious Excel Attachments in New Phishing Campaign

Do Son June 9, 2025 0

An old Microsoft Office vulnerability (CVE-2017-0199) is being exploited in a new phishing campaign to deploy the FormBook infostealer malware. Update now!

Iranian APT Group Breaches Middle Eastern Critical Infrastructure in Stealth Campaign

• Cyber Security

Iranian APT Group Breaches Middle Eastern Critical Infrastructure in Stealth Campaign

Do Son May 5, 2025 0

FortiGuard reveals an Iranian APT's multi-stage intrusion into Middle Eastern critical infrastructure using custom malware and stealthy persistence.