Group-IB Archives • Daily CyberSecurity

CyberDakait Deploys Seven Android Trojan Families Against 17,960 Indian Banking Devices

CyberDakait Android malware and Indian CyberDakait Android malware attack chain diagram

CyberDakait Deploys Seven Android Trojan Families Against 17,960 Indian Banking Devices

Do Son October 30, 2026

Group-IB exposes CyberDakait Android malware. The Indian CyberDakait Android malware campaign uses 7 trojans to infect 17,960 phones and steal 7.6M SMS.

SiriusQT RAT Combines Hidden Desktop Control With Credential and Wallet Theft SiriusQT RAT and Windows SiriusQT RAT HVNC attack architecture diagram

SiriusQT RAT and Windows SiriusQT RAT HVNC attack architecture diagram

SiriusQT RAT Combines Hidden Desktop Control With Credential and Wallet Theft

Do Son October 27, 2026

Group-IB analyzes over 280 samples of SiriusQT RAT. Discover how the Windows SiriusQT RAT uses HVNC, six persistence methods, and 100+ stealer targets.

Suspected Access Broker k0t Hits FortiGate and GlobalProtect Devices, Exposing 70,000 Credentials FortiGate GlobalProtect attacks by suspected initial access broker k0t against network edge devices

FortiGate GlobalProtect attacks by suspected initial access broker k0t against network edge devices

Suspected Access Broker k0t Hits FortiGate and GlobalProtect Devices, Exposing 70,000 Credentials

Do Son October 23, 2026

A suspected initial access broker behind FortiGate GlobalProtect attacks exposed 70,000+ credentials. See how k0t operates and how to defend.

Smishing Triad Phishing Kit Exposed by Group-IB The new Smishing Triad phishing kit architecture and Smishing Triad phishing kit attack diagram

The new Smishing Triad phishing kit architecture and Smishing Triad phishing kit attack diagram

Smishing Triad Phishing Kit Exposed by Group-IB

Do Son September 17, 2026

Group-IB exposed a new Smishing Triad phishing kit used by Outsider. Learn how this Smishing Triad phishing kit steals financial data worldwide.

Outsider Phishing Kit Survives Operation Ghost Hook Takedown Outsider Phishing Kit tracking panel and ChenLun Outsider PhaaS kit dashboard

Outsider Phishing Kit Survives Operation Ghost Hook Takedown

Do Son September 8, 2026

The Outsider Phishing Kit persists despite the Operation Ghost Hook takedown. Discover how the ChenLun Outsider PhaaS kit bypasses MFA via AiTM attacks.

Balonx Sistema: Mexican PhaaS Adds AI Vishing and RAT Balonx Sistema PhaaS platform diagram showing real-time phishing, Android RAT, and AI vishing targeting Mexican banks

Balonx Sistema PhaaS platform diagram showing real-time phishing, Android RAT, and AI vishing targeting Mexican banks

Balonx Sistema: Mexican PhaaS Adds AI Vishing and RAT

Do Son August 25, 2026

Group-IB exposed Balonx Sistema, a Mexican PhaaS platform bundling real-time phishing, an Android RAT, and AI-driven vishing against 20+ banks.

XMRig Botnet Abuses Linux PAM to Spread Forensic Smokescreen Across User Accounts XMRig Linux PAM abuse fileless cryptominer V25 botnet forensic smokescreen

XMRig Linux PAM abuse fileless cryptominer V25 botnet forensic smokescreen

XMRig Botnet Abuses Linux PAM to Spread Forensic Smokescreen Across User Accounts

Do Son August 5, 2026

Group-IB uncovered XMRig Linux PAM abuse that lets a fileless Monero miner regenerate across user accounts and vanish from disk forensics.

JadeProx Used TriBack Loader Against a Vietnamese Hospital, Malaysia’s Foreign Ministry, and Hong Kong Schools ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

JadeProx Used TriBack Loader Against a Vietnamese Hospital, Malaysia’s Foreign Ministry, and Hong Kong Schools

Do Son July 28, 2026

Group-IB found an exposed server that revealed JadeProx, a China-nexus cluster running TriBack Loader against targets in Vietnam, Malaysia and Hong Kong.

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password

Do Son July 21, 2026

ClickLock Stealer is macOS malware that freezes your Mac until you type your password. Group-IB found 100+ victims across 33 countries.

SilabRAT Malware: The $5,000-a-Month Crypto-Hunting RAT Hiding Behind HijackLoader SilabRAT malware SnappyClient, HijackLoader, Malware-as-a-Service

SilabRAT malware SnappyClient, HijackLoader, Malware-as-a-Service

SilabRAT Malware: The $5,000-a-Month Crypto-Hunting RAT Hiding Behind HijackLoader

Do Son June 17, 2026

SilabRAT malware, aka SnappyClient, is a $5K/month MaaS RAT flagged as HijackLoader. It uses HVNC and cracks crypto wallets, per Group-IB.

Massive Smishing Error524 Campaign Evades Traditional Security Filters Worldwide Smishing Error524 campaign Group-IB phishing report

Massive Smishing Error524 Campaign Evades Traditional Security Filters Worldwide

Do Son June 8, 2026

Read the Group-IB phishing report detailing the massive Smishing Error524 campaign targeting millions across 72 countries with advanced evasion tactics.

Unmasking the Phoenix System’s Rogue BTS Smishing Empire Phoenix System PhaaS Rogue BTS Smishing

Unmasking the Phoenix System’s Rogue BTS Smishing Empire

Do Son May 1, 2026

Group-IB unmasks the Phoenix System: a PhaaS platform using rogue cell towers and live-dashboards to bypass MFA across 2,500+ domains. Read the full report.

The GTFire Scheme: How Cybercriminals are Weaponizing Google’s Trusted Services for Global Phishing GTFire Phishing Campaign Google Firebase Abuse

GTFire Phishing Campaign Google Firebase Abuse

The GTFire Scheme: How Cybercriminals are Weaponizing Google’s Trusted Services for Global Phishing

Do Son March 2, 2026

Group-IB uncovers "GTFire," a massive credential-harvesting operation abusing Google Firebase and Translate to bypass security filters in 100+ countries.

Operation Olalampo: MuddyWater Unleashes AI-Assisted Rust Malware and Telegram C2 in MENA Espionage Surge Harvester APT Linux Backdoor OT Cyberattack Iranian APT Operation Olalampo MuddyWater APT Prince of Persia APT, Tonnerre v50 Patchwork APT, DLL Sideloading Subtle Snail, cyber espionage ShadowSilk, cyber espionage Volt Typhoon APT Group - Chinese Cybersecurity Firm

Harvester APT Linux Backdoor OT Cyberattack Iranian APT Operation Olalampo MuddyWater APT Prince of Persia APT, Tonnerre v50 Patchwork APT, DLL Sideloading Subtle Snail, cyber espionage ShadowSilk, cyber espionage Volt Typhoon APT Group - Chinese Cybersecurity Firm

Operation Olalampo: MuddyWater Unleashes AI-Assisted Rust Malware and Telegram C2 in MENA Espionage Surge

Do Son February 24, 2026

Group-IB exposes Operation Olalampo: MuddyWater's new MENA campaign using AI-assisted Rust malware (CHAR) and Telegram bots for stealthy C2 communication.

Industrialized Theft: GoldFactory Malware Hijacks Tax Season via Fake ‘Coretax’ Apps Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Industrialized Theft: GoldFactory Malware Hijacks Tax Season via Fake ‘Coretax’ Apps

Do Son February 23, 2026

Group-IB exposes an industrialized mobile banking fraud campaign in Indonesia. GoldFactory hackers use fake Coretax apps and Gigabud.RAT to drain accounts.

The Invisible Landlord: ShadowSyndicate Rotates Keys to Hide Infrastructure

Do Son February 6, 2026

Group-IB reveals ShadowSyndicate is evolving. The cybercrime cluster now rotates SSH keys to hide its infrastructure. Is it a BPH or IAB?

Crossing the Andes: Sophisticated Loan Phishing Scams Hit Peru Peru Loan Phishing Luhn Algorithm Scam

Crossing the Andes: Sophisticated Loan Phishing Scams Hit Peru

Do Son January 23, 2026

Group-IB reveals a sophisticated loan phishing campaign in Peru. Scammers use the Luhn algorithm to validate stolen credit cards via fake ads.

DeadLock Ransomware: New Strain Hides C2 in Polygon Smart Contracts DeadLock Ransomware Polygon Smart Contracts

DeadLock Ransomware: New Strain Hides C2 in Polygon Smart Contracts

Do Son January 16, 2026

Group-IB uncovers DeadLock ransomware using Polygon smart contracts for resilient C2. This "EtherHiding" tactic signals a new era of blockchain abuse.

“Ghost Tap” Rising: New Wave of Android Malware Turns Phones into Digital Pickpockets Ghost Tap Malware NFC Relay Attack

“Ghost Tap” Rising: New Wave of Android Malware Turns Phones into Digital Pickpockets

Do Son January 8, 2026

New "Ghost Tap" malware lets hackers relay NFC signals from your Android phone to steal funds remotely. Learn how this sophisticated Group-IB discovery works.

Wonderland Unleashed: New Android “Dropper” Malware Hijacks Telegram to Drain Bank Accounts Android zero day flaw June 2026 security bulletin RuTaxi Trojan Android Banking Malware Pixel 9 zero-click exploit, Dolby UDC vulnerability CVE-2025-54957 NexusRoute Android RAT, India E-Challan Phishing ClayRat Self-Defense, Android Accessibility Abuse Android Trojan, AntiDot Android Malware "BadPack"

Android zero day flaw June 2026 security bulletin RuTaxi Trojan Android Banking Malware Pixel 9 zero-click exploit, Dolby UDC vulnerability CVE-2025-54957 NexusRoute Android RAT, India E-Challan Phishing ClayRat Self-Defense, Android Accessibility Abuse Android Trojan, AntiDot Android Malware "BadPack"

Wonderland Unleashed: New Android “Dropper” Malware Hijacks Telegram to Drain Bank Accounts

Do Son December 23, 2025

Group-IB uncovers "Wonderland," a bidirectional Android SMS stealer in Uzbekistan that uses Telegram droppers to drain bank accounts and hijack sessions.

MuddyWater APT Shifts Tactics to Custom Malware MuddyWater APT ANY.RUN security incident

MuddyWater APT Shifts Tactics to Custom Malware

Do Son September 19, 2025

Group-IB reports on MuddyWater, an Iranian APT, shifting tactics from RMM tools to custom malware and spearphishing, using new backdoors like Phoenix.

ShadowSilk Unmasked: The Hybrid Espionage Group Targeting Central Asian Governments Harvester APT Linux Backdoor OT Cyberattack Iranian APT Operation Olalampo MuddyWater APT Prince of Persia APT, Tonnerre v50 Patchwork APT, DLL Sideloading Subtle Snail, cyber espionage ShadowSilk, cyber espionage Volt Typhoon APT Group - Chinese Cybersecurity Firm

ShadowSilk Unmasked: The Hybrid Espionage Group Targeting Central Asian Governments

Do Son August 29, 2025

A new Group-IB report reveals ShadowSilk, a hybrid Chinese and Russian-speaking threat cluster that uses Telegram bots for cyber espionage against Central Asian governments.