Do Son DOUBLECUP is a new Russian ClickFix Loader-as-a-Service that drops CountLoader and the DeviceManager RAT using steganography and EtherHiding.
Loader-as-a-Service
A steganographic loader hides Remcos RAT inside a bitmap and runs it in memory. K7 ties the fileless campaign to India via fake GST lures.
Trend Micro discovered RondoDox, a new botnet leveraging 50+ exploits (including the Pwn2Own TP-Link flaw) in an "exploit shotgun" approach to compromise routers, DVRs, and IoT globally.