Malware Analysis

“TryCloudflare” Abuse: AsyncRAT Exploits Free Tunnels to Build Stealthy WebDAV Network

• Malware

“TryCloudflare” Abuse: AsyncRAT Exploits Free Tunnels to Build Stealthy WebDAV Network

Do Son January 13, 2026 0

New AsyncRAT campaign abuses free Cloudflare tunnels for stealthy malware delivery. Learn how phishing emails lead to WebDAV attacks & Python injection.

“Boto Cor-de-Rosa”: Banking Malware Astaroth Pivots to WhatsApp in New Campaign

• Cybercriminals

“Boto Cor-de-Rosa”: Banking Malware Astaroth Pivots to WhatsApp in New Campaign

Do Son January 12, 2026 0

New Astaroth campaign "Boto Cor-de-Rosa" uses a Python worm to hijack WhatsApp Web. It auto-messages your contacts to spread banking malware globally.

RustyWater Rising: MuddyWater Drops PowerShell for Stealthy Rust Implants

• Cyber Security
• Malware

RustyWater Rising: MuddyWater Drops PowerShell for Stealthy Rust Implants

Do Son January 12, 2026 0

MuddyWater APT deploys new "RustyWater" malware against Middle East targets. CloudSEK reveals how the group is ditching PowerShell for stealthy Rust tools.

Guloader Malware Rides Wave of Fake Performance Reports

• Malware

Guloader Malware Rides Wave of Fake Performance Reports

Do Son January 9, 2026 0

New phishing campaign uses fake layoff warnings to drop Guloader and Remcos RAT. Learn how this HR-themed scam exploits workplace anxiety to steal data.

NodeCordRAT: The Trojan Hiding in NPM to Steal Crypto via Discord

• Malware

NodeCordRAT: The Trojan Hiding in NPM to Steal Crypto via Discord

Do Son January 9, 2026 0

Zscaler detects NodeCordRAT, a new malware in malicious npm packages. It uses Discord as a C2 server to loot crypto wallets and Chrome data.

LockBit 5.0 Sustains Global Ransomware Dominance

• Malware

LockBit 5.0 Sustains Global Ransomware Dominance

Do Son January 9, 2026 0

LockBit 5.0 emerges with new "premium" criminal services. AhnLab analysis reveals how the top RaaS gang targets IT firms and churches alike.

“VM Isolation is Not Absolute”: Researchers Unmask Sophisticated ESXi “Maestro” Exploit

• Malware
• Vulnerability Report

“VM Isolation is Not Absolute”: Researchers Unmask Sophisticated ESXi “Maestro” Exploit

Do Son January 8, 2026 0

Huntress exposes "VSOCKpuppet" VM escape: Attackers used a hidden zero-day toolkit to breach VMware ESXi hosts and bypass network monitoring.

GoBruteforcer Returns: How AI Code Snippets Fueled a 50,000-Server Botnet

• Malware

GoBruteforcer Returns: How AI Code Snippets Fueled a 50,000-Server Botnet

Do Son January 8, 2026 0

New GoBruteforcer variant targets 50k+ servers by exploiting weak passwords from AI-generated code. Learn how this crypto-stealing botnet operates.

CrazyHunter: The “Ruthless” Ransomware Stalking Healthcare

• Malware

CrazyHunter: The “Ruthless” Ransomware Stalking Healthcare

Do Son January 8, 2026 0

New CrazyHunter ransomware targets healthcare with BYOVD tactics and rapid encryption. Trellix reveals how this "greedy" threat cripples hospitals.

Popular Chinese Utility Hijacked to Deploy Browser Malware

• Malware

Popular Chinese Utility Hijacked to Deploy Browser Malware

Do Son January 7, 2026 0

Nearly 1M users compromised: Discover how the popular Office Assistant tool uses Mltab malware to hijack browsers, steal data, and exploit digital signatures.

More_Eggs Malware Deep Dive: Abusing ieuinit.exe and Polymorphic JavaScript

• Malware

More_Eggs Malware Deep Dive: Abusing ieuinit.exe and Polymorphic JavaScript

Do Son May 20, 2025 0

A technical analysis of the More_Eggs malware, detailing its use of ieuinit.exe abuse, DLL side-loading, and polymorphic JavaScript.

Skitnet Analysis: Nim, Rust, and DNS Abuse in Advanced Malware Campaign

• Malware

Skitnet Analysis: Nim, Rust, and DNS Abuse in Advanced Malware Campaign

Do Son May 19, 2025 0

In-depth analysis of Skitnet malware: Rust, Nim, and DNS abuse. Discover how this sophisticated threat evades detection.

Gunra Ransomware: New Threat Analysis Reveals Evasion Tactics

• Malware

Gunra Ransomware: New Threat Analysis Reveals Evasion Tactics

Do Son May 7, 2025 0

CYFIRMA's analysis details Gunra Ransomware's sophisticated techniques, including evasion and data exfiltration, impacting global industries.

StealC V2: ThreatLabz Unveils the Evolution of a Stealthy Info-Stealer and Malware Loader

• Malware

StealC V2: ThreatLabz Unveils the Evolution of a Stealthy Info-Stealer and Malware Loader

Do Son May 5, 2025 0

ThreatLabz reveals StealC V2—an evolving info-stealer with encrypted C2, MSI and PowerShell payloads, and a rule-driven control panel for targeted attacks.

Lumma Stealer: Advanced Obfuscation and Evasion Techniques Analysis

• Malware

Lumma Stealer: Advanced Obfuscation and Evasion Techniques Analysis

Do Son April 25, 2025 0

Trellix analysis reveals Lumma Stealer's latest tactics: code obfuscation, API hashing, ETW evasion, anti-VM. Learn how this InfoStealer avoids detection.

ToyMaker’s Playbook: Cisco Talos Exposes IAB Tactics Leading to Cactus Ransomware

• Cybercriminals
• Malware

ToyMaker’s Playbook: Cisco Talos Exposes IAB Tactics Leading to Cactus Ransomware

Do Son April 25, 2025 0

Cisco Talos uncovers ToyMaker's IAB activity, paving the way for Cactus ransomware. Learn how LAGTOY backdoor & credential theft led to a major breach.

Unveiling a Multi-Stage Malware Attack: Cloudflare Abuse and AsyncRAT Delivery

• Malware

Unveiling a Multi-Stage Malware Attack: Cloudflare Abuse and AsyncRAT Delivery

Do Son April 23, 2025 0

A deep dive into a sophisticated multi-stage malware attack using Cloudflare to deliver AsyncRAT. Learn how attackers evade detection and compromise systems.

Gorilla Android Malware: Evolving Threat with Espionage Capabilities

• Malware

Gorilla Android Malware: Evolving Threat with Espionage Capabilities

Do Son April 18, 2025 0

Prodaft analysis reveals Gorilla, a new Android malware evolving to steal data and potentially conduct espionage.

DAMASCENED PEACOCK: NCSC Uncovers Sophisticated Malware Targeting UK MOD

• Cyber Security
• Malware

DAMASCENED PEACOCK: NCSC Uncovers Sophisticated Malware Targeting UK MOD

Do Son April 15, 2025 0

The NCSC reveals DAMASCENED PEACOCK, a sophisticated malware targeting the UK MOD, using spear-phishing, code signing, and COM Hijacking.

ViperSoftX Malware: Arabic-Speaking Attackers Exploit PowerShell in New Cyberattack Campaign

• Cybercriminals
• Malware

ViperSoftX Malware: Arabic-Speaking Attackers Exploit PowerShell in New Cyberattack Campaign

Do Son April 13, 2025 0

ViperSoftX malware is being used by Arabic-speaking attackers to target South Korea, according to ASEC. This malware uses PowerShell and spreads through torrents, delivering PureCrypter and Quasar RAT

GPT-4: Unveiling the AI Model’s Prowess in Malware Analysis

• Malware
• Technology

GPT-4: Unveiling the AI Model’s Prowess in Malware Analysis

Do Son November 16, 2023 0

Check Point conducted a study on the capabilities of GPT in the realm of malware analysis, using the extensive language model of GPT-4