Do Son Discover how the Havoc stager campaign exploits fake invoices. Read the LevelBlue SpiderLabs report detailing this stealthy threat.
Memory injection
Darktrace exposes Chinese APT Twill Typhoon’s latest campaign using DLL sideloading and Yahoo/Apple CDN lookalikes to deploy a modular .NET RAT.
Cyble uncovers "ShadowHS," a fileless Linux malware weaponizing hackshell. It uses GSocket tunneling to evade firewalls and kill rival bots.
Vidar 2.0, fully rewritten in C, is a multithreaded infostealer that bypasses Chrome's AppBound encryption via memory injection to steal crypto wallets and credentials. Its adoption spikes as Lumma declines.
Remcos RAT campaign evades antivirus using PowerShell-based in-memory execution. Steals data, bypasses UAC, and avoids detection with stealthy tactics.