Do Son Intrinsec’s 2025 report unmasks "Fly," the elusive operator of Russian Market, linking the decade-old bazaar to early malware and BTC-E laundering.
threat intelligence
A joint Hunt.io and Acronis report exposes the shared infrastructure behind Lazarus and Kimsuky, revealing the unified web of North Korean hacking.
Transparent Tribe (APT36) evolves with new Linux malware targeting Indian government BOSS systems via weaponized shortcut files.
Silent Push details how cybercriminals and APTs are misusing DDNS services for stealthy C2 servers, phishing, and malware delivery. Dozens of high-profile groups are involved.
Group-IB reports on MuddyWater, an Iranian APT, shifting tactics from RMM tools to custom malware and spearphishing, using new backdoors like Phoenix.
CYFIRMA uncovers XillenStealer, a new Python-based, open-source malware on GitHub. Its built-in builder enables even novices to steal data and credentials.
GitLab Threat Intelligence reveals a new North Korean malware campaign using "ClickFix" social engineering to target new industries like crypto and retail.
SmokeLoader is back. Despite a recent takedown, the malware loader returns with new versions, fixing bugs and adding advanced evasion tactics.
A new report reveals HijackLoader, a Malware-as-a-Service loader. It uses advanced evasion and anti-analysis techniques to deliver stealers and other payloads.
Okta Threat Intelligence uncovers VoidProxy, a dangerous new Phishing-as-a-Service (PhaaS) platform that uses Adversary-in-the-Middle attacks to bypass MFA.
A new report uncovers 45 previously unknown domains linked to the Chinese APT group Salt Typhoon. The findings reveal a long-term, multi-year espionage infrastructure.
A new report reveals Inf0s3c Stealer, a stealthy Python malware that abuses Discord to exfiltrate passwords, crypto wallets, and other sensitive data from victims.
A new report reveals TinkyWinkey, a stealthy Windows keylogger that uses low-level APIs and DLL injection to steal credentials and sensitive data from victims.
A new report reveals a SpyNote Android RAT campaign using fake Google Play Store clones to steal data, with the malware abusing Accessibility Services for control.
A new ransomware strain called Cephalus is using compromised RDP, DLL sideloading, and abused security tools to bypass defenses and intimidate victims.
CISA has added two Citrix and one critical Git vulnerability to its KEV Catalog, warning that all three flaws are being actively exploited by malicious actors.
GreyNoise reports a massive, coordinated scanning campaign targeting Microsoft RDP services. Attackers are probing tens of thousands of IPs to prepare for future attacks.
A new report reveals that Android droppers are evolving. They are now being re-engineered to bypass Google Play Protect and deliver a wide range of malware.
A new report reveals that the Pakistan-linked APT36 is now targeting Indian government and defense entities with Linux-specific malware delivered via Google Drive.
A data leak from an alleged North Korean APT group's workstation has revealed its use of a commercial proxy service, offering a rare look into its anonymizing infrastructure.
A new report reveals that the Pakistan-based APT36 is targeting Indian government entities using spear-phishing and Linux-specific malware to steal sensitive data.
A new report reveals the Anatsa banking trojan is now targeting over 831 financial institutions worldwide. The malware is distributed via fake apps on Google Play.