Unit 42

Prometei Botnet Evolves: Linux Variant Returns With Stealthier Payloads and Monero Mining Focus

• Malware

Prometei Botnet Evolves: Linux Variant Returns With Stealthier Payloads and Monero Mining Focus

Do Son June 23, 2025 0

The Prometei botnet is back with a stealthy Linux variant, actively mining Monero and stealing credentials. It uses DGA, custom UPX packing, and sophisticated anti-analysis techniques.

KimJongRAT Returns: New PE & PowerShell Variants Steal Crypto and Browser Data via CDNs

• Malware

KimJongRAT Returns: New PE & PowerShell Variants Steal Crypto and Browser Data via CDNs

Do Son June 18, 2025 0

KimJongRAT is back with new PE and PowerShell variants, using LNK files and CDNs to steal browser, email, and over 30 crypto wallet details from victims.

From Cheats to Compromise: Blitz Malware Exploits Gamers via Backdoored Standoff 2 Cheats

• Malware

From Cheats to Compromise: Blitz Malware Exploits Gamers via Backdoored Standoff 2 Cheats

Do Son June 9, 2025 0

Blitz malware infects gamers via backdoored Standoff 2 cheats, stealing data and cryptojacking. It uses Hugging Face for C2 and targets Windows users globally.

Stealth in Pixels: .NET Malware Hides Payloads in Bitmap Resources

• Malware

Stealth in Pixels: .NET Malware Hides Payloads in Bitmap Resources

Do Son May 13, 2025 0

Sophisticated malware hides inside image files within .NET apps to secretly infect systems, targeting finance in Türkiye and logistics in Asia.

From Web Shell to Full Control: APT-Style Exploits Surge Against SAP NetWeaver

• Malware
• Vulnerability

From Web Shell to Full Control: APT-Style Exploits Surge Against SAP NetWeaver

Do Son May 11, 2025 0

CVE-2025-31324 in SAP NetWeaver lets attackers upload web shells, enabling full remote code execution and system compromise—no login required.

Gremlin Stealer Malware Targets Browsers, Crypto Wallets, and VPNs in Telegram-Based Campaign

• Malware

Gremlin Stealer Malware Targets Browsers, Crypto Wallets, and VPNs in Telegram-Based Campaign

Do Son May 1, 2025 0

Gremlin Stealer malware, written in C#, exfiltrates browser data, crypto wallets, and VPN credentials, distributing stolen data via a Telegram-based backend.

Slow Pisces Targets Crypto Developers with Deceptive Coding Challenges

• Cybercriminals
• Malware

Slow Pisces Targets Crypto Developers with Deceptive Coding Challenges

Do Son April 14, 2025 0

North Korean threat group Slow Pisces targets crypto developers with fake job offers and malicious coding challenges. Learn how they steal millions