Tag: 2025-07-02

A new email attack distributing DCRAT, a Remote Access Trojan, has been uncovered. The threat actor impersonates a Colombian government entity to target organizations in Colombia. The attack employs multiple evasion techniques, including password-protected archives, obfuscation, steganography, base…

This article provides an in-depth analysis of Windows shortcut (LNK) file malware, based on the examination of 30,000 recent samples. The research reveals four main categories of LNK malware: exploit execution, file on disk execution, in-argument scripts execution, and overlay execution. Each techn…

The Kimsuky group has adopted a deceptive tactic called 'ClickFix' to trick users into unknowingly participating in attack chains. This method involves disguising malicious instructions as troubleshooting guides or security document verification procedures. The campaign is believed to be an extensi…

A new ransomware strain resembling DragonForce but with unique traits has emerged, possibly connected to an entity called DEVMAN. The sample reuses DragonForce code but adds its own elements, including the .DEVMAN file extension. Attribution is unclear, as the ransom note is identical to DragonForc…

This analysis reveals a network of Pakistani freelancers creating websites for cracked software distribution, potentially linked to stealer malware campaigns. The report identifies specific email addresses, domain names, and hosting providers associated with these activities. It highlights the use …

A newly emerged ransomware group called Dire Wolf has been observed since May 2025, targeting multiple sectors globally with a focus on manufacturing and technology. The group employs double extortion tactics, encrypting files and threatening to publish stolen data. Analysis of a Dire Wolf ransomwa…