Tag: aes-256-gcm

3 Attack Reports | 0 Vulnerabilities

Attack reports

PDFSIDER Malware - Exploitation of DLL Side-Loading for AV and EDR Evasion

PDFSIDER is a newly identified malware variant that utilizes DLL side-loading to deploy a covert backdoor with encrypted command-and-control capabilities. It exploits vulnerabilities in legitimate software like PDF24 Creator to bypass endpoint detection mechanisms. The malware operates primarily in…
apt
dll side-loading
spear-phishing
anti-vm
aes-256-gcm
2026-01-18
in-memory backdoor
pdf24 creator
pdfsider
Published: January 18, 2026
Downloadable IOCs: 5

CyberVolk Ransomware: Analysis of Double Encryption Structure and Disguised Decryption Logic

The CyberVolk ransomware, emerging in May 2024, targets public institutions and key infrastructures of anti-Russian countries. It uses a double encryption structure with AES-256 GCM and ChaCha20-Poly1305 algorithms. The ransomware excludes certain files and directories from encryption and uses a sy…
ransomware
geopolitical
pro-russian
chacha20-poly1305
2025-09-12
symmetric key
cybervolk
aes-256 gcm
double encryption
Published: September 12, 2025
Downloadable IOCs: 0

Interlock Ransomware Targeting Businesses

The Interlock ransomware group has been actively targeting businesses and critical infrastructures in North America and Europe since September 2024. Their ransomware employs AES-256-GCM encryption with RSA-4096 key protection, leveraging the OpenSSL library for efficient file encryption. The malwar…
ransomware
data theft
europe
interlock
file encryption
code obfuscation
2025-08-29
openssl
north america
aes-256-gcm
rsa-4096
Published: August 29, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports