Tag: anti-debugging

6 Attack Reports | 0 Vulnerabilities

Attack reports

Operation Dragon Whistle: UNG002 Targets Chinese Academia via Weaponized Institutional Lure

A sophisticated spear-phishing campaign designated Operation Dragon Whistle has been identified targeting Changzhou University in China. The threat actor UNG002 leveraged highly contextual social engineering by impersonating official university communications regarding mandatory 2026 National Stude…

social engineering

dll sideloading

in-memory execution

chinese academia

education sector targeting

Published: May 20, 2026

Downloadable IOCs: 8

Malicious JavaScript Injects Fullscreen Iframe On a WordPress Website

A JavaScript-based malware campaign has been discovered affecting compromised WordPress websites. The malware injects a fullscreen iframe that loads content from suspicious external domains, aiming to force users to view unsolicited content for ad fraud, traffic generation, or social engineering. T…

iframe injection

powershell exploitation

fullscreen overlay

Published: August 14, 2025

Downloadable IOCs: 6

Clone, Compile, Compromise: Open-Source Malware Trap on GitHub

A newly identified threat actor, Water Curse, is exploiting GitHub to deliver weaponized repositories containing multistage malware. The group has been linked to at least 76 GitHub accounts, targeting cybersecurity professionals, game developers, and DevOps teams. Their malware enables data exfiltr…

privilege escalation

data exfiltration

backdoor.js.dullrat

multistage malware

Published: June 16, 2025

Downloadable IOCs: 0

GorillaBot: Technical Analysis and Code Similarities with Mirai

GorillaBot is a newly discovered Mirai-based botnet that has launched over 300,000 attacks across more than 100 countries, targeting various industries including telecommunications, finance, and education. It reuses Mirai's core logic while adding custom encryption and evasion techniques. The malwa…

c2 communication

Published: March 25, 2025

Downloadable IOCs: 3

Updated Shadowpad Malware Leads to Ransomware Deployment

A recent investigation revealed Shadowpad malware being used to deploy a new ransomware family in Europe. The threat actor targeted 21 companies across 15 countries, primarily in the manufacturing sector. Access was gained through remote network attacks, exploiting weak passwords and bypassing mult…

multi-factor authentication bypass

remote network attacks

intellectual property theft

Published: February 20, 2025

Downloadable IOCs: 0

Analysis report on recent phishing attacks by APT-C-48 (CNC)

APT-C-48 (CNC), a South Asian government-backed APT group, has been targeting government, military, education, research, healthcare, and media sectors. They use spear-phishing emails with resume-related topics to deliver malicious payloads. The group modifies executable file icons to resemble PDF f…

Published: December 3, 2024

Downloadable IOCs: 5

Click here to see more Attack Reports