SecuriTricks - cobalt strike

From emerging threat to top-tier ransomware-as-a-service: The evolution of INC ransomware

INC has evolved from an emerging ransomware-as-a-service operation into one of the most active groups in 2026, claiming over 800 victims since 2023. The disruption of LockBit and BlackCat's shutdown created opportunities for INC to expand as affiliates migrated. Both Windows and Linux/ESXi encrypto…

cobalt strike

encryption

ransomware-as-a-service

veeam-credential-dumping

vmware-esxi

Published: June 17, 2026

Linked vulnerabilities : CVE-2024-57727 (CVSS 7.5), CVE-2023-3519, CVE-2023-48788, CVE-2025-5777 (CVSS 9.3)

Downloadable IOCs: 22

Middle East Malicious Infrastructure Report: 1,350+ C2 Servers Mapped Across 98 Providers

Between February and May 2026, over 1,350 active command-and-control servers were identified across 98 infrastructure providers spanning 14 Middle Eastern countries. Saudi Arabia's STC hosted 981 C2 servers, representing 72.4% of all regional malicious infrastructure, the largest concentration glob…

Published: May 21, 2026

Linked vulnerabilities : CVE-2025-11953 (CVSS 9.8)

Downloadable IOCs: 5

Fresh mischief and digital shenanigans

FrostyNeighbor, a cyberespionage group allegedly operating from Belarus and active since at least 2016, continues targeting governmental, military, and key sectors in Eastern Europe, particularly Ukraine, Poland, and Lithuania. Recent activities detected since March 2026 show the group targeting Uk…

governmental targeting

Published: May 21, 2026

Downloadable IOCs: 9

Operation Dragon Whistle: UNG002 Targets Chinese Academia via Weaponized Institutional Lure

A sophisticated spear-phishing campaign designated Operation Dragon Whistle has been identified targeting Changzhou University in China. The threat actor UNG002 leveraged highly contextual social engineering by impersonating official university communications regarding mandatory 2026 National Stude…

education sector targeting

Published: May 20, 2026

Downloadable IOCs: 8

The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

The Gentlemen ransomware-as-a-service program has rapidly expanded since mid-2025, claiming over 320 victims with 240 attacks occurring in early 2026. The service provides multi-platform lockers for Windows, Linux, NAS, BSD, and ESXi, enabling comprehensive coverage of corporate environments. Durin…

cobalt strike

anydesk

ransomware-as-a-service

group-policy-deployment

Published: April 20, 2026

Downloadable IOCs: 27

The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

The Gentlemen ransomware-as-a-service program has rapidly expanded since mid-2025, claiming over 320 victims with 240 attacks occurring in early 2026. The service provides multi-platform lockers for Windows, Linux, NAS, BSD, and ESXi, enabling comprehensive coverage of corporate environments. Durin…

cobalt strike

anydesk

ransomware-as-a-service

group-policy-deployment

Published: April 20, 2026

Downloadable IOCs: 27

Iran conflict drives heightened espionage activity against Middle East targets

The ongoing conflict involving Iran has led to increased cyber espionage activities targeting Middle Eastern governments. Multiple state-sponsored threat actors, including those from China, Belarus, Pakistan, and Hamas, have been observed conducting campaigns using the conflict as a lure. These act…

state-sponsored actors

Published: March 11, 2026

Downloadable IOCs: 19

Silver Dragon Targets Organizations in Southeast Asia and Europe

Check Point Research has identified a Chinese-nexus advanced persistent threat group named Silver Dragon, targeting organizations in Southeast Asia and Europe since mid-2024. The group, likely operating under APT41, exploits public-facing servers and uses phishing emails for initial access. They de…

Published: March 3, 2026

Downloadable IOCs: 31

Nation-State Actors Exploit Notepad++ Supply Chain

A state-sponsored threat group known as Lotus Blossom compromised the official hosting infrastructure for Notepad++ between June and December 2025. The attackers hijacked traffic to the update server, allowing them to selectively target specific users, primarily in Southeast Asia across government,…

supply chain

cobalt strike

dll sideloading

infrastructure compromise

infrastructure hijacking

2026-02-16

Published: February 16, 2026

Downloadable IOCs: 20

The Shadow Campaigns: Uncovering Global Espionage

This investigation reveals a new cyberespionage group tracked as TGR-STA-1030, believed to be a state-aligned actor operating from Asia. Over the past year, the group has compromised government and critical infrastructure organizations in 37 countries, targeting ministries, law enforcement agencies…

Published: February 5, 2026

Linked vulnerabilities : CVE-2019-11580

Downloadable IOCs: 22

Notepad++ supply chain attack breakdown

The article details a sophisticated supply chain attack on Notepad++ that occurred from July to October 2025. Attackers compromised the update infrastructure, deploying various malicious payloads through three distinct infection chains. The attack targeted individuals and organizations in Vietnam, …

Published: February 3, 2026

Downloadable IOCs: 36

The Chrysalis Backdoor: A Deep Dive into Lotus Blossom's toolkit

Rapid7 Labs has uncovered a sophisticated campaign attributed to the Chinese APT group Lotus Blossom, involving a new custom backdoor named Chrysalis. The attack compromised Notepad++ infrastructure to deliver the backdoor. Analysis revealed multiple custom loaders, including one using Microsoft Wa…

Published: February 3, 2026

Downloadable IOCs: 34

Can't stop, won't stop: TA584 innovates initial access

TA584, a prominent initial access broker targeting organizations globally, demonstrated significant changes in attack strategies throughout 2025. The actor expanded its global targeting, adopted ClickFix social engineering techniques, and began delivering new malware called Tsundere Bot. TA584's op…

initial access broker

Published: January 28, 2026

Downloadable IOCs: 7

Weekly Threat Bulletin – January 28th, 2026

This weekly threat bulletin highlights several critical vulnerabilities and emerging threats. A severe RCE vulnerability in React Server Components and Next.js (CVE-2025-55182) is being actively exploited. CISA added four critical flaws to its 'Must-Patch' list, including vulnerabilities in Versa C…

oracle e-business suite

Published: January 28, 2026

Linked vulnerabilities : CVE-2025-24893 (CVSS 9.8), CVE-2023-1389, CVE-2025-31125 (CVSS 5.3), CVE-2025-34026 (CVSS 9.2), CVE-2025-54313 (CVSS 7.5), CVE-2025-61882 (CVSS 9.8), CVE-2025-55182 (CVSS 10.0), CVE-2025-66478, CVE-2025-55184 (CVSS 7.5), CVE-2025-55183 (CVSS 5.3), CVE-2025-68645 (CVSS 8.8), CVE-2025-13335 (CVSS 6.5), CVE-2025-13927 (CVSS 7.5), CVE-2025-13928 (CVSS 7.5), CVE-2026-0723 (CVSS 7.4), CVE-2026-1102 (CVSS 5.3)

Downloadable IOCs: 37

APT Attacks Target Indian Government Using GOGITTER, GITSHELLPAD, and GOSHELL | Part 1

A Pakistan-linked APT group conducted two campaigns targeting Indian government entities. The Gopher Strike campaign used PDFs with malicious links to deliver an ISO file containing GOGITTER, a Golang downloader that fetches payloads from private GitHub repositories. GITSHELLPAD, a Golang backdoor,…

Published: January 26, 2026

Downloadable IOCs: 33

Inside China's Hosting Ecosystem: 18,000+ Malware C2 Servers Mapped Across Major ISPs

An analysis of Chinese hosting environments reveals over 18,000 active command-and-control (C2) servers distributed across 48 infrastructure providers. C2 infrastructure dominates malicious activity at 84%, followed by phishing at 13%. China Unicom hosts nearly half of all observed C2 servers, with…

Published: January 15, 2026

Linked vulnerabilities : CVE-2025-8110 (CVSS 8.7)

Downloadable IOCs: 12

Operation FrostBeacon: Multi-Cluster Cobalt Strike Campaign Targets Russia

Operation FrostBeacon is a targeted malware campaign delivering Cobalt Strike beacons to companies in Russia. It uses two infection clusters: one leveraging malicious archive files with LNK shortcuts, and another exploiting CVE-2017-0199 and CVE-2017-11882 vulnerabilities. Both clusters lead to rem…

Published: December 8, 2025

Linked vulnerabilities : CVE-2017-11882, CVE-2017-0199

Downloadable IOCs: 60

APT24 Pivot to Multi-Vector Attacks

APT24, a Chinese threat actor, has conducted a three-year cyber espionage campaign using BADAUDIO, a highly obfuscated first-stage downloader. The group has evolved from broad strategic web compromises to more sophisticated tactics, including supply chain attacks and targeted phishing. They comprom…

strategic web compromise

Published: November 20, 2025

Downloadable IOCs: 0

WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization

A malware campaign called WEBJACK is compromising Microsoft IIS servers to deploy BadIIS malware modules for SEO poisoning and fraud. The attackers hijack high-profile targets, including government and educational institutions, to redirect users to gambling websites. The campaign uses various tools…

Published: November 19, 2025

Downloadable IOCs: 34

Malicious Infrastructure Finds Stability with aurologic GmbH

German hosting provider aurologic GmbH has become a central hub for high-risk hosting networks, providing upstream transit to multiple threat activity enablers. These include sanctioned entities like Aeza Group and other providers associated with cybercrime and disinformation campaigns. aurologic's…

Published: November 6, 2025

Downloadable IOCs: 23

Team46 and TaxOff: Two Sides of the Same Coin

This intelligence report reveals that Team46 and TaxOff are likely the same APT group, now referred to as Team46. The analysis compares their attack methods, including the use of similar PowerShell commands, URL patterns, and loader functionality. Both groups utilized zero-day exploits and develope…

Published: October 29, 2025

Linked vulnerabilities : CVE-2024-6473 (CVSS 7.8), CVE-2025-2783 (CVSS 8.3)

Downloadable IOCs: 9

Uncovering Qilin attack methods exposed through multiple cases

The ransomware group Qilin has been highly active in 2025, publishing over 40 victim cases per month on its leak site. Manufacturing, professional services, and wholesale trade are the most affected sectors. Attackers likely originate from Eastern Europe or Russian-speaking regions. They use tools …

Published: October 27, 2025

Downloadable IOCs: 17

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

A Chinese-speaking cybercrime group, UAT-8099, is targeting high-value Internet Information Services (IIS) servers for search engine optimization fraud and data theft. The group focuses on reputable servers in India, Thailand, Vietnam, Canada, and Brazil, affecting universities, tech firms, and tel…

Published: October 2, 2025

Downloadable IOCs: 80

Threat Profile: Conti Ransomware Group

Conti, a notorious ransomware operation identified in 2019, quickly gained infamy for its advanced encryption, rapid lateral movement, and double extortion tactics. Operated by the Russia-based Wizard Spider group, Conti evolved from Ryuk ransomware and maintained suspected ties to Russian state in…

critical infrastructure

Published: September 30, 2025

Downloadable IOCs: 2

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

A user executed a malicious JavaScript file linked to Lunar Spider, initiating a two-month intrusion. The file downloaded a Brute Ratel DLL, which then injected Latrodectus malware. The threat actor used various tools including Cobalt Strike, BackConnect, and a custom .NET backdoor for persistence …

credential-harvesting

cobalt-strike

2025-09-29

Published: September 29, 2025

Downloadable IOCs: 0

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

A user executed a malicious JavaScript file linked to Lunar Spider, initiating a two-month intrusion. The file downloaded a Brute Ratel DLL, which then injected Latrodectus malware. The threat actor used various tools including Cobalt Strike, BackConnect, and a custom .NET backdoor for persistence …

credential-harvesting

cobalt-strike

2025-09-29

Published: September 29, 2025

Downloadable IOCs: 0

Targets Government, Defense, and Technology Organizations

RedNovember, a Chinese state-sponsored threat group, has expanded its cyber-espionage activities globally. The group targets high-profile government, intergovernmental, and private sector organizations, focusing on defense, aerospace, and technology sectors. It uses the Go-based backdoor Pantegana …

chinese state-sponsored

Published: September 24, 2025

Downloadable IOCs: 0

UAC-0057 Keeps Pressure on Ukraine and Poland

This report details recent cyber espionage campaigns targeting Ukraine and Poland, likely conducted by UAC-0057 (also known as UNC1151 or Ghostwriter). The threat actor used weaponized XLS spreadsheets with obfuscated VBA macros to drop first-stage DLL downloaders. C# and C++ downloaders were used …

Published: August 27, 2025

Linked vulnerabilities : CVE-2024-42009

Downloadable IOCs: 37

Pressure on Ukraine and Poland Continues

Recent analysis reveals two clusters of malicious archives targeting Ukraine and Poland since April 2025, linked to UAC-0057 (also known as UNC1151, FrostyNeighbor or Ghostwriter). The infection chains aim to collect system information and deploy implants for further exploitation, using readily ava…

Published: August 20, 2025

Downloadable IOCs: 0

SOC files: an APT41 attack on government IT services in Africa

Kaspersky's MDR team detected a targeted attack by APT41 against government IT services in Africa. The attackers used Impacket tools, Cobalt Strike, and custom agents for lateral movement and data collection. They leveraged DLL sideloading techniques and publicly available tools like Mimikatz and R…

credential harvesting

Published: August 20, 2025

Downloadable IOCs: 0

Threat Actor Profile: Interlock Ransomware

Interlock, a relatively new ransomware group first observed in September 2024, has gained prominence in 2025 as an opportunistic ransomware operator. Unlike traditional Ransomware-as-a-Service models, Interlock operates without affiliates or public advertisements. The group conducts double extortio…

Published: August 15, 2025

Downloadable IOCs: 24

CrossC2 Expanding Cobalt Strike Beacon to Cross-Platform Attacks

From September to December 2024, incidents involving CrossC2, an extension tool for Cobalt Strike Beacon on Linux, were confirmed. The attacker used CrossC2 along with other tools like PsExec, Plink, and Cobalt Strike to penetrate AD. A custom malware called ReadNimeLoader was used as a loader for …

Published: August 15, 2025

Downloadable IOCs: 0

SLOW#TEMPEST Cobalt Strike Loader

An ISO image containing a malicious Cobalt Strike loader was discovered, targeting Chinese-speaking users. The infection chain involves a deceptive LNK file, which executes a legitimate Alibaba executable to sideload a malicious DLL. The loader implements anti-analysis techniques, decrypts an embed…

Published: August 7, 2025

Downloadable IOCs: 9

SLOW#TEMPEST Cobalt Strike Loader

An ISO image containing a malicious Cobalt Strike loader was discovered, targeting Chinese-speaking users. The infection chain involves a deceptive LNK file, which executes a legitimate Alibaba executable to sideload a malicious DLL. The loader implements anti-analysis techniques, decrypts an embed…

Published: August 7, 2025

Downloadable IOCs: 9

Targeted attacks leverage accounts on popular online platforms as C2 servers

A sophisticated cyberattack campaign targeted the Russian IT industry and other entities globally in late 2024. The attackers used social media profiles and popular websites to deliver payload information, bypassing detection methods. They employed spear phishing emails with malicious RAR archives,…

Published: July 30, 2025

Downloadable IOCs: 2

New Wave of SquidLoader Malware Targeting Financial Institutions

A sophisticated malware campaign is targeting financial services in Hong Kong with SquidLoader, a highly evasive malware that deploys Cobalt Strike Beacon for remote access. The malware exhibits advanced anti-analysis, anti-sandbox, and anti-debugging techniques, achieving near-zero detection rates…

Published: July 21, 2025

Downloadable IOCs: 18

Malware Identified in Attacks Exploiting Ivanti Connect Secure Vulnerabilities

The article details malware and tactics used in attacks targeting Ivanti Connect Secure vulnerabilities from December 2024 to July 2025. It describes MDifyLoader, a loader based on libPeConv, which deploys Cobalt Strike Beacon through DLL side-loading. The attackers also utilized vshell, a multi-pl…

ivanti connect secure

2025-07-18

mdifyloader

Published: July 18, 2025

Downloadable IOCs: 0

Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting

Between March and June 2025, three Chinese state-sponsored threat actors conducted targeted phishing campaigns against the Taiwanese semiconductor industry. The campaigns targeted organizations involved in semiconductor manufacturing, design, testing, supply chain, and financial analysis. This acti…

Published: July 17, 2025

Downloadable IOCs: 54

DNS: A Small but Effective C2 system

This analysis explores the exploitation of DNS for command-and-control operations and data exfiltration. It details how cybercriminals leverage DNS tunneling to create covert communication channels, bypassing traditional security measures. The article examines various DNS tunneling families, includ…

Published: July 17, 2025

Downloadable IOCs: 0

A Hybrid Approach with Data Exfiltration and Encryption

The BlackSuit ransomware group, believed to be a rebrand of Royal ransomware, has emerged as a significant threat to organizations. This sophisticated attack combines data exfiltration and encryption, utilizing tools like Cobalt Strike for command and control, rclone for data exfiltration, and Blac…

Published: July 12, 2025

Downloadable IOCs: 0

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

A sophisticated campaign targeting China Mobile Tietong Co., Ltd., a subsidiary of China Mobile, has been uncovered. The attack employs VELETRIX, a new loader, and VShell, a known adversary simulation tool. The infection chain begins with a malicious ZIP file containing executable and DLL files. VE…

asset lighthouse system

ipfuscation

callback-execution

dll-sideloading

Published: June 7, 2025

Downloadable IOCs: 0

Custom Arsenal Developed to Target Multiple Industries

Earth Lamia, an APT threat actor, has been targeting organizations in Brazil, India, and Southeast Asia since 2023. The group exploits web application vulnerabilities, particularly SQL injection, to gain access to targeted systems. They have developed custom tools like PULSEPACK backdoor and Bypass…

vulnerability exploitation

brute ratel

multi-industry targeting

Published: May 27, 2025

Linked vulnerabilities : CVE-2024-9047 (CVSS 9.8), CVE-2024-51378 (CVSS 10.0), CVE-2024-51567 (CVSS 10.0), CVE-2024-56145, CVE-2025-31324 (CVSS 10.0), CVE-2017-9805, CVE-2024-27199, CVE-2024-27198, CVE-2021-22205

Downloadable IOCs: 185

Exploits Cityworks zero-day vulnerability to deliver malware

Chinese-speaking threat actors, dubbed UAT-6382, have been exploiting a remote-code-execution vulnerability (CVE-2025-0994) in Cityworks, a popular asset management system. The attacks, which began in January 2025, target local governing bodies in the United States, focusing on utilities management…

cobalt strike

exploitation

china chopper

chinese threat actors

Published: May 22, 2025

Linked vulnerabilities : CVE-2025-0944 (CVSS 6.3)

Downloadable IOCs: 18

New Nitrogen Ransomware Targets Financial Firms in the US, UK and Canada

Nitrogen, a new ransomware strain identified in September 2024, has become a significant threat to organizations worldwide, particularly in the financial sector. It encrypts critical data and demands substantial payments for decryption, targeting industries such as finance, construction, manufactur…

Published: May 20, 2025

Downloadable IOCs: 2

SAP Zero – Frostbite: How Russian RaaS Actor Qilin Exploited CVE-2025-31324 Weeks Before its Public Disclosure

CVE-2025-31324 hit the security world like a tsunami – an easily exploitable SAP vulnerability affecting enterprise environments across the globe. But while most assumed its exploitation began post-disclosure, new evidence suggests otherwise. During an incident response led by OP Innovate for a maj…

cobalt strike

sap netweaver

2025-05-20

ransomware-as-a-service (raas)

qilin ransomware

Published: May 20, 2025

Downloadable IOCs: 5

Modern Incident Response: Tackling Malicious ML Artifacts

This analysis explores the emerging threat of machine learning model-based breaches, detailing their anatomy, detection methods, and real-world examples. It highlights the risks associated with sharing ML models, particularly through platforms like Hugging Face, and the potential for malicious acto…

Published: May 14, 2025

Downloadable IOCs: 2

Targeting Taiwan & Japan with DLL Implants

A newly discovered APT campaign dubbed Swan Vector is targeting educational institutes and mechanical engineering industries in Taiwan and Japan. The attack uses a sophisticated multi-stage infection chain involving malicious LNK files, DLL implants (Pterois and Isurus), and Cobalt Strike payloads.…

Published: May 12, 2025

Downloadable IOCs: 16

DragonForce Ransomware Gang | From Hacktivists to High Street Extortionists

The DragonForce ransomware group, initially a pro-Palestine hacktivist operation, has evolved into a profit-driven extortion enterprise targeting UK retailers and various global entities. Emerging in August 2023, the group now employs a multi-extortion model, threatening data leaks and reputational…

dragonforce ransomware

white-label

Published: May 3, 2025

Downloadable IOCs: 0

Nitrogen Dropping Cobalt Strike – A Combination of 'Chemical Elements'

The Nitrogen ransomware group has expanded its operations from North America to Africa and Europe since September 2024. They utilize malvertising tactics, disguising malicious payloads as legitimate software like WinSCP. The group employs DLL sideloading for initial access, followed by Cobalt Strik…

Published: May 2, 2025

Downloadable IOCs: 2

Finding Minhook in a sideloading attack – and Sweden too

A threat actor campaign targeting multiple locations was observed in late 2023 and early 2024. Initially focused on the Far East, it later shifted to Sweden. The attacks used DLL sideloading techniques, employing the Minhook library to detour Windows API calls. The clean loader was obtained from in…

Published: May 1, 2025

Downloadable IOCs: 0

Two sides of the same coin

This intelligence report analyzes the similarities between two previously separate APT groups, Team46 and TaxOff, concluding they are likely the same entity. The analysis covers their shared tactics, techniques, and procedures, including similar PowerShell commands, loader functionality, and infras…

Published: April 18, 2025

Downloadable IOCs: 0

Inside BRUTED: Black Basta (RaaS) Used Automated Brute Forcing Framework to Target Edge Network Devices

Black Basta, a ransomware-as-a-service group, has been using an automated brute forcing framework called BRUTED to target edge network devices since 2023. The framework performs internet scanning and credential stuffing against firewalls and VPN solutions in corporate networks. Black Basta prioriti…

Published: April 16, 2025

Downloadable IOCs: 18

CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild

A critical vulnerability (CVE-2025-30406) in Gladinet CentreStack and Triofox software has been discovered and is being actively exploited. The flaw involves hardcoded cryptographic keys in configuration files, allowing attackers to abuse ASPX ViewState for remote code execution. Affected versions …

cobalt strike

privilege escalation

remote code execution

Published: April 15, 2025

Linked vulnerabilities : CVE-2025-30406

Downloadable IOCs: 6

Operation HollowQuill: Russian R&D Networks Targeted via Decoy PDFs

Operation HollowQuill targets Russian research and defense networks, particularly the Baltic State Technical University, using weaponized decoy documents disguised as research invitations. The attack chain involves a malicious RAR file containing a .NET dropper, which deploys a Golang-based shellco…

academic institutions

baltic state technical university

operation hollowquill

Published: March 31, 2025

Downloadable IOCs: 2

Fake Zoom Ends in BlackSuit Ransomware

A malicious website mimicking Zoom led to the installation of a trojanized installer, initiating a multi-stage attack. The initial payload, d3f@ckloader, downloaded additional components, including SectopRAT. After nine days, the threat actor deployed Brute Ratel and Cobalt Strike beacons for later…

Published: March 31, 2025

Downloadable IOCs: 0

Unmasking the new persistent attacks on Japan

An unknown attacker has been targeting organizations in Japan since January 2025, exploiting CVE-2024-4577, a remote code execution vulnerability in PHP-CGI on Windows. The attacker uses the Cobalt Strike kit 'TaoWu' for post-exploitation activities, including reconnaissance, privilege escalation, …

Published: March 6, 2025

Linked vulnerabilities : CVE-2024-4577 (CVSS 9.8)

Downloadable IOCs: 3

2024 Malicious Infrastructure Insights: Key Trends and Threats

The report highlights significant trends in malicious infrastructure for 2024, including the rise of malware-as-a-service infostealers, continued dominance of Cobalt Strike among offensive security tools, and increased use of legitimate services by threat actors. Key findings include LummaC2's domi…

malicious infrastructure

remote access trojans

2025-02-28

traffic distribution systems

mozi botnet

state-sponsored groups

command-and-control servers

solarmarker rat

offensive security tools

Published: February 28, 2025

Downloadable IOCs: 0

Ghostwriter | New Campaign Targets Ukrainian Government and Belarusian Opposition

A new campaign attributed to the Ghostwriter threat actor has been observed targeting opposition activists in Belarus and Ukrainian military and government organizations. The operation, which began preparation in mid-2024 and entered an active phase in late 2024, employs weaponized Excel documents …

Published: February 26, 2025

Downloadable IOCs: 10

Trimble Cityworks: CVE-2025-0994: Active Exploitation

A high-severity deserialization vulnerability in Trimble Cityworks, CVE-2025-0994, affects versions before 15.8.9 and Office Companion versions before 23.10. This flaw allows authenticated attackers to execute remote code on Microsoft IIS web servers. Exploitation indicators suggest the use of Rust…

cobalt strike

remote code execution

critical infrastructure

deserialization vulnerability

Published: February 20, 2025

Linked vulnerabilities : CVE-2025-0994 (CVSS 8.8)

Downloadable IOCs: 16

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

A sophisticated cyberespionage campaign targeting high-value entities in South Asia, particularly a telecommunications organization, has been identified. The threat actor, tracked as CL-STA-0048, employed rare techniques like 'Hex Staging' for payload delivery and DNS-based data exfiltration. The o…

Published: January 30, 2025

Linked vulnerabilities : CVE-2025-0282 (CVSS 9.0), CVE-2025-0283 (CVSS 7.0)

Downloadable IOCs: 21

Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware

This report details an intrusion that began with the execution of a Cobalt Strike beacon masquerading as a Windows Media Configuration Utility. The threat actor used various tools for persistence, lateral movement, and data exfiltration, including SystemBC and GhostSOCKS proxies, Rclone, and PsExec…

Published: January 27, 2025

Downloadable IOCs: 21

Tracking Adversaries: Ghostwriter APT Infrastructure

This analysis examines the infrastructure used by the Ghostwriter APT group, focusing on their phishing campaign targeting Ukrainian military. By pivoting on overlapping indicators of compromise (IOCs) from multiple threat reports, a cluster of malicious domains was identified. These domains share …

Published: January 24, 2025

Linked vulnerabilities : CVE-2022-30190

Downloadable IOCs: 25

APT32 Poisoning GitHub, Targeting Chinese Cybersecurity Professionals and Specific Large Enterprises

APT32 (OceanLotus) has launched a sophisticated attack targeting Chinese cybersecurity professionals and specific large enterprises. The group released a Cobalt Strike exploit plugin with a Trojan on GitHub, embedding a malicious .suo file into a Visual Studio project. When compiled, the Trojan exe…

Published: January 9, 2025

Downloadable IOCs: 0

Recent Cases of Watering Hole Attacks, Part 1

This analysis focuses on a watering hole attack targeting a Japanese university research laboratory website in 2023. The attack used social engineering to trick users into downloading and executing malware disguised as an Adobe Flash Player update. The malware, identified as a modified Cobalt Strik…

flashupdateinstall.exe

university

Published: December 20, 2024

Linked vulnerabilities : CVE-2022-1388

Downloadable IOCs: 10

The Curious Case of an Excellent Resume

This report details a malicious campaign where the threat actor gained initial access through a resume lure as part of a TA4557/FIN6 operation. The actor employed techniques like abusing legitimate binaries, establishing Cobalt Strike and Pyramid C2, exploiting CVE-2023-27532 for lateral movement, …

Published: December 4, 2024

Linked vulnerabilities : CVE-2023-27532

Downloadable IOCs: 20

Threat Assessment: Distributors of BlackSuit Ransomware

Ignoble Scorpius, previously known as Royal ransomware, has rebranded as BlackSuit ransomware and increased its activity since March 2024. The group has targeted at least 93 victims globally, with a focus on the construction and manufacturing industries. Their initial ransom demands average 1.6% of…

Published: November 20, 2024

Downloadable IOCs: 2

Spot the Difference: New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

Earth Kasha, a threat group targeting Japan since 2019, has launched a new campaign with significant updates to their tactics and arsenals. The group has expanded its targets to include Taiwan and India, focusing on advanced technology organizations and government agencies. They now exploit public-…

Published: November 19, 2024

Linked vulnerabilities : CVE-2023-3519, CVE-2023-27997, CVE-2023-45727, CVE-2023-28461, CVE-2013-3900, CVE-2023-3467, CVE-2023-3466

Downloadable IOCs: 7

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

A Chinese state-sponsored threat group, TAG-112, has compromised two Tibetan websites to deliver Cobalt Strike malware. The attackers embedded malicious JavaScript in the sites, spoofing a TLS certificate error to trick visitors into downloading a disguised security certificate. This campaign highl…

joomla vulnerabilities

tls certificate spoofing

evasive panda

tag-102

Published: November 13, 2024

Downloadable IOCs: 19

EDR Bypass Testing Reveals Extortion Actor's Toolkit

Unit 42 investigated an extortion attempt where threat actors tested an AV/EDR bypass tool on rogue systems with Cortex XDR installed. The actors purchased network access via Atera RMM and used a BYOVD technique for the bypass tool. Researchers gained visibility into the actors' systems, uncovering…

threat actor profiling

av/edr bypass

Published: November 2, 2024

Downloadable IOCs: 0

Chinese Hackers Toolkit Uncovered And Activity History Uncovered

A Chinese hacking group called 'You Dun' was discovered through an exposed open directory, revealing their comprehensive attack infrastructure. The group utilized sophisticated reconnaissance tools and exploited Zhiyuan OA software via SQL injection attacks, targeting South Korean pharmaceutical or…

Published: October 28, 2024

Linked vulnerabilities : CVE-2021-25003

Downloadable IOCs: 7

Inside the Open Directory of the “You Dun” Threat Group

An open directory exposed a Chinese-speaking threat actor's toolkit and operational history. The actor conducted extensive scanning and exploitation targeting organizations in South Korea, China, Thailand, Taiwan, and Iran using tools like WebLogicScan, Vulmap, and Xray. The Viper C2 framework and …

weblogic exploitation

viper c2

chinese threat actor

Published: October 28, 2024

Downloadable IOCs: 3

Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan

A sophisticated cyber espionage campaign dubbed Operation Cobalt Whisper has been uncovered, targeting various industries in Hong Kong and Pakistan. The threat actor focuses on the defense sector, engineering researchers, and key entities in these regions, using tailored lures related to electrotec…

Published: October 24, 2024

Downloadable IOCs: 0

New Bumblebee Loader Infection Chain Signals Possible Resurgence

A new infection chain for the Bumblebee loader malware has been discovered, potentially indicating its resurgence after Operation Endgame. The sophisticated downloader, first identified in March 2022, is used by cybercriminals to access corporate networks and deliver payloads like Cobalt Strike bea…

Published: October 21, 2024

Downloadable IOCs: 11

No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection

This article analyzes four previously undisclosed DNS tunneling campaigns identified through a new campaign monitoring system. The system detects tunneling domains based on common techniques and attributes used in malicious campaigns. Four new campaigns were uncovered: FinHealthXDS (targeting finan…

covert communications

hiloti

finhealthxds

Published: October 5, 2024

Downloadable IOCs: 0

Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware

A BlackCat ransomware intrusion began with a Nitrogen malware campaign impersonating Advanced IP Scanner. The attackers used Sliver and Cobalt Strike beacons for post-exploitation, leveraging Python scripts for memory loading. They performed network enumeration using various tools and moved lateral…

credential harvesting

Published: October 1, 2024

Downloadable IOCs: 45

Storm-0501: Ransomware attacks expanding to hybrid cloud environments

Microsoft has observed Storm-0501, a financially motivated cybercriminal group, conducting multi-staged attacks targeting hybrid cloud environments. The group compromises on-premises networks, performs lateral movement to cloud environments, exfiltrates data, steals credentials, creates persistent …

Published: September 30, 2024

Linked vulnerabilities : CVE-2023-4966, CVE-2023-38203, CVE-2023-29300, CVE-2022-47966

Downloadable IOCs: 14

Unraveling SloppyLemming’s Operations Across South Asia

An investigation reveals SloppyLemming, an advanced threat actor targeting South and East Asian countries, particularly Pakistan. The group uses multiple cloud services for credential harvesting, malware delivery, and command and control. Their operations focus on government, law enforcement, energ…

Published: September 27, 2024

Linked vulnerabilities : CVE-2023-38831

Downloadable IOCs: 96

From initial compromise to ransomware and wipers

The Twelve group, formed in April 2023 amid the Russian-Ukrainian conflict, specializes in attacking Russian government organizations. Their attacks involve encrypting and deleting victims' data, causing maximum damage without seeking financial gain. The group uses publicly available tools like Cob…

Published: September 23, 2024

Linked vulnerabilities : CVE-2021-22005, CVE-2021-21972

Downloadable IOCs: 20

Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC

Earth Baxia, a suspected China-based threat actor, targeted government organizations, telecommunication businesses, and the energy industry in multiple Asia-Pacific countries. The group employed sophisticated techniques, including spear-phishing emails and exploitation of a GeoServer vulnerability …

Published: September 20, 2024

Downloadable IOCs: 29

Advanced Persistent Threat Targeting Vietnamese Human Rights Defenders

A long-term intrusion targeting a Vietnamese human rights non-profit organization has been discovered, likely spanning at least four years. The attack shows significant overlaps with techniques used by APT32/OceanLotus, a threat actor known for targeting Vietnamese activists. The intrusion involved…

Published: September 3, 2024

Downloadable IOCs: 46

The Malware That Must Not Be Named: Suspected Espionage Campaign Delivers 'Voldemort'

Proofpoint researchers uncovered an unusual campaign delivering custom malware named "Voldemort". The activity impersonated tax authorities from various countries and targeted dozens of organizations worldwide. The attack chain combines popular and uncommon techniques, including using Google Sheets…

Published: September 2, 2024

Downloadable IOCs: 27

StopRansomware: RansomHub Ransomware

RansomHub is a ransomware-as-a-service variant that has targeted over 210 victims across various critical infrastructure sectors since February 2024. It employs a double-extortion model, encrypting systems and exfiltrating data. The ransom note provides victims with a client ID and instructions to …

ransomware-as-a-service

critical-infrastructure

CVE-2020-0787

lateral-movement

Published: August 30, 2024

Linked vulnerabilities : CVE-2020-1472, CVE-2023-46604, CVE-2023-22515, CVE-2020-0787, CVE-2017-0144, CVE-2023-3519, CVE-2023-27997, CVE-2023-48788, CVE-2023-46747

Downloadable IOCs: 14

BlackSuit Ransomware

The report meticulously chronicles a sophisticated intrusion which began in December 2023 and culminated in the deployment of BlackSuit ransomware approximately 15 days later. The threat actor demonstrated an array of tactics, leveraging tools like Cobalt Strike, Sharphound, and SystemBC, alongside…

Published: August 27, 2024

Downloadable IOCs: 16

A Dive into Latest Campaign

Earth Baku, an advanced persistent threat actor, has broadened its operations from the Indo-Pacific region to Europe, the Middle East, and Africa, targeting countries like Italy, Germany, UAE, and Qatar. The group leverages public-facing applications like IIS servers as entry points, deploying soph…

Published: August 9, 2024

Downloadable IOCs: 30

Likely compromise of Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

A government-affiliated Taiwanese research institute specializing in computing technologies experienced a cyber intrusion likely carried out by the Chinese hacking group APT41. The attackers employed ShadowPad malware, Cobalt Strike, and custom tools, exploiting vulnerabilities like CVE-2018-0824 f…

Published: August 2, 2024

Linked vulnerabilities : CVE-2018-0824

Downloadable IOCs: 13

Fake update puts visitors at risk

This intelligence report discusses SocGholish, a JavaScript downloader used by threat actors to deliver malware payloads disguised as fake browser updates. It analyzes the recent tactics, techniques, and procedures employed by threat groups like Evil Corp in compromising WordPress websites, fingerp…

Published: July 24, 2024

Downloadable IOCs: 10

GrimResource - Microsoft Management Console for initial access and evasion

A novel, in-the-wild code execution technique leveraging Microsoft Management Console files (MSC) has been identified by Elastic Security researchers and was first spotted in the wild in June 2016 and is currently being investigated by VirusTotal.

Published: June 27, 2024

Downloadable IOCs: 3

Chamelgang & Friends | Cyberespionage Groups Attacking Critical Infrastructure with Ransomware

In collaboration with Recorded Future, SentinelLabs has been tracking two distinct activity clusters targeting government and critical infrastructure sectors globally between 2021 and 2023.

Published: June 26, 2024

Downloadable IOCs: 8

Attackers Exploiting Public Cobalt Strike Profiles

This report discusses recent findings of malicious Cobalt Strike infrastructure and malicious Cobalt Strike samples that leverage publicly available Malleable C2 profiles for evasion. Despite its defensive cybersecurity use, threat actors continue exploiting Cobalt Strike's malleable and evasive na…

Published: June 26, 2024

Linked vulnerabilities : CVE-2024-3400

Downloadable IOCs: 6

Dissecting SSLoad Malware: A Comprehensive Technical Analysis

This in-depth analysis explores the intricate inner workings of SSLoad, a stealthy and adaptable malware known for its sophisticated delivery methods and evasion techniques. The comprehensive investigation unravels the malware's multistage infection chain, dissecting the various loaders, decryption…

cobalt strike

ssload

2024-06-10

Published: June 10, 2024

Downloadable IOCs: 7

IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

This report details an intrusion that commenced with a spam campaign distributing a forked IcedID loader. After gaining initial access, the threat actor deployed ScreenConnect and established Cobalt Strike beacons, enabling remote command execution. They also utilized CSharp Streamer, a capable RAT…

Published: June 10, 2024

Downloadable IOCs: 33

Operation Crimson Palace: A Technical Deep Dive

Sophos Managed Detection and Response initiated a threat hunt across customers after detecting abuse of a vulnerable VMware executable. The hunt uncovered a complex, persistent cyberespionage campaign by Chinese state-sponsored actors targeting a high-profile government organization in Southeast As…

Published: June 6, 2024

Downloadable IOCs: 138

Ongoing Malvertising Campaign leads to Ransomware

Rapid7 detected an ongoing malware distribution campaign involving trojanized installers of WinSCP and PuTTY, delivered via malicious search engine ads. The infection chain employs DLL side-loading, credential access, and deploys Sliver beacons followed by Cobalt Strike. In one case, the threat act…

Published: May 15, 2024

Downloadable IOCs: 78

Leveraging DNS Tunneling for Tracking and Scanning

This article presents a case study on new applications of domain name system (DNS) tunneling PaloAlto Unit42 have found in the wild. These techniques expand beyond DNS tunneling only for command and control (C2) and virtual private network (VPN) purposes.

Published: May 13, 2024

Downloadable IOCs: 63

Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

Following the 2023 holiday season, Akamai researchers uncovered a significant amount of highly likely malicious activity and domains purporting to be associated with the United States Postal Service (USPS). Akamai researchers compared five months of DNS traffic to the legitimate domain, usps.com, w…

Published: April 29, 2024

Downloadable IOCs: 34

Uncorking Old Wine: Zero-Day from 2017 + Loader in Unholy Alliance

An analysis uncovered a suspected malicious campaign targeting entities in Ukraine. The attack employed an old vulnerability from 2017, CVE-2017-8570, as the initial entry vector. The operation utilized a customized loader to deliver the Cobalt Strike Beacon payload. While the specific threat actor…

Published: April 29, 2024

Downloadable IOCs: 6

From IcedID to Dagon Locker Ransomware in 29 Days

This intrusion started in August 2023 with a phishing campaign that distributed IcedID malware. The phishing operation utilized the Prometheus Traffic Direction System (TDS) to deliver the malware and victims were directed to a fraudulent website, mimicking an Azure download portal.

Published: April 29, 2024

Downloadable IOCs: 33

Tag: cobalt strike

Attack reports

From emerging threat to top-tier ransomware-as-a-service: The evolution of INC ransomware

Ransomware Analysis: Go Binary and Fast Encryption

Agentic AI Uncovers New China-Linked Cluster OP-512

Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability

Middle East Malicious Infrastructure Report: 1,350+ C2 Servers Mapped Across 98 Providers

Fresh mischief and digital shenanigans

Operation Dragon Whistle: UNG002 Targets Chinese Academia via Weaponized Institutional Lure

The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

Iran conflict drives heightened espionage activity against Middle East targets

Silver Dragon Targets Organizations in Southeast Asia and Europe

Nation-State Actors Exploit Notepad++ Supply Chain

The Shadow Campaigns: Uncovering Global Espionage

Notepad++ supply chain attack breakdown

The Chrysalis Backdoor: A Deep Dive into Lotus Blossom's toolkit

Can't stop, won't stop: TA584 innovates initial access

Weekly Threat Bulletin – January 28th, 2026

APT Attacks Target Indian Government Using GOGITTER, GITSHELLPAD, and GOSHELL | Part 1

Inside China's Hosting Ecosystem: 18,000+ Malware C2 Servers Mapped Across Major ISPs

Operation FrostBeacon: Multi-Cluster Cobalt Strike Campaign Targets Russia

APT24 Pivot to Multi-Vector Attacks

WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization

Malicious Infrastructure Finds Stability with aurologic GmbH

Team46 and TaxOff: Two Sides of the Same Coin

Uncovering Qilin attack methods exposed through multiple cases

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

Threat Profile: Conti Ransomware Group

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

Targets Government, Defense, and Technology Organizations

UAC-0057 Keeps Pressure on Ukraine and Poland

Pressure on Ukraine and Poland Continues

SOC files: an APT41 attack on government IT services in Africa

Threat Actor Profile: Interlock Ransomware

CrossC2 Expanding Cobalt Strike Beacon to Cross-Platform Attacks

SLOW#TEMPEST Cobalt Strike Loader

SLOW#TEMPEST Cobalt Strike Loader

Targeted attacks leverage accounts on popular online platforms as C2 servers

New Wave of SquidLoader Malware Targeting Financial Institutions

Malware Identified in Attacks Exploiting Ivanti Connect Secure Vulnerabilities

Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting

DNS: A Small but Effective C2 system

A Hybrid Approach with Data Exfiltration and Encryption

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

Custom Arsenal Developed to Target Multiple Industries

Exploits Cityworks zero-day vulnerability to deliver malware

New Nitrogen Ransomware Targets Financial Firms in the US, UK and Canada

SAP Zero – Frostbite: How Russian RaaS Actor Qilin Exploited CVE-2025-31324 Weeks Before its Public Disclosure

Modern Incident Response: Tackling Malicious ML Artifacts

Targeting Taiwan & Japan with DLL Implants

DragonForce Ransomware Gang | From Hacktivists to High Street Extortionists

Nitrogen Dropping Cobalt Strike – A Combination of 'Chemical Elements'

Finding Minhook in a sideloading attack – and Sweden too

Two sides of the same coin

Inside BRUTED: Black Basta (RaaS) Used Automated Brute Forcing Framework to Target Edge Network Devices

CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild

Operation HollowQuill: Russian R&D Networks Targeted via Decoy PDFs

Fake Zoom Ends in BlackSuit Ransomware

Unmasking the new persistent attacks on Japan

2024 Malicious Infrastructure Insights: Key Trends and Threats

Ghostwriter | New Campaign Targets Ukrainian Government and Belarusian Opposition

Trimble Cityworks: CVE-2025-0994: Active Exploitation

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware

Tracking Adversaries: Ghostwriter APT Infrastructure

APT32 Poisoning GitHub, Targeting Chinese Cybersecurity Professionals and Specific Large Enterprises

Recent Cases of Watering Hole Attacks, Part 1

The Curious Case of an Excellent Resume

Threat Assessment: Distributors of BlackSuit Ransomware

Spot the Difference: New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

EDR Bypass Testing Reveals Extortion Actor's Toolkit

Chinese Hackers Toolkit Uncovered And Activity History Uncovered

Inside the Open Directory of the “You Dun” Threat Group

Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan

New Bumblebee Loader Infection Chain Signals Possible Resurgence

No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection

Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware