Tag: command and control

16 Attack Reports | 0 Vulnerabilities

Attack reports

Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics

Trend Research observed a resurgence in Lumma Stealer activity since October 20, 2025, accompanied by new behaviors and C&C techniques. The malware now employs browser fingerprinting as part of its command-and-control tactics, collecting and exfiltrating system, network, hardware, and browser data …

data exfiltration

process injection

evasion techniques

command-and-control

browser fingerprinting

cybercriminal activity

Published: November 14, 2025

Downloadable IOCs: 3

AI-Generated Code and Fake Apps Used for Far-Reaching Attacks

A new malware campaign called EvilAI is spreading globally by disguising itself as legitimate AI-enhanced productivity tools. The malware uses AI-generated code and professional interfaces to evade detection, targeting organizations across sectors like manufacturing, government, and healthcare. It …

credential theft

command and control

ai-generated code

fake applications

Published: September 12, 2025

Downloadable IOCs: 14

Backdoor in "AppSuite PDF Editor": A Detailed Technical Analysis

A detailed analysis of a malicious PDF editor application called AppSuite PDF Editor reveals it to be a sophisticated backdoor. The software, masquerading as a legitimate productivity tool, is distributed through high-ranking websites. Once installed, it creates scheduled tasks and establishes pers…

data exfiltration

command and control

scheduled tasks

browser manipulation

appsuite pdf editor

Published: August 28, 2025

Downloadable IOCs: 9

Atomic macOS Stealer includes a backdoor for persistent access

The Atomic macOS Stealer (AMOS) has received a major update, now including an embedded backdoor for persistent access to compromised Mac devices. This upgrade allows attackers to maintain access, run remote tasks, and gain extended control over infected machines. The Russia-affiliated AMOS threat g…

data exfiltration

atomic macos stealer

command-and-control

persistent access

russia-affiliated

Published: August 8, 2025

Downloadable IOCs: 6

DNS: A Small but Effective C2 system

This analysis explores the exploitation of DNS for command-and-control operations and data exfiltration. It details how cybercriminals leverage DNS tunneling to create covert communication channels, bypassing traditional security measures. The article examines various DNS tunneling families, includ…

command-and-control

dns exfiltrator

Published: July 17, 2025

Downloadable IOCs: 0

Inside a VenomRAT Malware Campaign

A malicious campaign utilizing VenomRAT, a Remote Access Trojan, is analyzed. The attackers use a fake Bitdefender download website to spread malware, including VenomRAT, StormKitty, and SilentTrinity. These tools work together to provide initial access, steal credentials, and maintain long-term hi…

credential theft

open-source malware

command and control

remote access trojan

Published: May 29, 2025

Downloadable IOCs: 35

Reborn in Rust: Attempt to thwart malware analysis

AsyncRAT, a remote access trojan known since 2019, has been rewritten in Rust, marking a shift from its original C# implementation. This change aims to complicate reverse engineering efforts due to limited analysis tool support for Rust. The malware retains its core functionality, including plugin …

command and control

remote access trojan

reverse engineering

system information

Published: May 26, 2025

Downloadable IOCs: 4

StilachiRAT analysis: From system reconnaissance to cryptocurrency theft

Microsoft Incident Response researchers discovered a novel remote access trojan named StilachiRAT, demonstrating sophisticated evasion, persistence, and data exfiltration techniques. The malware collects extensive system information, targets cryptocurrency wallet extensions, steals browser credenti…

credential theft

cryptocurrency theft

command and control

remote access trojan

system reconnaissance

Published: March 17, 2025

Linked vulnerabilities : CVE-2023-36884

Downloadable IOCs: 2

LightSpy Malware Now Targets Facebook & Instagram Data

LightSpy, a modular surveillance framework, has expanded its capabilities to target Facebook and Instagram data. The malware, initially focused on mobile devices, now compromises Windows, macOS, Linux, and routers. Recent analysis reveals a significant expansion in its command list, with over 100 c…

command and control

Published: February 21, 2025

Downloadable IOCs: 27

Operation Phantom Circuit: North Korea's Global Data Exfiltration Campaign

In December 2024, the Lazarus Group, a North Korean threat actor, launched a sophisticated global campaign targeting cryptocurrency and technology developers. The operation, code-named 'Phantom Circuit,' involved embedding malware into trusted development tools, compromising hundreds of victims wor…

data exfiltration

software supply chain

command-and-control

phantom circuit

Published: January 30, 2025

Downloadable IOCs: 13

Investigating A Web Shell Intrusion With Managed XDR

This analysis details a web shell intrusion incident where attackers exploited an IIS worker to exfiltrate data. The attacker uploaded a web shell, created a new account for persistence, modified an existing user's password, and used encoded PowerShell commands to establish a reverse TCP shell for …

privilege escalation

data exfiltration

command-and-control

reverse tcp shell

Published: January 15, 2025

Downloadable IOCs: 0

Cyberhaven’s preliminary analysis of the recent malicious Chrome extension

A phishing attack on December 24th, 2024 compromised a Cyberhaven employee's access to the Google Chrome Web Store, leading to the publication of a malicious version of their Chrome extension. This was part of a larger campaign targeting Chrome Extension developers, primarily aiming at Facebook Ads…

data exfiltration

chrome extension

command and control

Published: January 2, 2025

Downloadable IOCs: 5

Dissecting A Multi-Stage PowerShell Campaign Using Chisel

A sophisticated multi-stage PowerShell campaign has been identified, utilizing an LNK file to initiate a sequence of obfuscated scripts. The attack maintains persistence and stealth by connecting with a command-and-control server. It employs Chisel, a fast TCP/UDP tunneling tool, and a Netskope pro…

lateral movement

command-and-control

Published: November 12, 2024

Downloadable IOCs: 17

New Winos 4.0 Malware Infects Gamers Through Malicious Game Optimization Apps

A command-and-control framework called Winos 4.0 is being distributed through gaming-related applications, targeting Chinese-speaking users. The malware, rebuilt from Gh0st RAT, uses a multi-stage infection process involving fake BMP files, DLLs, and shellcode. It can harvest system information, ca…

cryptocurrency wallets

multi-stage infection

command-and-control

optimization apps

Published: November 6, 2024

Downloadable IOCs: 2

DarkComet RAT: Technical Analysis of Attack Chain

This analysis examines the Remote Access Trojan (RAT) DarkComet, detailing its capabilities, distribution methods, and technical operations. The malware alters file attributes, establishes communication with malicious domains, modifies process privileges, and gathers system information. It employs …

privilege escalation

command and control

remote access trojan

Published: October 23, 2024

Downloadable IOCs: 1

The Dark Knight Returns: Joker malware analysis

The report details sophisticated command and control (C2) techniques employed by the APT41 threat group. APT41 uses custom malware and legitimate tools to maintain persistent access to compromised networks while evading detection. Key techniques include DNS tunneling, domain fronting, and steganogr…

command and control

domain fronting

Published: October 3, 2024

Downloadable IOCs: 8

Click here to see more Attack Reports