Tag: confuserex

2 Attack Reports | 0 Vulnerabilities

Attack reports

New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer

Unit 42 researchers have observed changes in the distribution and obfuscation techniques of DarkCloud Stealer. The new infection chain, first seen in April 2025, involves ConfuserEx obfuscation and a final payload written in Visual Basic 6. The attack begins with a phishing email containing an arch…
obfuscation
infostealer
anti-analysis
infection chain
process hollowing
confuserex
darkcloud stealer
2025-08-07
visual basic 6
runpe
2025-08-08
Published: August 8, 2025
Downloadable IOCs: 10

Ghostwriter | New Campaign Targets Ukrainian Government and Belarusian Opposition

A new campaign attributed to the Ghostwriter threat actor has been observed targeting opposition activists in Belarus and Ukrainian military and government organizations. The operation, which began preparation in mid-2024 and entered an active phase in late 2024, employs weaponized Excel documents …
cobalt strike
ukraine
2025-02-26
confuserex
unc1151
picassoloader
uac-0057
Published: February 26, 2025
Downloadable IOCs: 10
Click here to see more Attack Reports