Tag: dll injection

3 Attack Reports | 0 Vulnerabilities

Attack reports

Operation BarrelFire: Targeting Kazakhstan Oil & Gas

A threat group dubbed NoisyBear has been targeting Kazakhstan's oil and gas sector since April 2025. The campaign focuses on KazMunaiGas employees, using spear-phishing emails with malicious attachments. The infection chain involves a ZIP file containing a malicious LNK file and decoy document, whi…
powershell
infrastructure
spear-phishing
kazakhstan
central asia
russian threat actor
dll injection
amsi bypass
oil and gas
2025-09-04
2025-09-05
downshell
Published: September 5, 2025
Downloadable IOCs: 14

TINKYWINKEY KEYLOGGER

TinkyWinkey is a sophisticated Windows-based keylogger that combines persistent service execution, low-level keyboard hooks, and comprehensive system profiling. It captures all keystrokes, including special keys and multi-language input, alongside detailed system metrics such as CPU, memory, OS ver…
windows
persistence
service
keylogger
stealth
dll injection
2025-09-01
system profiling
tinkywinkey
Published: September 1, 2025
Downloadable IOCs: 3

LegionLoader exposed!

LegionLoader, also known as Satacom, CurlyGate, and RobotDropper, is an active downloader malware that has gained significant traction recently, amassing over 2,000 samples in weeks. The campaign appears to have started on December 19, 2024, with Brazil being the most affected country. The malware …
brazil
downloader
drive-by download
anti-sandbox
msi
multi-stage
legionloader
robotdropper
2025-02-10
satacom
dll injection
curlygate
Published: February 10, 2025
Downloadable IOCs: 108
Click here to see more Attack Reports