SecuriTricks - evasion

From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery

Check Point Research uncovered a malware campaign exploiting expired Discord invite links to redirect users to malicious servers. The attackers use a combination of techniques including ClickFix phishing, multi-stage loaders, and time-based evasions to deliver AsyncRAT and a customized Skuld Steale…

phishing

evasion

Published: June 13, 2025

Downloadable IOCs: 0

Beware of AI Pickpockets: Pickai Backdoor Spreading Through ComfyUI Vulnerability

A new backdoor named Pickai is exploiting ComfyUI vulnerabilities to spread and steal sensitive AI data. Developed in C++, Pickai offers remote command execution and reverse shell capabilities with strong persistence and evasion techniques. It uses multiple C2 servers for redundancy and has infecte…

Published: June 13, 2025

Downloadable IOCs: 9

RHADAMANTHYS: In-Depth Analysis of a Sophisticated Stealer Targeting Israeli Users

This comprehensive technical analysis delves into the intricate workings of an advanced and localized malware campaign employing the RHADAMANTHYS stealer. Dissecting the infection chain, anti-analysis techniques, data theft capabilities, and Command & Control infrastructure, this detailed report sh…

Published: August 5, 2024

Downloadable IOCs: 5

Introducing Gh0stGambit: A Dropper for Deploying Gh0st RAT

This analysis examines a recent malware campaign involving a dropper dubbed Gh0stGambit, which is employed to retrieve and execute encrypted payloads, specifically a variant of the notorious Gh0st Remote Access Trojan (RAT). The report details the multi-stage infection process, including the use of…

Published: July 31, 2024

Linked vulnerabilities : CVE-2024-5806 (CVSS 7.4)

Downloadable IOCs: 6

Exploiting CVE-2024-21412: A Stealer Campaign Unleashed

This report details a malicious campaign exploiting the CVE-2024-21412 vulnerability in Microsoft Windows SmartScreen to bypass security warnings and deliver malware. Attackers employ crafted links, LNK files, and HTA scripts to download decoy PDFs and shell code injectors, ultimately injecting ste…

Published: July 24, 2024

Linked vulnerabilities : CVE-2024-21412

Downloadable IOCs: 27

MoonWalk

This blog post examines MoonWalk, a new backdoor employed by APT41, a China-based threat actor known for campaigns in Southeast Asia. MoonWalk utilizes numerous evasion techniques, including DLL hollowing, call stack spoofing, and the abuse of Windows Fibers to evade security solutions. It also lev…

Published: July 12, 2024

Downloadable IOCs: 3

DodgeBox: A deep dive into the updated arsenal of APT41

This blog post provides an in-depth technical analysis of a newly discovered malware loader called DodgeBox, which is attributed to the China-based advanced persistent threat (APT) actor APT41. DodgeBox incorporates various evasion techniques such as call stack spoofing, DLL sideloading, DLL hollow…

Published: July 11, 2024

Downloadable IOCs: 1

Turla: A Master of Deception

This report details a recent campaign by the Turla threat group involving malicious LNK files that deliver a fileless backdoor. The attack leverages compromised websites, PowerShell scripts, and MSBuild to deploy the payload, which employs various evasion techniques like disabling security features…

Published: July 8, 2024

Downloadable IOCs: 10

Dissecting GootLoader With Node.js

This article demonstrates how to circumvent anti-analysis techniques employed by GootLoader malware while utilizing Node.js debugging in Visual Studio Code. GootLoader JavaScript files employ an evasion technique that can pose a formidable challenge for sandboxes attempting to analyze the malware. …

Published: July 4, 2024

Downloadable IOCs: 2

Attackers Exploiting Public Cobalt Strike Profiles

This report discusses recent findings of malicious Cobalt Strike infrastructure and malicious Cobalt Strike samples that leverage publicly available Malleable C2 profiles for evasion. Despite its defensive cybersecurity use, threat actors continue exploiting Cobalt Strike's malleable and evasive na…

Published: June 26, 2024

Linked vulnerabilities : CVE-2024-3400

Downloadable IOCs: 6

Malware Targets Message Queuing Services Applications

The report describes a recent campaign targeting Apache RocketMQ platforms, where attackers exploited a known vulnerability (CVE-2023-33246) to gain remote code execution on the systems. They then downloaded and executed the Muhstik malware, which provides persistence, evades detection, performs la…

Published: June 6, 2024

Linked vulnerabilities : CVE-2023-33246

Downloadable IOCs: 21

Excel File Deploys Cobalt Strike at Ukraine

A sophisticated multi-stage cyberattack was identified, utilizing an Excel file embedded with a VBA macro designed to deploy a DLL file. The attacker employed various evasion techniques and a multi-stage malware strategy to deliver the notorious 'Cobalt Strike' payload, establishing communication w…

Published: June 4, 2024

Downloadable IOCs: 10

Distribution of Malware Under the Guise of MS Office Cracked Versions (XMRig, OrcusRAT, etc.)

The report analyzes a campaign where threat actors distribute various malware strains like RATs, coinminers, and loaders disguised as cracked versions of popular software. South Korean systems are heavily targeted, with malware persisting via scheduled tasks and evading security products. Detailed …

Published: May 30, 2024

Downloadable IOCs: 11

Cyberespionage Group Earth Hundun's Continuous Refinement of Waterbear and Deuterbear

This comprehensive analysis delves into the continuous evolution and refinement of sophisticated malware entities employed by a persistent cyberespionage group targeting organizations in the Asia-Pacific region. The malware, known as Waterbear and its latest iteration, Deuterbear, have undergone si…

Published: May 21, 2024

Downloadable IOCs: 29

Distribution of DanaBot Malware via Word Files Detected

This analysis examines the infection process of the DanaBot malware, distributed through sophisticated spam emails containing malicious Word documents. The documents leverage external links to download and execute macro files, which subsequently fetch and run the DanaBot payload. The infection chai…

Published: May 14, 2024

Downloadable IOCs: 0

Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four

This comprehensive analysis provides a thorough examination of the REMCOS Remote Access Trojan (RAT), a prominent malware threat that gained significant prevalence in 2024. The analysis delves into the malware's configuration structure, command and control capabilities, persistence mechanisms, and …

Published: May 9, 2024

Downloadable IOCs: 34

HijackLoader Updates

HijackLoader, also known as IDAT Loader, is a modular malware loader capable of executing multiple payloads. It utilizes a variety of modules for code injection, execution, and evasion techniques. This report analyzes the updated version of HijackLoader, which includes new modules for bypassing Win…

Published: May 7, 2024

Downloadable IOCs: 11

macOS Adload Pivots Just Days After Apple’s XProtect Clampdown

The report analyzes a new variant of the Adload adware that evades Apple's recent XProtect malware signature updates. Despite Apple adding 74 new rules targeting Adload in XProtect version 2192, the adware authors have rapidly modified their code to bypass these detections. The report examines a sp…

Published: May 1, 2024

Downloadable IOCs: 11

Tag: evasion

Attack reports

From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery

Beware of AI Pickpockets: Pickai Backdoor Spreading Through ComfyUI Vulnerability

Excel(ent) Obfuscation: Regex Gone Rogue

Agenda Ransomware Group Adds SmokeLoader and NETXLOADER to Their Arsenal

Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims

Outlaw cybergang attacking targets worldwide

New HijackLoader Evasion Tactics

GorillaBot: Technical Analysis and Code Similarities with Mirai

Weaver Ant, the Web Shell Whisperer: Tracking a China-Nexus Cyber Operation

Stopping Sobolan Malware with Aqua Runtime Protection

Auto-Color: An Emerging and Evasive Linux Backdoor

XWorm Cocktail: A Mix of PE data with PowerShell Code

Vgod RANSOMWARE

New TorNet backdoor seen in widespread campaign

Malware Analysis: A Kernel Land Rootkit Loader for FK_Undead

Iranian Dream Job campaign

WINELOADER Analysis

Threat actors use copyright infringement phishing lure to deploy infostealers

ValleyRAT Insights: Tactics, Techniques, and Detection Methods

DarkComet RAT: Technical Analysis of Attack Chain

New wave of Bumblebee malware attacks warned

Attackers Target Exposed Docker Remote API Servers With perfctl Malware

The New Malware Distribution Service

CoreWarrior Spreader Malware Surge

perfctl: A Stealthy Malware Targeting Millions of Linux Servers

The Dark Knight Returns: Joker malware analysis

Gomorrah Stealer: An In-Depth Analysis of a .NET-Based Malware

A glimpse into the next moves and associated botnets

A glimpse into the Quad7 operators’ next moves and associated botnets

Threat Actors Target the Middle East Using Fake Palo Alto GlobalProtect Tool

Sophisticated Malware Campaign Targets Czech Officials Using NATO-Themed Decoys

Unveiling sedexp: A Stealthy Linux Malware Exploiting udev Rules

Campaign uses infostealers and clippers for financial gain

Threat Actors’ Toolkit: Leveraging Sliver, PoshC2 & Batch Scripts

RHADAMANTHYS: In-Depth Analysis of a Sophisticated Stealer Targeting Israeli Users

Introducing Gh0stGambit: A Dropper for Deploying Gh0st RAT

Exploiting CVE-2024-21412: A Stealer Campaign Unleashed

MoonWalk

DodgeBox: A deep dive into the updated arsenal of APT41

Turla: A Master of Deception

Dissecting GootLoader With Node.js

Attackers Exploiting Public Cobalt Strike Profiles

Malware Targets Message Queuing Services Applications

Excel File Deploys Cobalt Strike at Ukraine

Distribution of Malware Under the Guise of MS Office Cracked Versions (XMRig, OrcusRAT, etc.)

Cyberespionage Group Earth Hundun's Continuous Refinement of Waterbear and Deuterbear

Distribution of DanaBot Malware via Word Files Detected

Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four

HijackLoader Updates

macOS Adload Pivots Just Days After Apple’s XProtect Clampdown