Tag: kongtuke

3 Attack Reports | 0 Vulnerabilities

Attack reports

The Demon Arrives Later: A Havoc Stager Hides Behind Microsoft Defender DLP

Cybercriminals in Brazil are exploiting the country's electronic invoice system (Nota Fiscal eletrônica) to deliver Havoc framework implants. The campaign surfaced during May 2026, coinciding with tax season when accountants routinely process invoice-related emails. Attackers distribute malicious Z…

brazil tax lure

invoice phishing

Published: June 3, 2026

Linked vulnerabilities : CVE-2026-45585 (CVSS 6.8)

Downloadable IOCs: 23

KongTuke FileFix Leads to New Interlock RAT Variant

A new and resilient variant of the Interlock ransomware group's remote access trojan (RAT) has been identified. This PHP-based malware, a shift from the previous JavaScript-based NodeSnake, is being used in a widespread campaign associated with the LandUpdate808 (KongTuke) web-inject threat cluster…

cloudflare tunnel

Published: July 15, 2025

Downloadable IOCs: 12

Yet Another NodeJS Backdoor (YaNB): A Modern Challenge

A resurgence in malicious campaigns exploiting deceptive CAPTCHA verifications has been observed, tricking users into executing NodeJS-based backdoors and deploying sophisticated Remote Access Trojans. The attack begins with a malicious NodeJS script connecting to attacker-controlled infrastructure…

system reconnaissance

Published: May 16, 2025

Downloadable IOCs: 11

Click here to see more Attack Reports