Tag: memory-resident malware

1 Attack Reports | 0 Vulnerabilities

Attack reports

NSIS Abuse and sRDI Shellcode: Anatomy of the Winos 4.0 Campaign

A malware campaign using fake software installers to deliver Winos v4.0, a memory-resident malware, has been tracked throughout 2025. The campaign, dubbed Catena, employs trojanized NSIS installers, reflective DLL loading, and shellcode-embedded INI files to evade detection. It stages payloads enti…
nsis
winos
chinese-speaking targets
2025-05-27
srdi
memory-resident malware
winos v4.0
catena loader
reflective dll injection
trojanized installers
Published: May 27, 2025
Downloadable IOCs: 31
Click here to see more Attack Reports