SecuriTricks - process injection

Reloaded in a modern Remcos RAT Infection

Analysts discovered a new Remcos RAT infection chain starting with a batch file executing encoded commands that creates hidden directories and retrieves encrypted payloads. Unlike earlier campaigns relying on PowerShell-hosted .NET loaders, this variant incorporates DonutLoader shellcode and AutoIt…

phishing

shellcode

Published: May 30, 2026

Downloadable IOCs: 4

Using KATA and KEDR to detect the AdaptixC2 agent

AdaptixC2 is an emerging open-source post-exploitation framework rapidly adopted by threat actors in APT attacks and ransomware campaigns. Written in Go and C++, it supports Windows, macOS, and Linux with extensive modularity through Beacon Object Files (BOFs). The framework enables diverse command…

credential harvesting

post-exploitation framework

Published: April 17, 2026

Downloadable IOCs: 0

From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere

Multiple campaigns are distributing NWHStealer through diverse delivery methods including fake VPN downloads, hardware utilities, and gaming modifications. The malware collects browser data, saved passwords, and cryptocurrency wallet information. Distribution occurs via fake websites impersonating …

cryptocurrency wallet theft

fake vpn

Published: April 17, 2026

Downloadable IOCs: 3

How ClickFix Opens the Door to Stealthy StealC Information Stealer

This analysis examines a sophisticated attack chain targeting Windows systems through social engineering. It uses fake CAPTCHA verification pages to trick users into executing malicious PowerShell commands. The multi-stage infection process ultimately deploys the StealC information stealer, a commo…

multi-stage infection

fileless execution

2026-02-17

Published: February 17, 2026

Downloadable IOCs: 9

The game is over: when “free” comes at too high a price. What we know about RenEngine

A widespread campaign is distributing the RenEngine loader malware disguised as pirated games and software. The loader uses a modified Ren'Py game engine to deliver payloads like Lumma and ACR stealers. It employs sophisticated techniques including sandbox evasion, process injection, and modular de…

Published: February 11, 2026

Downloadable IOCs: 0

Operation DupeHike: Targeting Russian employees with DUPERUNNER and AdaptixC2

A campaign targeting Russian corporate entities, particularly HR, payroll, and administrative departments, has been uncovered. The attack uses realistic decoy documents themed around employee bonuses and financial policies. The malware ecosystem involves a malicious LNK file leading to an implant d…

Published: December 3, 2025

Downloadable IOCs: 12

Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics

Trend Research observed a resurgence in Lumma Stealer activity since October 20, 2025, accompanied by new behaviors and C&C techniques. The malware now employs browser fingerprinting as part of its command-and-control tactics, collecting and exfiltrating system, network, hardware, and browser data …

browser fingerprinting

2025-11-14

cybercriminal activity

Published: November 14, 2025

Downloadable IOCs: 3

Getting to the Crux (Ransomware) of the Matter

A new ransomware variant named Crux has been identified, claiming association with the BlackByte group. Observed in three separate incidents, Crux encrypts files with a .crux extension and leaves ransom notes. Initial access appears to involve Remote Desktop Protocol (RDP) using valid credentials. …

Published: July 21, 2025

Downloadable IOCs: 3

macOS NimDoor | North Korean Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware

DPRK threat actors are targeting Web3 and crypto-related businesses using Nim-compiled binaries and multiple attack chains. The malware, dubbed NimDoor, employs unusual techniques for macOS, including process injection and encrypted WebSocket communications. It uses a novel persistence mechanism le…

Published: July 4, 2025

Downloadable IOCs: 9

Malware Analysis Report: UMBRELLA STAND - Malware targeting Fortinet devices

UMBRELLA STAND is a sophisticated malware targeting FortiGate 100D series firewalls produced by Fortinet. It contains remote shell execution functionality, configurable beacon frequency, and AES-encrypted C2 communications. The malware uses fake TLS on port 443 to beacon to its C2 server and has th…

Published: June 23, 2025

Downloadable IOCs: 11

Inside the BlueNoroff Web3 macOS Intrusion Analysis

A detailed analysis of a sophisticated intrusion targeting a cryptocurrency foundation employee is presented. The attack, attributed to the North Korean APT group BlueNoroff, began with a social engineering lure via Telegram, leading to the installation of malicious software disguised as a Zoom ext…

Published: June 19, 2025

Downloadable IOCs: 18

Threat Actors are Targeting US Tax-Session with new Tactics of Stealerium-infostealer

Cybercriminals are exploiting the US tax season to deploy Stealerium malware, targeting citizens through sophisticated phishing campaigns. The attack utilizes deceptive email attachments with malicious LNK files, leading to the execution of PowerShell scripts and the download of a PyInstaller-packa…

Published: April 30, 2025

Downloadable IOCs: 0

Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers

Mandiant discovered China-nexus espionage group UNC3886 deploying custom backdoors on Juniper Networks' Junos OS routers in mid-2024. The actor used TINYSHELL-based backdoors with various capabilities, including active and passive functions and log disabling. UNC3886 demonstrated advanced system kn…

network infrastructure

Published: April 11, 2025

Linked vulnerabilities : CVE-2025-21590 (CVSS 4.4), CVE-2022-41328, CVE-2025-22457 (CVSS 9.0)

Downloadable IOCs: 14

Tag: process injection

Attack reports

Reloaded in a modern Remcos RAT Infection

Using KATA and KEDR to detect the AdaptixC2 agent

From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere

How ClickFix Opens the Door to Stealthy StealC Information Stealer

The game is over: when “free” comes at too high a price. What we know about RenEngine

Operation DupeHike: Targeting Russian employees with DUPERUNNER and AdaptixC2

Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics

Getting to the Crux (Ransomware) of the Matter

macOS NimDoor | North Korean Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware

Malware Analysis Report: UMBRELLA STAND - Malware targeting Fortinet devices

Inside the BlueNoroff Web3 macOS Intrusion Analysis

Threat Actors are Targeting US Tax-Session with new Tactics of Stealerium-infostealer

Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers

AsyncRAT Reloaded: Using Python and TryCloudflare for Malware Delivery Again

Technical Analysis of Xloader Versions 6 and 7

End-of-Year PTO: Days Off and Data Exfiltration with Formbook

Threat Actor Targets Manufacturing Industry With Malware

XWorm: Analysis of Latest Version and Execution Flow

Deep Analysis of Snake Keylogger’s New Variant