SecuriTricks - process injection

Operation DupeHike: Targeting Russian employees with DUPERUNNER and AdaptixC2

A campaign targeting Russian corporate entities, particularly HR, payroll, and administrative departments, has been uncovered. The attack uses realistic decoy documents themed around employee bonuses and financial policies. The malware ecosystem involves a malicious LNK file leading to an implant d…

process injection

c2 communication

Published: December 3, 2025

Downloadable IOCs: 12

Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics

Trend Research observed a resurgence in Lumma Stealer activity since October 20, 2025, accompanied by new behaviors and C&C techniques. The malware now employs browser fingerprinting as part of its command-and-control tactics, collecting and exfiltrating system, network, hardware, and browser data …

browser fingerprinting

2025-11-14

cybercriminal activity

Published: November 14, 2025

Downloadable IOCs: 3

Getting to the Crux (Ransomware) of the Matter

A new ransomware variant named Crux has been identified, claiming association with the BlackByte group. Observed in three separate incidents, Crux encrypts files with a .crux extension and leaves ransom notes. Initial access appears to involve Remote Desktop Protocol (RDP) using valid credentials. …

Published: July 21, 2025

Downloadable IOCs: 3

macOS NimDoor | North Korean Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware

DPRK threat actors are targeting Web3 and crypto-related businesses using Nim-compiled binaries and multiple attack chains. The malware, dubbed NimDoor, employs unusual techniques for macOS, including process injection and encrypted WebSocket communications. It uses a novel persistence mechanism le…

Published: July 4, 2025

Downloadable IOCs: 9

Malware Analysis Report: UMBRELLA STAND - Malware targeting Fortinet devices

UMBRELLA STAND is a sophisticated malware targeting FortiGate 100D series firewalls produced by Fortinet. It contains remote shell execution functionality, configurable beacon frequency, and AES-encrypted C2 communications. The malware uses fake TLS on port 443 to beacon to its C2 server and has th…

Published: June 23, 2025

Downloadable IOCs: 11

Inside the BlueNoroff Web3 macOS Intrusion Analysis

A detailed analysis of a sophisticated intrusion targeting a cryptocurrency foundation employee is presented. The attack, attributed to the North Korean APT group BlueNoroff, began with a social engineering lure via Telegram, leading to the installation of malicious software disguised as a Zoom ext…

Published: June 19, 2025

Downloadable IOCs: 18

Threat Actors are Targeting US Tax-Session with new Tactics of Stealerium-infostealer

Cybercriminals are exploiting the US tax season to deploy Stealerium malware, targeting citizens through sophisticated phishing campaigns. The attack utilizes deceptive email attachments with malicious LNK files, leading to the execution of PowerShell scripts and the download of a PyInstaller-packa…

Published: April 30, 2025

Downloadable IOCs: 0

Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers

Mandiant discovered China-nexus espionage group UNC3886 deploying custom backdoors on Juniper Networks' Junos OS routers in mid-2024. The actor used TINYSHELL-based backdoors with various capabilities, including active and passive functions and log disabling. UNC3886 demonstrated advanced system kn…

network infrastructure

Published: April 11, 2025

Linked vulnerabilities : CVE-2025-21590 (CVSS 4.4), CVE-2022-41328, CVE-2025-22457 (CVSS 9.0)

Downloadable IOCs: 14

Tag: process injection

Attack reports

Operation DupeHike: Targeting Russian employees with DUPERUNNER and AdaptixC2

Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics

Getting to the Crux (Ransomware) of the Matter

macOS NimDoor | North Korean Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware

Malware Analysis Report: UMBRELLA STAND - Malware targeting Fortinet devices

Inside the BlueNoroff Web3 macOS Intrusion Analysis

Threat Actors are Targeting US Tax-Session with new Tactics of Stealerium-infostealer

Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers

AsyncRAT Reloaded: Using Python and TryCloudflare for Malware Delivery Again

Technical Analysis of Xloader Versions 6 and 7

End-of-Year PTO: Days Off and Data Exfiltration with Formbook

Threat Actor Targets Manufacturing Industry With Malware

XWorm: Analysis of Latest Version and Execution Flow

Deep Analysis of Snake Keylogger’s New Variant