Tag: rc4 encryption

4 Attack Reports | 0 Vulnerabilities

Attack reports

Obfuscation Without Effort: Breaking a GIFTEDCROOK Stealer

A fresh GIFTEDCROOK stealer variant was identified as part of a UAC-0226 campaign targeting Ukraine. Initial access leverages CVE-2025-6218 and CVE-2025-8088 through a weaponized RAR archive containing a decoy PDF themed around military registry information. The attack chain uses an LNK file to exe…

data exfiltration

phishing campaign

powershell payload

ukraine targeting

winrar exploitation

Published: April 13, 2026

Linked vulnerabilities : CVE-2025-8088, CVE-2025-6218

Downloadable IOCs: 4

The Latest PlugX Variant Executed by STATICPLUGIN

In January 2026, a new variant of the PlugX malware was observed being used in targeted attacks. Analysis suggests involvement of the UNC6384 APT group, linked to Mustang Panda, targeting government agencies in Southeast Asia. The malware uses a browser updater disguise to download and execute a ma…

dll-sideloading

targeted-attack

Published: February 25, 2026

Downloadable IOCs: 11

Analysis of the latest Mirai wave exploiting TBK DVR devices with CVE-2024-3721

A new wave of Mirai botnet attacks is exploiting CVE-2024-3721 to target TBK DVR devices. The campaign uses a POST request to execute system commands without authorization, downloading and running an ARM32 binary. This Mirai variant includes features like RC4 string encryption, anti-VM checks, and …

Published: June 6, 2025

Downloadable IOCs: 17

I StealC You: Tracking the Rapid Changes To Steal

StealC V2, introduced in March 2025, is an enhanced version of the popular information stealer and malware downloader. Key updates include a streamlined JSON-based C2 communication protocol with RC4 encryption, expanded payload delivery options (MSI packages and PowerShell scripts), and a redesigne…

credential harvesting

information stealer

Published: May 2, 2025

Downloadable IOCs: 0

Click here to see more Attack Reports