SecuriTricks - spearphishing

Reborn in Rust: MuddyWater Evolves Tooling with RustyWater Implant

MuddyWater APT group has launched a spearphishing campaign targeting various sectors in the Middle East, including diplomatic, maritime, financial, and telecom entities. The campaign employs icon spoofing and malicious Word documents to deliver a Rust-based implant dubbed 'RustyWater'. This new too…

spearphishing

implant

Published: January 8, 2026

Downloadable IOCs: 12

Snakes by the riverbank

ESET researchers have identified new MuddyWater activity targeting organizations in Israel and Egypt. The Iran-aligned cyberespionage group deployed custom tools to improve defense evasion and persistence, including a Fooder loader to execute the MuddyViper backdoor. The campaign demonstrates a mor…

critical infrastructure

Published: December 2, 2025

Downloadable IOCs: 9

UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities

Chinese-affiliated threat actor UNC6384 is conducting a cyber espionage campaign targeting European diplomatic entities, particularly in Hungary and Belgium. The group exploits the ZDI-CAN-25373 Windows vulnerability to deliver PlugX malware through spearphishing emails with malicious LNK files. Th…

Published: October 31, 2025

Downloadable IOCs: 26

Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation

A coordinated spearphishing campaign targeted NGOs and Ukrainian government administrations involved in war relief efforts. The attack used emails impersonating the Ukrainian President's Office with weaponized PDFs, employing a fake Cloudflare captcha page to execute malware. The final payload was …

Published: October 22, 2025

Downloadable IOCs: 24

PhantomCaptcha: Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation

A coordinated spearphishing campaign targeted NGOs and Ukrainian government administrations involved in war relief efforts. The attack used emails impersonating the Ukrainian President's Office with weaponized PDFs, employing a fake Cloudflare captcha page to execute malware. The final payload was …

Published: October 22, 2025

Downloadable IOCs: 0

Going Underground: China-aligned TA415 Conducts U.S.-China Economic Relations Targeting Using VS Code Remote Tunnels

Throughout July and August 2025, TA415, a Chinese state-sponsored threat actor, conducted spearphishing campaigns targeting U.S. government, think tank, and academic organizations focused on U.S.-China relations. The group impersonated high-profile individuals and organizations to deliver an infect…

vs code remote tunnels

whirlcoil

github authentication

Published: September 17, 2025

Downloadable IOCs: 0

Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability

A zero-day vulnerability in WinRAR, CVE-2025-8088, has been discovered being exploited in the wild by the Russia-aligned group RomCom. The vulnerability allows attackers to hide malicious files in archives, which are silently deployed when extracted. The exploit was used in spearphishing campaigns …

Published: August 11, 2025

Linked vulnerabilities : CVE-2023-36884, CVE-2025-8088

Downloadable IOCs: 9

Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset

Throughout 2024, Gamaredon focused exclusively on targeting Ukrainian governmental institutions with spearphishing campaigns and weaponized USB drives. The group developed six new tools and significantly updated existing ones, improving stealth and evasion capabilities. Gamaredon increased the scal…

Published: July 4, 2025

Downloadable IOCs: 53

Snake Keylogger in Geopolitical Affairs: Abuse of Trusted Java Utilities in Cybercrime Operations

The S2 Group’s intelligence team has identified through adversary tracking a new phishing campaign by Snake Keylogger, a Russian origin stealer programmed in .NET, targeting various types of victims, such as companies, governments or individuals. The campaign has been identified as using spearphish…

Published: June 30, 2025

Downloadable IOCs: 34

Dissecting Kimsuky's Attacks on South Korea: In-Depth Analysis of GitHub-Based Malicious Infrastructure

A sophisticated spearphishing campaign targeting South Korea has been uncovered, utilizing GitHub as attack infrastructure. The threat actor, linked to the North Korean group Kimsuky, created multiple private repositories to store malware, decoy files, and exfiltrated victim data. The attack levera…

Published: June 26, 2025

Downloadable IOCs: 16

Unmasking the Infrastructure of a Spear‑phishing Campaign

Censys researchers uncovered a spear‑phishing campaign where threat actors leveraged a cluster of 16 open directories hosting heavily obfuscated Visual Basic Script (VBS) files. The study analyzes how attackers set up these public-accessible directories to store malicious scripts, the obfuscation t…

Published: June 11, 2025

Downloadable IOCs: 54

UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign

A spear phishing campaign targeting Polish entities has been observed, exploiting the CVE-2024-42009 vulnerability in Roundcube to steal user credentials. The campaign, attributed to UNC1151, involves sending emails with malicious JavaScript that installs a Service Worker in the victim's browser. T…

spearphishing

poland

credential theft

vulnerability exploitation

Published: June 5, 2025

Linked vulnerabilities : CVE-2024-42009, CVE-2025-49113 (CVSS 9.9)

Downloadable IOCs: 3

RedDelta: Chinese State-Sponsored Group Targets Mongolia, Taiwan, and Southeast Asia with Evolving Cyber Threats

Between July 2023 and December 2024, the Chinese state-sponsored group RedDelta targeted Mongolia, Taiwan, and Southeast Asian countries with an adapted infection chain to distribute its customized PlugX backdoor. The group used themed lure documents and evolved its tactics, transitioning from Wind…

Published: January 9, 2025

Downloadable IOCs: 259

Leveraging Cloudflare Tunnels for GammaDrop Infrastructure

BlueAlpha, a Russian state-sponsored cyber threat group, has evolved its malware delivery tactics by exploiting Cloudflare Tunnels to conceal GammaDrop staging infrastructure. The group employs HTML smuggling with sophisticated modifications to bypass email security systems and uses DNS fast-fluxin…

obfuscation techniques

gammaload

cloudflare tunnels

russian state-sponsored

dns fast-fluxing

Published: December 5, 2024

Downloadable IOCs: 1

BlueAlpha Abuses Cloudflare Tunneling Service for GammaDrop Staging Infrastructure

BlueAlpha, a Russian state-sponsored cyber threat group, has evolved its malware delivery tactics by exploiting Cloudflare Tunnels to conceal GammaDrop staging infrastructure. The group employs HTML smuggling with sophisticated modifications to bypass email security systems and uses DNS fast-fluxin…

obfuscation techniques

gammaload

cloudflare tunnels

russian state-sponsored

dns fast-fluxing

Published: December 5, 2024

Downloadable IOCs: 0

HawkEye Malware: Technical Analysis

HawkEye, also known as PredatorPain, is a long-lived keylogger malware that has evolved to include stealer capabilities. Originating before 2010, it gained popularity in 2013 through spearphishing campaigns. The malware is typically delivered via phishing emails or compromised websites, and utilize…

Published: November 13, 2024

Downloadable IOCs: 4

Malicious Inauthentic Falcon Crash Reporter Installer Distributed to German Entity

On July 24, 2024, CrowdStrike Intelligence identified an unattributed spearphishing attempt delivering an inauthentic installer impersonating CrowdStrike's Crash Reporter through a website targeting a German entity. The site utilized JavaScript obfuscation to deliver the malicious installer, which …

Published: July 31, 2024

Downloadable IOCs: 5

Tag: spearphishing

Attack reports

Reborn in Rust: MuddyWater Evolves Tooling with RustyWater Implant

Snakes by the riverbank

UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities

Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation

PhantomCaptcha: Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation

Going Underground: China-aligned TA415 Conducts U.S.-China Economic Relations Targeting Using VS Code Remote Tunnels

Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability

Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset

Snake Keylogger in Geopolitical Affairs: Abuse of Trusted Java Utilities in Cybercrime Operations

Dissecting Kimsuky's Attacks on South Korea: In-Depth Analysis of GitHub-Based Malicious Infrastructure

Unmasking the Infrastructure of a Spear‑phishing Campaign

UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign

Operation RoundPress targeting high-value webmail servers

Weaponized Words: Uyghur Language Software Hijacked to Deliver Malware

YouTube Creators Under Siege Again: Clickflix Technique Fuels Malware Attacks

Operation AkaiRyū: Europe invited to Expo 2025 and ANEL backdoor revived

Targeting of freelance developers

RedDelta: Chinese State-Sponsored Group Targets Mongolia, Taiwan, and Southeast Asia with Evolving Cyber Threats

Leveraging Cloudflare Tunnels for GammaDrop Infrastructure

BlueAlpha Abuses Cloudflare Tunneling Service for GammaDrop Staging Infrastructure

HawkEye Malware: Technical Analysis

Malicious Inauthentic Falcon Crash Reporter Installer Distributed to German Entity