SecuriTricks - stealth

DeerStealer Malware Campaign: Stealth, Persistence, and Rootkit-Like Capabilities

DeerStealer is a sophisticated information-stealing malware that targets a wide range of user and system data. It employs deception techniques, persistence mechanisms, and rootkit-like capabilities to evade detection and maintain stealth on compromised systems. The malware uses signed executables, …

rootkit

persistence

multi-stage-execution

xfiles spyware

Published: September 20, 2025

Downloadable IOCs: 0

TINKYWINKEY KEYLOGGER

TinkyWinkey is a sophisticated Windows-based keylogger that combines persistent service execution, low-level keyboard hooks, and comprehensive system profiling. It captures all keystrokes, including special keys and multi-language input, alongside detailed system metrics such as CPU, memory, OS ver…

Published: September 1, 2025

Downloadable IOCs: 3

The Covert Dual-Mode Backdoor Threat

MystRodX is a sophisticated backdoor discovered in June 2025, featuring stealth and flexibility. It uses multi-layer encryption for sensitive information and can operate in active or passive modes. The backdoor supports file management, port forwarding, reverse shell, and socket management. Its pas…

dual-process guardian

dns trigger

passive mode

Published: August 28, 2025

Downloadable IOCs: 12

APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

Pakistan-linked APT36 (Transparent Tribe) launched a new cyber-espionage campaign targeting Indian government and defense entities. Active in August 2025, the group used phishing ZIP files containing malicious Linux “.desktop” shortcuts that downloaded payloads from Google Drive.

Published: August 21, 2025

Downloadable IOCs: 6

GreyNoise Discovers Stealthy Backdoor Campaign Affecting Thousands of ASUS Routers

A sophisticated campaign targeting ASUS routers has been uncovered, compromising thousands of devices. The attackers employ brute-force attempts, authentication bypasses, and exploit CVE-2023-39780 to gain initial access. They establish persistence by enabling SSH access on a custom port and insert…

authentication bypass

Published: June 4, 2025

Downloadable IOCs: 3

New Bumblebee Loader Infection Chain Signals Possible Resurgence

A new infection chain for the Bumblebee loader malware has been discovered, potentially indicating its resurgence after Operation Endgame. The sophisticated downloader, first identified in March 2022, is used by cybercriminals to access corporate networks and deliver payloads like Cobalt Strike bea…

Published: October 21, 2024

Downloadable IOCs: 11

Technical Analysis of a Novel IMEEX Framework

The IMEEX framework is a newly discovered, custom-built malware targeting Windows systems. Delivered as a 64-bit DLL, it offers extensive control over compromised machines, featuring execution of additional modules, file manipulation, process management, registry modification, and remote command ex…

Published: October 14, 2024

Downloadable IOCs: 9

From Perfctl to InfoStealer

A new stealthy Linux malware called perfctl has been analyzed. The malware runs two processes: perfctl and a disguised process mimicking known Linux processes. It uses Tor for external communications and local sockets for inter-process communication. After 30 minutes, the attacker drops scripts to …

Published: October 9, 2024

Downloadable IOCs: 3

A glimpse into the next moves and associated botnets

The report provides insights into the evolving tactics and infrastructure of a threat group referred to as the 'Quad7 botnet operators.' It details the discovery of new staging servers, implants, and botnet clusters associated with this group. The operators appear to be compromising various router …

Published: September 10, 2024

Downloadable IOCs: 11

A glimpse into the Quad7 operators’ next moves and associated botnets

The report provides insights into the evolving tactics and infrastructure of a threat group referred to as the 'Quad7 botnet operators.' It details the discovery of new staging servers, implants, and botnet clusters associated with this group. The operators appear to be compromising various router …

Published: September 10, 2024

Downloadable IOCs: 0

Tag: stealth

Attack reports

CrySome RAT : An Advanced Persistent .NET Remote Access Trojan

Illuminating VoidLink: Technical analysis of the VoidLink rootkit framework

Cryptojacking Campaign Exploits Driver to Boost Monero Mining

VoidLink threat analysis: C2-compiled kernel rootkits discovered

Command & Evade: Turla's Kazuar v3 Loader

The Cloud-Native Malware Framework

DPRK's Playbook: HttpTroy and New BLINDINGCAN Variant

Hidden WordPress Backdoors Creating Admin Accounts

DeerStealer Malware Campaign: Stealth, Persistence, and Rootkit-Like Capabilities

TINKYWINKEY KEYLOGGER

The Covert Dual-Mode Backdoor Threat

APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

GreyNoise Discovers Stealthy Backdoor Campaign Affecting Thousands of ASUS Routers

New Bumblebee Loader Infection Chain Signals Possible Resurgence

Technical Analysis of a Novel IMEEX Framework

From Perfctl to InfoStealer

A glimpse into the next moves and associated botnets

A glimpse into the Quad7 operators’ next moves and associated botnets