Tag: syscall

2 Attack Reports | 0 Vulnerabilities

Attack reports

Direct-Sys Loader and CGrabber Stealer Five-Stage Malware Chain

A sophisticated five-stage malware operation delivers two new malware families: Direct-Sys Loader and CGrabber Stealer. The attack begins with ZIP archives distributed via GitHub user attachment URLs, exploiting a legitimate Microsoft-signed binary (Launcher_x64.exe) for DLL sideloading. Direct-Sys…

dll sideloading

information stealer

cryptocurrency theft

cgrabber stealer

direct-sys loader

github distribution

Published: April 17, 2026

Downloadable IOCs: 91

APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

Pakistan-linked APT36 (Transparent Tribe) launched a new cyber-espionage campaign targeting Indian government and defense entities. Active in August 2025, the group used phishing ZIP files containing malicious Linux “.desktop” shortcuts that downloaded payloads from Google Drive.

Published: August 21, 2025

Downloadable IOCs: 6

Click here to see more Attack Reports