SecuriTricks - telegram

UNG0801: Tracking Threat Clusters obsessed with AV Icon Spoofing targeting Israel

An analysis of threat clusters, dubbed UNG0801 or Operation IconCat, targeting Israeli organizations. The actors use socially engineered phishing lures in Hebrew, exploiting antivirus icon spoofing from well-known vendors like SentinelOne and Check Point. Two distinct infection chains were identifi…

phishing

dropbox

Published: December 22, 2025

Downloadable IOCs: 7

Technical Analysis of the BlackForce Phishing Kit

The BlackForce phishing kit, first observed in August 2025, has evolved through multiple versions and is capable of stealing credentials and performing Man-in-the-Browser attacks to bypass multi-factor authentication. It impersonates various brands and uses sophisticated evasion techniques, includi…

Published: December 12, 2025

Downloadable IOCs: 0

New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2

Kaspersky researchers uncovered new malicious operations by the Tomiris threat actor targeting foreign ministries, intergovernmental organizations, and government entities. The attacks, which began in early 2025, show a shift in tactics with increased use of implants leveraging public services like…

tomiris powershell telegram backdoor

multi-language malware

tomiris c# reverseshell

tomiris c/c++ reverseshell

tomiris python telegram reverseshell

reverse shells

tomiris python discord reverseshell

tomiris c# telegram reverseshell

tomiris rust downloader

tomiris python filegrabber

distopia backdoor

tomiris go reversesocks

tomiris go reverseshell

tomiris rust reverseshell

tomiris c++ reversesocks

Published: November 28, 2025

Downloadable IOCs: 66

Operation Dragon Breath (APT-Q-27): Dimensional Reduction Attack Against the Gambling Industry

A threat group known as Golden Eye Dog (APT-Q-27) has been targeting individuals involved in gambling and related activities in Southeast Asia, as well as overseas Chinese communities. The group's operations include remote control, cryptocurrency mining, DDoS attacks, and traffic-related activities…

Published: November 5, 2025

Downloadable IOCs: 0

New Python RAT Targets Gamers via Minecraft

A new multi-function Python RAT has been discovered targeting gamers through Minecraft. The malware, posing as a legitimate Minecraft client called 'Nursultan Client', uses the Telegram Bot API for command and control. It has capabilities including screenshot capture, webcam access, Discord token t…

Published: October 22, 2025

Downloadable IOCs: 1

From infostealer to full RAT: dissecting the PureRAT attack chain

An investigation into what appeared at first glance to be a “standard” Python-based infostealer campaign took an interesting turn when it was discovered to culminate in the deployment of a full-featured, commercially available remote access trojan (RAT) known as PureRAT.

Published: October 10, 2025

Downloadable IOCs: 7

Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users | Trend Micro (US)

SORVEPOTEL has been observed to spread across Windows systems through convincing phishing messages with malicious ZIP file attachments. Interestingly, the phishing message that contains the malicious file attachment requires users to open it on a desktop, suggesting that threat actors might be more…

Published: October 6, 2025

Downloadable IOCs: 23

Noodlophile Stealer Evolves: Targeted Copyright Phishing Hits Enterprises with Social Media Footprints

The Noodlophile Stealer, first detailed in our previous analysis (New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms), has evolved into a highly targeted threat exploiting enterprises with significant Facebook footprints.

Published: August 19, 2025

Downloadable IOCs: 28

Ghost in the Zip | New PXA Stealer and Its Telegram-Powered Ecosystem

SentinelLABS and Beazley Security uncovered a series of infostealer campaigns delivering the Python-based PXA Stealer. The malware, which first appeared in late 2024, has evolved to incorporate sophisticated anti-analysis techniques and a hardened command-and-control infrastructure. Over 4,000 uniq…

python

infostealer

data theft

credential harvesting

2025-08-04

pxa stealer

Published: August 4, 2025

Downloadable IOCs: 5

RAVEN STEALER UNMASKED: Telegram-Based Data Exfiltration

Raven Stealer is a modern information-stealing malware developed in Delphi and C++, designed to extract sensitive data from victim machines. It targets Chromium-based browsers, extracting passwords, cookies, payment details, and autofill information. The malware uses a modular architecture and a bu…

Published: August 1, 2025

Downloadable IOCs: 0

Strategic Pivot: From Browser Stealer to Data Exfiltration Platform During Critical Ukraine Negotiations

The cyber-espionage group UAC-0226 has significantly evolved its GIFTEDCROOK malware from a basic browser data stealer to a robust intelligence-gathering tool. Three versions were identified between April-June 2025, with the latest iterations capable of exfiltrating a wide range of sensitive docume…

Published: June 27, 2025

Linked vulnerabilities : CVE-2025-5777 (CVSS 9.3)

Downloadable IOCs: 11

Understanding CyberEYE RAT Builder: Capabilities and Implications

CyberEye is a modular, .NET-based Remote Access Trojan that utilizes Telegram for Command and Control, eliminating the need for attackers to maintain their own infrastructure. It offers a wide array of surveillance and data theft capabilities, including keylogging, file grabbing, and clipboard hija…

windows defender evasion

telegramrat

Published: June 13, 2025

Downloadable IOCs: 0

Analysis of the Triple Combo Threat of the Kimsuky Group

The Genians Security Center (GSC) detected an APT (Advanced Persistent Threat) campaign targeting users of Facebook, email, and Telegram in Korea between March and April 2025. The threat actor explored reconnaissance and selected attack targets through two Facebook accounts.

Published: June 11, 2025

Downloadable IOCs: 14

Blitz Malware: A Tale of Game Cheats and Code Repositories

Blitz is a new Windows-based malware discovered in 2024 consisting of a downloader and bot payload. The latest version was spread through backdoored game cheats for Standoff 2 distributed via Telegram. Blitz abuses Hugging Face Spaces to host components of its C2 infrastructure and payloads. The ma…

xmrig

ddos

information stealing

cryptocurrency mining

Published: June 6, 2025

Downloadable IOCs: 80

The strange tale of ischhfd83: When cybercriminals eat their own

This investigation uncovered a large-scale campaign involving backdoored GitHub repositories targeting game cheaters and inexperienced cybercriminals. The threat actor, possibly linked to a Distribution-as-a-Service operation, uses multiple types of backdoors and a convoluted infection chain leadin…

Published: June 4, 2025

Downloadable IOCs: 52

How Adversary Telegram Bots Help to Reveal Threats: Case Study

This analysis examines a phishing campaign targeting Italian and US users, focusing on credential harvesting for Microsoft services and Italy's PEC system. The attackers use Notion workspaces and other cloud platforms to host phishing pages, exfiltrating stolen data via Telegram bots. The campaign,…

phishing

exfiltration

credential harvesting

Published: May 21, 2025

Downloadable IOCs: 16

Tales from the cloud trenches: The Attacker doth persist too much, methinks

A leaked AWS access key led to malicious activities over a 150-minute period, involving five distinct IP addresses. The attackers employed both common and innovative tactics, including creating 'persistence-as-a-service' infrastructure, manipulating AWS Identity Center, and disabling organization-l…

Published: May 13, 2025

Downloadable IOCs: 5

Recruitment Scams on the Rise: How Threat Actors Exploit Job Seekers

A significant increase in recruitment scams has been observed, with three distinct threat actors targeting job seekers. The first impersonates tech employers using advance fee fraud tactics. The second poses as a logistics recruitment agency, targeting 18 geographies and affecting 63,000 people in …

Published: May 12, 2025

Downloadable IOCs: 0

Gremlin Stealer: New Stealer on Sale in Underground Forum

A new information-stealing malware called Gremlin Stealer, written in C#, has been identified by researchers. Advertised on Telegram since March 2025, it targets a wide range of data including browser information, crypto wallets, FTP and VPN credentials. The malware exfiltrates stolen data to a web…

Published: April 29, 2025

Downloadable IOCs: 2

Power Parasites: Job & Investment Scam Campaign Targets Energy Companies and Major Brands

A scam campaign dubbed 'Power Parasites' is targeting individuals in Asian countries through deceptive websites, social media groups, and Telegram channels. The campaign exploits the names and branding of global energy companies and other major brands to conduct job and investment scams. Victims ar…

Published: April 24, 2025

Downloadable IOCs: 0

PE32 Ransomware: A New Telegram-Based Threat on the Rise

PE32 Ransomware is a new strain of malware that utilizes Telegram for command and control. Despite its amateur execution, it effectively encrypts files and causes significant damage. The ransomware features a unique two-tiered payment model, demanding one fee to unlock files and another to prevent …

exposed infrastructure

Published: April 22, 2025

Downloadable IOCs: 5

Russian-Speaking Threat Actor Abuses Cloudflare & Telegram in Phishing Campaign

A Russian-speaking threat actor has launched a new phishing campaign using Cloudflare-branded pages themed around DMCA takedown notices. The attack abuses the ms-search protocol to deliver malicious LNK files disguised as PDFs. Once executed, the malware communicates with a Telegram bot to report t…

Published: April 4, 2025

Downloadable IOCs: 0

Investigating Scam Crypto Investment Platforms Using Pyramid Schemes to Defraud Victims

A campaign distributing thousands of fraudulent cryptocurrency investment platforms via websites and mobile applications has been uncovered. The operation impersonates well-known brands and organizations, luring victims with unrealistic promises of high returns. The consistent design of the platfor…

Published: March 13, 2025

Downloadable IOCs: 36

Bloody Wolf evolution: new targets, new tools

Bloody Wolf, a notorious threat actor, has shifted its tactics by replacing malware with the legitimate remote administration tool NetSupport. The group has expanded its targets to include organizations in both Kazakhstan and Russia, compromising over 400 systems. Their attack method involves phish…

remote administration

jar files

Published: February 20, 2025

Downloadable IOCs: 0

FinStealer

A sophisticated malware campaign exploits a leading Indian bank's brand through fraudulent mobile applications. Distributed via phishing links and social engineering, these fake apps mimic legitimate bank apps, tricking users into revealing sensitive information. The malware uses advanced evasion t…

trojan.rewardsteal/joxpk

CVE-2011-2688

Published: February 17, 2025

Linked vulnerabilities : CVE-2011-2688

Downloadable IOCs: 5

Tria stealer targets Android users for SMS exfiltration and financial gain

Since mid-2024, a malicious Android campaign dubbed 'Tria Stealer' has been targeting users in Malaysia and Brunei using wedding invitation lures. The malware collects SMS data, call logs, messages from apps like WhatsApp, and email data from Gmail and Outlook. It exfiltrates this information to Te…

Published: January 30, 2025

Downloadable IOCs: 3

Unveiling Silent Lynx APT Targeting Entities Across Kyrgyzstan & Neighboring Nations

A new threat group dubbed Silent Lynx has been uncovered targeting entities in Kyrgyzstan and neighboring nations. The group, believed to be Kazakhstan-based, employs sophisticated multi-stage attack strategies using ISO files, C++ loaders, PowerShell scripts, and Golang implants. Their campaigns f…

xerox_scan17510875802718752175.exe

kyrgyzstan

resocks

Published: January 21, 2025

Downloadable IOCs: 12

Sneaky 2FA: exposing a new AiTM Phishing-as-a-Service

A new Adversary-in-the-Middle (AiTM) phishing kit called Sneaky 2FA has been discovered targeting Microsoft 365 accounts. The kit is sold as Phishing-as-a-Service by a cybercrime service called Sneaky Log, which operates via a Telegram bot. Sneaky 2FA uses anti-bot and anti-analysis features, authe…

Published: January 17, 2025

Downloadable IOCs: 26

Araneida Scanner: Cracked Acunetix Web App & API Scanner Discovered

Silent Push Threat Analysts have uncovered the Araneida Scanner, a cracked version of Acunetix being used for illegal purposes. The scanner is employed for offensive reconnaissance, user data scraping, and vulnerability exploitation. It was detected during a partner's reconnaissance effort, prompti…

Published: December 20, 2024

Downloadable IOCs: 13

Python-Based NodeStealer Version Targets Facebook Ads Manager

The latest variant of NodeStealer has evolved from JavaScript to Python, expanding its data theft capabilities. Trend Micro's MXDR team uncovered this advanced version in a campaign targeting a Malaysian educational institution, linked to a Vietnamese threat group. The malware now targets Facebook …

Published: December 19, 2024

Downloadable IOCs: 5

Hacktivists attack Russian organizations using rare RATs

The Cyber Anarchy Squad (C.A.S) is a hacktivist group targeting Russian and Belarusian organizations since 2022. They exploit vulnerabilities in public services and use free tools to inflict maximum damage. The group employs rare remote access Trojans like Revenge RAT and Spark RAT, alongside commo…

Published: December 18, 2024

Downloadable IOCs: 0

CURLing for Crypto on Honeypots

An analysis of honeypot activity reveals a pattern of repeated curl commands targeting various websites, primarily originating from a single IP address. The commands, executed on multiple honeypots, focus on cryptocurrency-related sites, bot construction platforms, and communication services. The a…

Published: December 9, 2024

Downloadable IOCs: 37

Matrix Unleashes A New Widespread DDoS Campaign

A new widespread Distributed Denial-of-Service (DDoS) campaign orchestrated by a threat actor named Matrix has been uncovered. The operation combines public scripts, brute-force attacks, and exploitation of weak credentials to create a botnet capable of global disruption. Matrix targets vulnerabili…

vulnerability exploitation

Published: November 27, 2024

Linked vulnerabilities : CVE-2024-27348, CVE-2021-20090, CVE-2022-30525, CVE-2018-10562, CVE-2018-10561, CVE-2022-30075, CVE-2018-9995, CVE-2017-17106, CVE-2017-18368, CVE-2014-8361, CVE-2017-17215

Downloadable IOCs: 12

Python Crypto Library Updated to Steal Private Keys

Phylum's automated risk detection platform discovered that the PyPI package aiocpa was updated to include malicious code that steals private keys by exfiltrating them through Telegram when users initialize the crypto library.

Published: November 26, 2024

Downloadable IOCs: 4

Telekopye transitions to targeting tourists via hotel booking scam

ESET researchers have discovered that Telekopye, a Telegram-based toolkit used by cybercriminals to scam people on online marketplaces, has expanded its operations to target users of popular accommodation booking platforms like Booking.com and Airbnb. The scammers, referred to as Neanderthals, now …

Published: November 17, 2024

Downloadable IOCs: 0

Russian Hackers Attacking Ukraine Military With Malware Via Telegram

Russian hackers, identified as UNC5812, are targeting the Ukrainian military through a sophisticated cyber operation. The attackers use a deceptive Telegram channel and website posing as a civil defense service to distribute malware for both Windows and Android devices. The Windows attack deploys P…

Published: October 31, 2024

Downloadable IOCs: 7

Hybrid Russian Espionage and Influence Campaign Aims to Compromise Ukrainian Military Recruits and Deliver Anti-Mobilization Narratives

A Russian hybrid espionage and influence operation, dubbed UNC5812, targets potential Ukrainian military recruits through a Telegram persona called 'Civil Defense'. The campaign delivers Windows and Android malware, including SUNSPINNER, PURESTEALER, and CRAXSRAT, while simultaneously spreading ant…

Published: October 28, 2024

Linked vulnerabilities : CVE-2024-47575 (CVSS 9.8)

Downloadable IOCs: 3

Core Werewolf hones its arsenal against Russia’s government organizations

BI.ZONE Threat Intelligence continues monitoring a threat actor called Core Werewolf, which has targeted Russia's defense industry and critical infrastructure since 2021. In its recent campaigns, the adversary employed a new loader written in AutoIt and started delivering malicious files via Telegr…

Published: October 14, 2024

Downloadable IOCs: 25

Arsenal honed against Russia's government organizations

Core Werewolf, a threat actor targeting Russia's defense industry and critical infrastructure since 2021, has evolved its tactics. The group now employs a new loader written in AutoIt and has expanded its delivery methods to include Telegram alongside email. Their campaign involves RAR archives con…

critical infrastructure

sfx executables

rar archives

Published: October 11, 2024

Downloadable IOCs: 25

Key Group uses leaked builders of ransomware and wipers

Key Group, also known as keygroup777, is a financially motivated ransomware group primarily targeting Russian users. The group has been active since 2022, using various leaked ransomware builders and wipers, including Xorist, Chaos, Annabelle, Slam, RuRansom, UX-Cryptor, Hakuna Matata, and Judge/No…

Published: October 2, 2024

Downloadable IOCs: 24

Key Group: another ransomware group using leaked builders

Key Group is a financially motivated ransomware group primarily targeting Russian users. They use various leaked ransomware builders including Chaos, Xorist, Annabelle, Slam, RuRansom, UX-Cryptor, Hakuna Matata, and Judge/NoCry. The group's activity has been tracked since April 2022, with their tac…

financially motivated

Published: October 1, 2024

Downloadable IOCs: 0

A Comprehensive Analysis of Angry Stealer: Rage Stealer in a New Disguise

CYFIRMA's research team recently identified a sophisticated dropper binary designed to deploy an information stealer, dubbed 'Angry Stealer,' actively advertised on Telegram and other online platforms. The stealer targets sensitive data from browsers, cryptocurrency wallets, VPN credentials, and sy…

Published: August 28, 2024

Downloadable IOCs: 2

Cursed tapes: Exploiting the EvilVideo vulnerability on Telegram for Android

ESET researchers discovered a vulnerability named EvilVideo that allows attackers to share malicious Android payloads disguised as video files through Telegram for Android. The exploit makes the malicious files appear as multimedia content, tricking users into installing malware. The vulnerability …

Published: July 23, 2024

Downloadable IOCs: 1

Braodo Info Stealer Targeting Vietnam and Abroad

CYFIRMA discovered Braodo Stealer, a Python-based malware active since early 2024, primarily targeting users in Vietnam but also present in the US, Czechia, Germany, Netherlands, Singapore, and the UK. This malware utilizes GitHub and a Singapore-based VPS server to host and distribute its maliciou…

Published: July 15, 2024

Downloadable IOCs: 14

Tag: telegram

Attack reports

UNG0801: Tracking Threat Clusters obsessed with AV Icon Spoofing targeting Israel

Technical Analysis of the BlackForce Phishing Kit

New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2

Operation Dragon Breath (APT-Q-27): Dimensional Reduction Attack Against the Gambling Industry

New Python RAT Targets Gamers via Minecraft

From infostealer to full RAT: dissecting the PureRAT attack chain

Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users | Trend Micro (US)

Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users

Werewolf raids Russia's public sector with trusted relationship attacks

Olymp Loader: A new Malware-as-a-Service written in Assembly

ZynorRAT technical analysis: Reverse engineering a novel, Turkish Go-based RAT

MuddyWater Leveraging DCHSpy For Israel-Iran Conflict

Noodlophile Stealer Evolves: Targeted Copyright Phishing Hits Enterprises with Social Media Footprints

Ghost in the Zip | New PXA Stealer and Its Telegram-Powered Ecosystem

RAVEN STEALER UNMASKED: Telegram-Based Data Exfiltration

Strategic Pivot: From Browser Stealer to Data Exfiltration Platform During Critical Ukraine Negotiations

Understanding CyberEYE RAT Builder: Capabilities and Implications

Analysis of the Triple Combo Threat of the Kimsuky Group

Blitz Malware: A Tale of Game Cheats and Code Repositories

The strange tale of ischhfd83: When cybercriminals eat their own

How Adversary Telegram Bots Help to Reveal Threats: Case Study

Tales from the cloud trenches: The Attacker doth persist too much, methinks

Recruitment Scams on the Rise: How Threat Actors Exploit Job Seekers

Gremlin Stealer: New Stealer on Sale in Underground Forum

Power Parasites: Job & Investment Scam Campaign Targets Energy Companies and Major Brands

PE32 Ransomware: A New Telegram-Based Threat on the Rise

Russian-Speaking Threat Actor Abuses Cloudflare & Telegram in Phishing Campaign

Investigating Scam Crypto Investment Platforms Using Pyramid Schemes to Defraud Victims

Bloody Wolf evolution: new targets, new tools

FinStealer

Tria stealer targets Android users for SMS exfiltration and financial gain

Unveiling Silent Lynx APT Targeting Entities Across Kyrgyzstan & Neighboring Nations

Sneaky 2FA: exposing a new AiTM Phishing-as-a-Service

Araneida Scanner: Cracked Acunetix Web App & API Scanner Discovered

Python-Based NodeStealer Version Targets Facebook Ads Manager

Hacktivists attack Russian organizations using rare RATs

CURLing for Crypto on Honeypots

Matrix Unleashes A New Widespread DDoS Campaign

Python Crypto Library Updated to Steal Private Keys

Telekopye transitions to targeting tourists via hotel booking scam

Russian Hackers Attacking Ukraine Military With Malware Via Telegram

Hybrid Russian Espionage and Influence Campaign Aims to Compromise Ukrainian Military Recruits and Deliver Anti-Mobilization Narratives

Core Werewolf hones its arsenal against Russia’s government organizations

Arsenal honed against Russia's government organizations

Key Group uses leaked builders of ransomware and wipers

Key Group: another ransomware group using leaked builders

A Comprehensive Analysis of Angry Stealer: Rage Stealer in a New Disguise

Cursed tapes: Exploiting the EvilVideo vulnerability on Telegram for Android

Braodo Info Stealer Targeting Vietnam and Abroad